fix(cli): address Copilot review feedback

- Align error message wording to say "retry HTTP client" in loadConfig
- Add token_type_hint assertions to revocation tests for RFC 7009 compliance

Author: appleboy

config.go

@@ -236,7 +236,7 @@ func loadConfig() *AppConfig {
 	var err error
 	cfg.RetryClient, err = retry.NewBackgroundClient(retry.WithHTTPClient(baseHTTPClient))
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: failed to create HTTP client: %v\n", err)
+		fmt.Fprintf(os.Stderr, "Error: failed to create retry HTTP client: %v\n", err)
 		os.Exit(1)
 	}
 

token_cmd_test.go

@@ -106,7 +106,11 @@ func TestRunTokenDelete(t *testing.T) {
 
 func TestRunTokenDelete_ServerRevocation(t *testing.T) {
 	t.Run("successful revocation and local delete", func(t *testing.T) {
-		var revokedTokens []string
+		type revokeCall struct {
+			token         string
+			tokenTypeHint string
+		}
+		var revokeCalls []revokeCall
 		var mu sync.Mutex
 		srv := httptest.NewServer(
 			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -115,7 +119,10 @@ func TestRunTokenDelete_ServerRevocation(t *testing.T) {
 					return
 				}
 				mu.Lock()
-				revokedTokens = append(revokedTokens, r.FormValue("token"))
+				revokeCalls = append(revokeCalls, revokeCall{
+					token:         r.FormValue("token"),
+					tokenTypeHint: r.FormValue("token_type_hint"),
+				})
 				mu.Unlock()
 				w.WriteHeader(http.StatusOK)
 			}),
@@ -163,16 +170,24 @@ func TestRunTokenDelete_ServerRevocation(t *testing.T) {
 
 		mu.Lock()
 		defer mu.Unlock()
-		if len(revokedTokens) != 2 {
-			t.Fatalf("expected 2 revoke calls, got %d", len(revokedTokens))
+		if len(revokeCalls) != 2 {
+			t.Fatalf("expected 2 revoke calls, got %d", len(revokeCalls))
 		}
 		// Revocations run concurrently, so order is non-deterministic.
-		got := map[string]bool{revokedTokens[0]: true, revokedTokens[1]: true}
-		if !got["refresh-456"] {
-			t.Errorf("expected refresh token to be revoked, got %v", revokedTokens)
+		// Build a map from token to its type hint for assertion.
+		hintByToken := make(map[string]string, len(revokeCalls))
+		for _, c := range revokeCalls {
+			hintByToken[c.token] = c.tokenTypeHint
+		}
+		if hint, ok := hintByToken["refresh-456"]; !ok {
+			t.Errorf("expected refresh token to be revoked, got %v", revokeCalls)
+		} else if hint != "refresh_token" {
+			t.Errorf("refresh token_type_hint: got %q, want %q", hint, "refresh_token")
 		}
-		if !got["access-123"] {
-			t.Errorf("expected access token to be revoked, got %v", revokedTokens)
+		if hint, ok := hintByToken["access-123"]; !ok {
+			t.Errorf("expected access token to be revoked, got %v", revokeCalls)
+		} else if hint != "access_token" {
+			t.Errorf("access token_type_hint: got %q, want %q", hint, "access_token")
 		}
 	})
 
@@ -269,16 +284,20 @@ func TestRunTokenDelete_ServerRevocation(t *testing.T) {
 	})
 
 	t.Run("only access token no refresh token", func(t *testing.T) {
-		var revokedTokens []string
-		var mu sync.Mutex
+		var (
+			gotToken         string
+			gotTokenTypeHint string
+			mu               sync.Mutex
+		)
 		srv := httptest.NewServer(
 			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				if err := r.ParseForm(); err != nil {
 					http.Error(w, "bad form", http.StatusBadRequest)
 					return
 				}
 				mu.Lock()
-				revokedTokens = append(revokedTokens, r.FormValue("token"))
+				gotToken = r.FormValue("token")
+				gotTokenTypeHint = r.FormValue("token_type_hint")
 				mu.Unlock()
 				w.WriteHeader(http.StatusOK)
 			}),
@@ -319,11 +338,11 @@ func TestRunTokenDelete_ServerRevocation(t *testing.T) {
 
 		mu.Lock()
 		defer mu.Unlock()
-		if len(revokedTokens) != 1 {
-			t.Fatalf("expected 1 revoke call (access only), got %d", len(revokedTokens))
+		if gotToken != "access-only" {
+			t.Errorf("token: got %q, want %q", gotToken, "access-only")
 		}
-		if revokedTokens[0] != "access-only" {
-			t.Errorf("expected access token, got %q", revokedTokens[0])
+		if gotTokenTypeHint != "access_token" {
+			t.Errorf("token_type_hint: got %q, want %q", gotTokenTypeHint, "access_token")
 		}
 	})
 }