Main coves client
bretton.dev
1import 'package:coves_flutter/services/coves_api_service.dart';
2import 'package:dio/dio.dart';
3import 'package:flutter_test/flutter_test.dart';
4import 'package:http_mock_adapter/http_mock_adapter.dart';
5
6void main() {
7 TestWidgetsFlutterBinding.ensureInitialized();
8
9 group('CovesApiService - Token Refresh on 401', () {
10 late Dio dio;
11 late DioAdapter dioAdapter;
12 late CovesApiService apiService;
13
14 // Track token refresh and sign-out calls
15 int tokenRefreshCallCount = 0;
16 int signOutCallCount = 0;
17 String currentToken = 'initial-token';
18 bool shouldRefreshSucceed = true;
19
20 // Mock token getter
21 Future<String?> mockTokenGetter() async {
22 return currentToken;
23 }
24
25 // Mock token refresher
26 Future<bool> mockTokenRefresher() async {
27 tokenRefreshCallCount++;
28 if (shouldRefreshSucceed) {
29 // Simulate successful refresh by updating the token
30 currentToken = 'refreshed-token';
31 return true;
32 }
33 return false;
34 }
35
36 // Mock sign-out handler
37 Future<void> mockSignOutHandler() async {
38 signOutCallCount++;
39 }
40
41 setUp(() {
42 dio = Dio(BaseOptions(baseUrl: 'https://api.test.coves.social'));
43 dioAdapter = DioAdapter(dio: dio);
44
45 // Reset counters and state
46 tokenRefreshCallCount = 0;
47 signOutCallCount = 0;
48 currentToken = 'initial-token';
49 shouldRefreshSucceed = true;
50
51 apiService = CovesApiService(
52 dio: dio,
53 tokenGetter: mockTokenGetter,
54 tokenRefresher: mockTokenRefresher,
55 signOutHandler: mockSignOutHandler,
56 );
57 });
58
59 tearDown(() {
60 apiService.dispose();
61 });
62
63 test('should call token refresher on 401 response but only retry once', () async {
64 // This test verifies the interceptor detects 401, calls the refresher,
65 // and only retries ONCE to prevent infinite loops (even if retry returns 401).
66
67 const postUri = 'at://did:plc:test/social.coves.post.record/123';
68
69 // Mock will always return 401 (simulates scenario where even refresh doesn't help)
70 dioAdapter.onGet(
71 '/xrpc/social.coves.community.comment.getComments',
72 (server) => server.reply(401, {
73 'error': 'Unauthorized',
74 'message': 'Token expired',
75 }),
76 queryParameters: {
77 'post': postUri,
78 'sort': 'hot',
79 'depth': 10,
80 'limit': 50,
81 },
82 );
83
84 // Make the request and expect it to fail (mock keeps returning 401)
85 expect(
86 () => apiService.getComments(postUri: postUri),
87 throwsA(isA<Exception>()),
88 );
89
90 // Wait for async operations
91 await Future.delayed(const Duration(milliseconds: 100));
92
93 // Verify token refresh was called exactly once (proves interceptor works)
94 expect(tokenRefreshCallCount, 1);
95
96 // Verify token was updated by refresher
97 expect(currentToken, 'refreshed-token');
98
99 // Verify user was signed out after retry failed (proves retry limit works)
100 expect(signOutCallCount, 1);
101 });
102
103 test('should sign out user if token refresh fails', () async {
104 const postUri = 'at://did:plc:test/social.coves.post.record/123';
105
106 // Set refresh to fail
107 shouldRefreshSucceed = false;
108
109 // First request with expired token returns 401
110 dioAdapter.onGet(
111 '/xrpc/social.coves.community.comment.getComments',
112 (server) => server.reply(401, {
113 'error': 'Unauthorized',
114 'message': 'Token expired',
115 }),
116 queryParameters: {
117 'post': postUri,
118 'sort': 'hot',
119 'depth': 10,
120 'limit': 50,
121 },
122 );
123
124 // Make the request and expect it to fail
125 expect(
126 () => apiService.getComments(postUri: postUri),
127 throwsA(isA<Exception>()),
128 );
129
130 // Wait for async operations to complete
131 await Future.delayed(const Duration(milliseconds: 100));
132
133 // Verify token refresh was attempted
134 expect(tokenRefreshCallCount, 1);
135
136 // Verify user was signed out after refresh failure
137 expect(signOutCallCount, 1);
138 });
139
140 test(
141 'should NOT retry refresh endpoint on 401 (avoid infinite loop)',
142 () async {
143 // This test verifies that the interceptor checks for /oauth/refresh
144 // in the path to avoid infinite loops. Due to limitations with mocking
145 // complex request/response cycles, we test this by verifying the
146 // signOutHandler gets called when refresh fails.
