token_cmd_test.go

package main

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	retry "github.com/appleboy/go-httpretry"
	"github.com/go-authgate/sdk-go/credstore"
	"github.com/go-authgate/sdk-go/oauth"
)

func TestRunTokenDelete(t *testing.T) {
	tests := []struct {
		name      string
		setup     func(credstore.Store[credstore.Token])
		wantCode  int
		checkOut  func(t *testing.T, out string)
		checkErr  func(t *testing.T, errOut string)
		postCheck func(t *testing.T, store credstore.Store[credstore.Token])
	}{
		{
			name: "token exists delete succeeds",
			setup: func(s credstore.Store[credstore.Token]) {
				if err := s.Save("test-id", credstore.Token{
					AccessToken: "my-access-token",
					ExpiresAt:   time.Now().Add(time.Hour),
					ClientID:    "test-id",
				}); err != nil {
					t.Fatalf("setup: failed to save token: %v", err)
				}
			},
			wantCode: 0,
			checkOut: func(t *testing.T, out string) {
				if !strings.Contains(out, "deleted") {
					t.Errorf("expected 'deleted' in stdout, got: %q", out)
				}
			},
		},
		{
			name:     "no token stored",
			setup:    func(s credstore.Store[credstore.Token]) {},
			wantCode: 1,
			checkErr: func(t *testing.T, errOut string) {
				if !strings.Contains(errOut, "no stored token") {
					t.Errorf("expected 'no stored token' in stderr, got: %q", errOut)
				}
			},
		},
		{
			name: "delete then load returns not found",
			setup: func(s credstore.Store[credstore.Token]) {
				if err := s.Save("test-id", credstore.Token{
					AccessToken: "my-access-token",
					ExpiresAt:   time.Now().Add(time.Hour),
					ClientID:    "test-id",
				}); err != nil {
					t.Fatalf("setup: failed to save token: %v", err)
				}
			},
			wantCode: 0,
			postCheck: func(t *testing.T, store credstore.Store[credstore.Token]) {
				_, err := store.Load("test-id")
				if !errors.Is(err, credstore.ErrNotFound) {
					t.Errorf("expected ErrNotFound after delete, got: %v", err)
				}
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			store := credstore.NewTokenFileStore(
				filepath.Join(t.TempDir(), "tokens.json"),
			)
			tc.setup(store)
			cfg := &AppConfig{ClientID: "test-id", Store: store}
			var stdout, stderr bytes.Buffer
			code := runTokenDelete(
				context.Background(), cfg, true, &stdout, &stderr,
			)
			if code != tc.wantCode {
				t.Errorf("exit code: got %d, want %d", code, tc.wantCode)
			}
			if tc.checkOut != nil {
				tc.checkOut(t, stdout.String())
			}
			if tc.checkErr != nil {
				tc.checkErr(t, stderr.String())
			}
			if tc.postCheck != nil {
				tc.postCheck(t, store)
			}
		})
	}
}

func TestRunTokenDelete_ServerRevocation(t *testing.T) {
	t.Run("successful revocation and local delete", func(t *testing.T) {
		type revokeCall struct {
			token         string
			tokenTypeHint string
		}
		var revokeCalls []revokeCall
		var mu sync.Mutex
		srv := httptest.NewServer(
			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				if err := r.ParseForm(); err != nil {
					http.Error(w, "bad form", http.StatusBadRequest)
					return
				}
				mu.Lock()
				revokeCalls = append(revokeCalls, revokeCall{
					token:         r.FormValue("token"),
					tokenTypeHint: r.FormValue("token_type_hint"),
				})
				mu.Unlock()
				w.WriteHeader(http.StatusOK)
			}),
		)
		defer srv.Close()

		rc, err := retry.NewClient()
		if err != nil {
			t.Fatal(err)
		}
		store := credstore.NewTokenFileStore(
			filepath.Join(t.TempDir(), "tokens.json"),
		)
		if err := store.Save("test-id", credstore.Token{
			AccessToken:  "access-123",
			RefreshToken: "refresh-456",
			ExpiresAt:    time.Now().Add(time.Hour),
			ClientID:     "test-id",
		}); err != nil {
			t.Fatal(err)
		}

		cfg := &AppConfig{
			ClientID:          "test-id",
			ServerURL:         srv.URL,
			Endpoints:         oauth.Endpoints{RevocationURL: srv.URL + "/oauth/revoke"},
			RevocationTimeout: defaultRevocationTimeout,
			RetryClient:       rc,
			Store:             store,
		}

