···

       
1
       
1
       
+
       
<?xml version="1.0" encoding="UTF-8"?>

     

       
2
       
2
       
+
       
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

     

       
3
       
3
       
+
       
<plist version="1.0">

     

       
4
       
4
       
+
       
<dict>

     

       
5
       
5
       
+
       
	<key>com.apple.developer.associated-domains</key>

     

       
6
       
6
       
+
       
	<array>

     

       
7
       
7
       
+
       
		<string>applinks:coves.social</string>

     

       
8
       
8
       
+
       
	</array>

     

       
9
       
9
       
+
       
</dict>

     

       
10
       
10
       
+
       
</plist>

     

···

       
37
       
37
       
 
       
        voteService: VoteService(

     

       
38
       
38
       
 
       
          sessionGetter: () async => null,

     

       
39
       
39
       
 
       
          didGetter: () => null,

     

       
40
       
40
       
-
       
          pdsUrlGetter: () => null,

     

       
41
       
40
       
 
       
        ),

     

       
42
       
41
       
 
       
        authProvider: FakeAuthProvider(),

     

       
43
       
42
       
 
       
      );

     
···

       
286
       
285
       
 
       
          community: CommunityRef(

     

       
287
       
286
       
 
       
            did: 'did:plc:community',

     

       
288
       
287
       
 
       
            name: 'test-community',

     

       
288
       
288
       
+
       
            handle: 'test-community.community.coves.social',

     

       
289
       
289
       
 
       
          ),

     

       
290
       
290
       
 
       
          createdAt: DateTime.now(),

     

       
291
       
291
       
 
       
          indexedAt: DateTime.now(),

     
···

       
315
       
315
       
 
       


     

       
316
       
316
       
 
       
      await tester.pumpWidget(createTestWidget());

     

       
317
       
317
       
 
       


     

       
318
       
318
       
-
       
      expect(find.text('c/test-community'), findsOneWidget);

     

       
318
       
318
       
+
       
      // Check for community handle parts (displayed as !test-community@coves.social)

     

       
319
       
319
       
+
       
      expect(find.textContaining('!test-community'), findsOneWidget);

     

       
319
       
320
       
 
       
      expect(find.text('@test.user'), findsOneWidget);

     

       
320
       
321
       
 
       
    });

     

       
321
       
322
       
 
       


     
···

       
338
       
339
       
 
       


     

       
339
       
340
       
 
       
      // Verify post card exists (which contains Semantics wrapper)

     

       
340
       
341
       
 
       
      expect(find.text('Accessible Post'), findsOneWidget);

     

       
341
       
341
       
-
       
      expect(find.text('c/test-community'), findsOneWidget);

     

       
342
       
342
       
+
       
      // Check for community handle parts (displayed as !test-community@coves.social)

     

       
343
       
343
       
+
       
      expect(find.textContaining('!test-community'), findsOneWidget);

     

       
344
       
344
       
+
       
      expect(find.textContaining('@coves.social'), findsOneWidget);

     

       
342
       
345
       
 
       
    });

     

       
343
       
346
       
 
       


     

       
344
       
347
       
 
       
    testWidgets('should properly dispose scroll controller', (tester) async {

     
···

       
366
       
369
       
 
       
        handle: 'test.user',

     

       
367
       
370
       
 
       
        displayName: 'Test User',

     

       
368
       
371
       
 
       
      ),

     

       
369
       
369
       
-
       
      community: CommunityRef(did: 'did:plc:community', name: 'test-community'),

     

       
372
       
372
       
+
       
      community: CommunityRef(

     

       
373
       
373
       
+
       
        did: 'did:plc:community',

     

       
374
       
374
       
+
       
        name: 'test-community',

     

       
375
       
375
       
+
       
        handle: 'test-community.community.coves.social',

     

       
376
       
376
       
+
       
      ),

     

       
370
       
377
       
 
       
      createdAt: DateTime.parse('2025-01-01T12:00:00Z'),

     

       
371
       
378
       
 
       
      indexedAt: DateTime.parse('2025-01-01T12:00:00Z'),

     

       
372
       
379
       
 
       
      text: 'Test body',

     

···

       
26
       
26
       
 
       
    Future<bool> Function()? tokenRefresher,

     

       
27
       
27
       
 
       
    Future<void> Function()? signOutHandler,

     

       
28
       
28
       
 
       
    Dio? dio,

     

       
29
       
29
       
-
       
  })  : _tokenGetter = tokenGetter,

     

       
30
       
30
       
-
       
        _tokenRefresher = tokenRefresher,

     

       
31
       
31
       
-
       
        _signOutHandler = signOutHandler {

     

       
29
       
29
       
+
       
  }) : _tokenGetter = tokenGetter,

     

       
30
       
30
       
+
       
       _tokenRefresher = tokenRefresher,

     

       
31
       
31
       
+
       
       _signOutHandler = signOutHandler {

     

       
32
       
32
       
 
       
    _dio =

     

       
33
       
33
       
 
       
        dio ??