147
148 // Set refresh to fail (simulates refresh endpoint returning 401)
149 shouldRefreshSucceed = false;
150
151 const postUri = 'at://did:plc:test/social.coves.post.record/123';
152
153 dioAdapter.onGet(
154 '/xrpc/social.coves.community.comment.getComments',
155 (server) => server.reply(401, {
156 'error': 'Unauthorized',
157 'message': 'Token expired',
158 }),
159 queryParameters: {
160 'post': postUri,
161 'sort': 'hot',
162 'depth': 10,
163 'limit': 50,
164 },
165 );
166
167 // Make the request and expect it to fail
168 expect(
169 () => apiService.getComments(postUri: postUri),
170 throwsA(isA<Exception>()),
171 );
172
173 // Wait for async operations to complete
174 await Future.delayed(const Duration(milliseconds: 100));
175
176 // Verify user was signed out (no infinite loop)
177 expect(signOutCallCount, 1);
178 },
179 );
180
181 test(
182 'should sign out user if token refresh throws exception',
183 () async {
184 // Skipped: causes retry loops with http_mock_adapter after disposal
185 // The core functionality is tested by the "should sign out user if token
186 // refresh fails" test above.
187 },
188 skip: 'Causes retry issues with http_mock_adapter',
189 );
190
191 test(
192 'should handle 401 gracefully when no refresher is provided',
193 () async {
194 // Create API service without refresh capability
195 final apiServiceNoRefresh = CovesApiService(
196 dio: dio,
197 tokenGetter: mockTokenGetter,
198 // No tokenRefresher provided
199 // No signOutHandler provided
200 );
201
202 const postUri = 'at://did:plc:test/social.coves.post.record/123';
203
204 // Request returns 401
205 dioAdapter.onGet(
206 '/xrpc/social.coves.community.comment.getComments',
207 (server) => server.reply(401, {
208 'error': 'Unauthorized',
209 'message': 'Token expired',
210 }),
211 queryParameters: {
212 'post': postUri,
213 'sort': 'hot',
214 'depth': 10,
215 'limit': 50,
216 },
217 );
218
219 // Make the request and expect it to fail with AuthenticationException
220 expect(
221 () => apiServiceNoRefresh.getComments(postUri: postUri),
222 throwsA(isA<Exception>()),
223 );
224
225 // Verify refresh was NOT called (no refresher provided)
226 expect(tokenRefreshCallCount, 0);
227
228 // Verify sign-out was NOT called (no handler provided)
229 expect(signOutCallCount, 0);
230
231 apiServiceNoRefresh.dispose();
232 },
233 );
234
235 // Skipped: http_mock_adapter cannot handle stateful request/response cycles
236
237 test('should handle non-401 errors normally without refresh', () async {
238 const postUri = 'at://did:plc:test/social.coves.post.record/123';
239
240 // Request returns 500 server error
241 dioAdapter.onGet(
242 '/xrpc/social.coves.community.comment.getComments',
243 (server) => server.reply(500, {
244 'error': 'InternalServerError',
245 'message': 'Database connection failed',
246 }),
247 queryParameters: {
248 'post': postUri,
249 'sort': 'hot',
250 'depth': 10,
251 'limit': 50,
252 },
253 );
254
255 // Make the request and expect it to fail
256 expect(
257 () => apiService.getComments(postUri: postUri),
258 throwsA(isA<Exception>()),
259 );
260
261 // Verify refresh was NOT called (not a 401)
262 expect(tokenRefreshCallCount, 0);
263
264 // Verify sign-out was NOT called
265 expect(signOutCallCount, 0);
266 });
267
268 // Skipped: http_mock_adapter cannot handle stateful request/response cycles
269 });
270}