		var stdout, stderr bytes.Buffer
		code := runTokenDelete(
			context.Background(), cfg, false, &stdout, &stderr,
		)
		if code != 0 {
			t.Fatalf("exit code: got %d, want 0; stderr: %s", code, stderr.String())
		}
		if !strings.Contains(stdout.String(), "revoked on server") {
			t.Errorf("expected 'revoked on server' in stdout, got: %q", stdout.String())
		}
		if !strings.Contains(stdout.String(), "deleted") {
			t.Errorf("expected 'deleted' in stdout, got: %q", stdout.String())
		}

		mu.Lock()
		defer mu.Unlock()
		if len(revokeCalls) != 2 {
			t.Fatalf("expected 2 revoke calls, got %d", len(revokeCalls))
		}
		// Revocations run concurrently, so order is non-deterministic.
		// Build a map from token to its type hint for assertion.
		hintByToken := make(map[string]string, len(revokeCalls))
		for _, c := range revokeCalls {
			hintByToken[c.token] = c.tokenTypeHint
		}
		if hint, ok := hintByToken["refresh-456"]; !ok {
			t.Errorf("expected refresh token to be revoked, got %v", revokeCalls)
		} else if hint != "refresh_token" {
			t.Errorf("refresh token_type_hint: got %q, want %q", hint, "refresh_token")
		}
		if hint, ok := hintByToken["access-123"]; !ok {
			t.Errorf("expected access token to be revoked, got %v", revokeCalls)
		} else if hint != "access_token" {
			t.Errorf("access token_type_hint: got %q, want %q", hint, "access_token")
		}
	})

	t.Run("server error graceful degradation", func(t *testing.T) {
		srv := httptest.NewServer(
			http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
				w.WriteHeader(http.StatusInternalServerError)
			}),
		)
		defer srv.Close()

		rc, err := retry.NewClient()
		if err != nil {
			t.Fatal(err)
		}
		store := credstore.NewTokenFileStore(
			filepath.Join(t.TempDir(), "tokens.json"),
		)
		if err := store.Save("test-id", credstore.Token{
			AccessToken: "access-123",
			ExpiresAt:   time.Now().Add(time.Hour),
			ClientID:    "test-id",
		}); err != nil {
			t.Fatal(err)
		}

		cfg := &AppConfig{
			ClientID:          "test-id",
			ServerURL:         srv.URL,
			Endpoints:         oauth.Endpoints{RevocationURL: srv.URL + "/oauth/revoke"},
			RevocationTimeout: defaultRevocationTimeout,
			RetryClient:       rc,
			Store:             store,
		}

		var stdout, stderr bytes.Buffer
		code := runTokenDelete(
			context.Background(), cfg, false, &stdout, &stderr,
		)
		if code != 0 {
			t.Fatalf("exit code: got %d, want 0", code)
		}
		if !strings.Contains(stderr.String(), "Warning") {
			t.Errorf("expected warning in stderr, got: %q", stderr.String())
		}
		if !strings.Contains(stdout.String(), "deleted") {
			t.Errorf("token should still be deleted locally, got: %q", stdout.String())
		}
	})

	t.Run("local-only skips server call", func(t *testing.T) {
		var serverCalled atomic.Bool
		srv := httptest.NewServer(
			http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
				serverCalled.Store(true)
				w.WriteHeader(http.StatusOK)
			}),
		)
		defer srv.Close()

		rc, err := retry.NewClient()
		if err != nil {
			t.Fatal(err)
		}
		store := credstore.NewTokenFileStore(
			filepath.Join(t.TempDir(), "tokens.json"),
		)
		if err := store.Save("test-id", credstore.Token{
			AccessToken: "access-123",
			ExpiresAt:   time.Now().Add(time.Hour),
			ClientID:    "test-id",
		}); err != nil {
			t.Fatal(err)
		}

		cfg := &AppConfig{
			ClientID:          "test-id",
			Endpoints:         oauth.Endpoints{RevocationURL: srv.URL + "/oauth/revoke"},
			RevocationTimeout: defaultRevocationTimeout,
			RetryClient:       rc,
			Store:             store,
		}

		var stdout, stderr bytes.Buffer
		code := runTokenDelete(
			context.Background(), cfg, true, &stdout, &stderr,
		)
		if code != 0 {
			t.Fatalf("exit code: got %d, want 0", code)
		}
		if serverCalled.Load() {
			t.Error("server should not have been called with --local-only")
		}
	})