     

       
34
       
34
       
 
       
        Dio(

     
···

       
78
       
78
       
 
       
            }

     

       
79
       
79
       
 
       


     

       
80
       
80
       
 
       
            // Don't retry the refresh endpoint itself (avoid infinite loop)

     

       
81
       
81
       
-
       
            final isRefreshEndpoint =

     

       
82
       
82
       
-
       
                error.requestOptions.path.contains('/oauth/refresh');

     

       
81
       
81
       
+
       
            final isRefreshEndpoint = error.requestOptions.path.contains(

     

       
82
       
82
       
+
       
              '/oauth/refresh',

     

       
83
       
83
       
+
       
            );

     

       
83
       
84
       
 
       
            if (isRefreshEndpoint) {

     

       
84
       
85
       
 
       
              if (kDebugMode) {

     

       
85
       
86
       
 
       
                debugPrint(

     
···

       
160
       
161
       
 
       
              }

     

       
161
       
162
       
 
       
              // Only sign out if we haven't already (avoid double sign-out)

     

       
162
       
163
       
 
       
              // Check if this is a DioException from a retried request

     

       
163
       
163
       
-
       
              final isRetriedRequest = e is DioException &&

     

       
164
       
164
       
+
       
              final isRetriedRequest =

     

       
165
       
165
       
+
       
                  e is DioException &&

     

       
164
       
166
       
 
       
                  e.response?.statusCode == 401 &&

     

       
165
       
167
       
 
       
                  e.requestOptions.extra['retried'] == true;

     

       
166
       
168
       
 
       


     
···

       
352
       
354
       
 
       
      if (kDebugMode) {

     

       
353
       
355
       
 
       
        debugPrint('❌ Error parsing comments response: $e');

     

       
354
       
356
       
 
       
      }

     

       
355
       
355
       
-
       
      throw ApiException(

     

       
356
       
356
       
-
       
        'Failed to parse server response',

     

       
357
       
357
       
-
       
        originalError: e,

     

       
358
       
358
       
-
       
      );

     

       
357
       
357
       
+
       
      throw ApiException('Failed to parse server response', originalError: e);

     

       
359
       
358
       
 
       
    }

     

       
360
       
359
       
 
       
  }

     

       
361
       
360
       
 
       


     

···

       
26
       
26
       
 
       
/// 4. Call /oauth/refresh when needed

     

       
27
       
27
       
 
       
/// 5. Call /oauth/logout to sign out

     

       
28
       
28
       
 
       
class CovesAuthService {

     

       
29
       
29
       
-
       
  factory CovesAuthService({

     

       
30
       
30
       
-
       
    Dio? dio,

     

       
31
       
31
       
-
       
    FlutterSecureStorage? storage,

     

       
32
       
32
       
-
       
  }) {

     

       
29
       
29
       
+
       
  factory CovesAuthService({Dio? dio, FlutterSecureStorage? storage}) {

     

       
33
       
30
       
 
       
    _instance ??= CovesAuthService._internal(dio: dio, storage: storage);

     

       
34
       
31
       
 
       
    return _instance!;

     

       
35
       
32
       
 
       
  }

     

       
36
       
33
       
 
       


     

       
37
       
37
       
-
       
  CovesAuthService._internal({

     

       
38
       
38
       
-
       
    Dio? dio,

     

       
39
       
39
       
-
       
    FlutterSecureStorage? storage,

     

       
40
       
40
       
-
       
  }) : _storage = storage ??

     

       
41
       
41
       
-
       
            const FlutterSecureStorage(

     

       
42
       
42
       
-
       
              aOptions: AndroidOptions(encryptedSharedPreferences: true),

     

       
43
       
43
       
-
       
              iOptions: IOSOptions(

     

       
44
       
44
       
-
       
                accessibility: KeychainAccessibility.first_unlock,

     

       
45
       
45
       
-
       
              ),

     

       
46
       
46
       
-
       
            ) {

     

       
34
       
34
       
+
       
  CovesAuthService._internal({Dio? dio, FlutterSecureStorage? storage})

     

       
35
       
35
       
+
       
    : _storage =

     

       
36
       
36
       
+
       
          storage ??

     

       
37
       
37
       
+
       
          const FlutterSecureStorage(

     

       
38
       
38
       
+
       
            aOptions: AndroidOptions(encryptedSharedPreferences: true),

     

       
39
       
39
       
+
       
            iOptions: IOSOptions(

     

       
40
       
40
       
+
       
              accessibility: KeychainAccessibility.first_unlock,

     

       
41
       
41
       
+
       
            ),

     

       
42
       
42
       
+
       
          ) {

     

       
47
       
43
       
 
       
    // Initialize Dio if provided, otherwise it will be initialized in initialize()

     

       
48
       
44
       
 
       
    if (dio != null) {

     

       
49
       
45
       
 
       
      _dio = dio;

     
···

       
341
       
337
       
 
       
          await _dio.post<void>(

     

       
342
       
338
       
 
       
            '/oauth/logout',

     

       
343
       
339
       
 
       
            options: Options(

     

       
344
       
344
       
-
       
              headers: {

     

       
345
       
345
       
-
       
                'Authorization': 'Bearer ${_session!.token}',

     

       
346
       
346
       
-
       
              },

     

       
340
       
340
       
+
       
              headers: {'Authorization': 'Bearer ${_session!.token}'},

     

       
347
       
341
       
 
       
            ),

     

       
348
       
342
       
 
       
          );

     

       
349
       
343
       
 
       


     
···

       
520
       
514
       
 
       


     

       
521
       
515
       
 
       
  /// Save session to secure storage

     

       
522
       
516
       
 
       
  Future<void> _saveSession(CovesSession session) async {

     

       
523
       
523
       
-
       
    await _storage.write(

     

       
524
       
524
       
-
       
      key: _storageKey,

     

       
525
       
525
       
-
       
      value: session.toJsonString(),

     

       
526
       
526
       
-
       
    );

     

       
517
       
517
       
+
       
    await _storage.write(key: _storageKey, value: session.toJsonString());

     

       
527
       
518
       
 
       
  }

     

       
528
       
519
       
 
       


     

       
529
       
520
       
 
       
  /// Clear session from secure storage

     

···

       
4
       
4
       
 
       
/// Bluesky-style navigation icons using SVG assets

     

       
5
       
5
       
 
       
/// These icons match the design from Bluesky's social-app

     

       
6
       
6
       
 
       
class BlueSkyIcon extends StatelessWidget {

     

       
7
       
7
       
-
       


     

       
8
       
7
       
 
       
  const BlueSkyIcon({

     

       
9
       
8
       
 
       
    required this.iconName,

     

       
10
       
9
       
 
       
    this.size = 28,

     

···

       
49
       
49
       
 
       
    return Container(

     

       
50
       
50
       
 
       
      decoration: const BoxDecoration(

     

       
51
       
51
       
 
       
        color: AppColors.background,

     

       
52
       
52
       
-
       
        border: Border(

     

       
53
       
53
       
-
       
          top: BorderSide(color: AppColors.backgroundSecondary),

     

       
54
       
54
       
-
       
        ),

     

       
52
       
52
       
+
       
        border: Border(top: BorderSide(color: AppColors.backgroundSecondary)),

     

       
55
       
53
       
 
       
      ),

     

       
56
       
54
       
 
       
      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 8),

     

       
57
       
55
       
 
       
      child: SafeArea(

     

···

       
161
       
161
       
 
       
                    ),

     

       
162
       
162
       
 
       
                  )

     

       
163
       
163
       
 
       
                else

     

       
164
       
164
       
-
       
                  // Title when navigation is disabled

     

       
165
       
165
       
-
       
                  if (post.post.title != null) ...[

     

       
166
       
166
       
-
       
                    Text(

     

       
167
       
167
       
-
       
                      post.post.title!,

     

       
168
       
168
       
-
       
                      style: TextStyle(

     

       
169
       
169
       
-
       
                        color: AppColors.textPrimary,

     

       
170
       
170
       
-
       
                        fontSize: titleFontSize,

     

       
171
       
171
       
-
       
                        fontWeight: titleFontWeight,

     

       
172
       
172
       
-
       
                        height: 1.3,

     

       
173
       
173
       
-
       
                      ),

     

       
164
       
164
       
+
       
                // Title when navigation is disabled

     