	t.Run("only access token no refresh token", func(t *testing.T) {
		var (
			callCount        int
			gotToken         string
			gotTokenTypeHint string
			mu               sync.Mutex
		)
		srv := httptest.NewServer(
			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				if err := r.ParseForm(); err != nil {
					http.Error(w, "bad form", http.StatusBadRequest)
					return
				}
				mu.Lock()
				callCount++
				gotToken = r.FormValue("token")
				gotTokenTypeHint = r.FormValue("token_type_hint")
				mu.Unlock()
				w.WriteHeader(http.StatusOK)
			}),
		)
		defer srv.Close()

		rc, err := retry.NewClient()
		if err != nil {
			t.Fatal(err)
		}
		store := credstore.NewTokenFileStore(
			filepath.Join(t.TempDir(), "tokens.json"),
		)
		if err := store.Save("test-id", credstore.Token{
			AccessToken: "access-only",
			ExpiresAt:   time.Now().Add(time.Hour),
			ClientID:    "test-id",
		}); err != nil {
			t.Fatal(err)
		}

		cfg := &AppConfig{
			ClientID:          "test-id",
			ServerURL:         srv.URL,
			Endpoints:         oauth.Endpoints{RevocationURL: srv.URL + "/oauth/revoke"},
			RevocationTimeout: defaultRevocationTimeout,
			RetryClient:       rc,
			Store:             store,
		}

		var stdout, stderr bytes.Buffer
		code := runTokenDelete(
			context.Background(), cfg, false, &stdout, &stderr,
		)
		if code != 0 {
			t.Fatalf("exit code: got %d, want 0", code)
		}

		mu.Lock()
		defer mu.Unlock()
		if callCount != 1 {
			t.Fatalf("expected 1 revoke call (access only), got %d", callCount)
		}
		if gotToken != "access-only" {
			t.Errorf("token: got %q, want %q", gotToken, "access-only")
		}
		if gotTokenTypeHint != "access_token" {
			t.Errorf("token_type_hint: got %q, want %q", gotTokenTypeHint, "access_token")
		}
	})
}

func TestRunTokenGet(t *testing.T) {
	tests := []struct {
		name     string
		setup    func(credstore.Store[credstore.Token])
		jsonOut  bool
		wantCode int
		checkOut func(t *testing.T, out string)
		checkErr func(t *testing.T, errOut string)
	}{
		{
			name: "token found plain output",
			setup: func(s credstore.Store[credstore.Token]) {
				if err := s.Save("test-id", credstore.Token{
					AccessToken: "my-access-token",
					ExpiresAt:   time.Now().Add(time.Hour),
					ClientID:    "test-id",
				}); err != nil {
					t.Fatalf("setup: failed to save token: %v", err)
				}
			},
			jsonOut:  false,
			wantCode: 0,
			checkOut: func(t *testing.T, out string) {
				if out != "my-access-token\n" {
					t.Errorf("got %q, want %q", out, "my-access-token\n")
				}
			},
		},
		{
			name: "token found json output",
			setup: func(s credstore.Store[credstore.Token]) {
				if err := s.Save("test-id", credstore.Token{
					AccessToken: "my-access-token",
					ExpiresAt:   time.Now().Add(time.Hour),
					ClientID:    "test-id",
				}); err != nil {
					t.Fatalf("setup: failed to save token: %v", err)
				}
			},
			jsonOut:  true,
			wantCode: 0,
			checkOut: func(t *testing.T, out string) {
				var result tokenGetOutput
				if err := json.Unmarshal([]byte(out), &result); err != nil {
					t.Fatalf("invalid JSON: %v", err)
				}
				if result.AccessToken != "my-access-token" {
					t.Errorf("access_token: got %q", result.AccessToken)
				}
				if result.Expired {
					t.Error("expected expired=false")
				}
			},
		},
		{
			name:     "no token stored",
			setup:    func(s credstore.Store[credstore.Token]) {},
			jsonOut:  false,
			wantCode: 1,
			checkErr: func(t *testing.T, errOut string) {
				if !strings.Contains(errOut, "no stored token") {
					t.Errorf("expected 'no stored token' in stderr, got: %q", errOut)
				}
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			store := credstore.NewTokenFileStore(
				filepath.Join(t.TempDir(), "tokens.json"),
			)
			tc.setup(store)
			var stdout, stderr bytes.Buffer
			code := runTokenGet(store, "test-id", tc.jsonOut, &stdout, &stderr)
			if code != tc.wantCode {
				t.Errorf("exit code: got %d, want %d", code, tc.wantCode)
			}
			if tc.checkOut != nil {
				tc.checkOut(t, stdout.String())
			}
			if tc.checkErr != nil {
				tc.checkErr(t, stderr.String())
			}
		})
	}
}