       
165
       
165
       
+
       
                if (post.post.title != null) ...[

     

       
166
       
166
       
+
       
                  Text(

     

       
167
       
167
       
+
       
                    post.post.title!,

     

       
168
       
168
       
+
       
                    style: TextStyle(

     

       
169
       
169
       
+
       
                      color: AppColors.textPrimary,

     

       
170
       
170
       
+
       
                      fontSize: titleFontSize,

     

       
171
       
171
       
+
       
                      fontWeight: titleFontWeight,

     

       
172
       
172
       
+
       
                      height: 1.3,

     

       
174
       
173
       
 
       
                    ),

     

       
175
       
175
       
-
       
                    if (post.post.embed?.external != null ||

     

       
176
       
176
       
-
       
                        post.post.text.isNotEmpty)

     

       
177
       
177
       
-
       
                      const SizedBox(height: 8),

     

       
178
       
178
       
-
       
                  ],

     

       
174
       
174
       
+
       
                  ),

     

       
175
       
175
       
+
       
                  if (post.post.embed?.external != null ||

     

       
176
       
176
       
+
       
                      post.post.text.isNotEmpty)

     

       
177
       
177
       
+
       
                    const SizedBox(height: 8),

     

       
178
       
178
       
+
       
                ],

     

       
179
       
179
       
 
       


     

       
180
       
180
       
 
       
                // Embed (handles its own taps - not wrapped in InkWell)

     

       
181
       
181
       
 
       
                if (post.post.embed?.external != null) ...[

     
···

       
590
       
590
       
 
       
    // For non-video embeds (images, link previews), make them tappable

     

       
591
       
591
       
 
       
    // to navigate to post detail

     

       
592
       
592
       
 
       
    if (widget.onImageTap != null) {

     

       
593
       
593
       
-
       
      return GestureDetector(

     

       
594
       
594
       
-
       
        onTap: widget.onImageTap,

     

       
595
       
595
       
-
       
        child: thumbnailWidget,

     

       
596
       
596
       
-
       
      );

     

       
593
       
593
       
+
       
      return GestureDetector(onTap: widget.onImageTap, child: thumbnailWidget);

     

       
597
       
594
       
 
       
    }

     

       
598
       
595
       
 
       


     

       
599
       
596
       
 
       
    // No tap handler provided, just return the thumbnail

     

···

       
120
       
120
       
 
       
                            Icon(

     

       
121
       
121
       
 
       
                              Icons.chat_bubble_outline,

     

       
122
       
122
       
 
       
                              size: 20,

     

       
123
       
123
       
-
       
                              color:

     

       
124
       
124
       
-
       
                                  AppColors.textPrimary.withValues(

     

       
125
       
125
       
-
       
                                    alpha: 0.6,

     

       
126
       
126
       
-
       
                                  ),

     

       
123
       
123
       
+
       
                              color: AppColors.textPrimary.withValues(

     

       
124
       
124
       
+
       
                                alpha: 0.6,

     

       
125
       
125
       
+
       
                              ),

     

       
127
       
126
       
 
       
                            ),

     

       
128
       
127
       
 
       
                            const SizedBox(width: 5),

     

       
129
       
128
       
 
       
                            Text(

     

       
130
       
129
       
 
       
                              DateTimeUtils.formatCount(count),

     

       
131
       
130
       
 
       
                              style: TextStyle(

     

       
132
       
132
       
-
       
                                color:

     

       
133
       
133
       
-
       
                                    AppColors.textPrimary.withValues(

     

       
134
       
134
       
-
       
                                      alpha: 0.6,

     

       
135
       
135
       
-
       
                                    ),

     

       
131
       
131
       
+
       
                                color: AppColors.textPrimary.withValues(

     

       
132
       
132
       
+
       
                                  alpha: 0.6,

     

       
133
       
133
       
+
       
                                ),

     

       
136
       
134
       
 
       
                                fontSize: 13,

     

       
137
       
135
       
 
       
                              ),

     

       
138
       
136
       
 
       
                            ),

     

···

       
233
       
233
       
 
       
        'session_id': 'sess456',

     

       
234
       
234
       
 
       
      };

     

       
235
       
235
       
 
       


     

       
236
       
236
       
-
       
      expect(

     

       
237
       
237
       
-
       
        () => CovesSession.fromJson(json),

     

       
238
       
238
       
-
       
        throwsA(isA<TypeError>()),

     

       
239
       
239
       
-
       
      );

     

       
236
       
236
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
240
       
237
       
 
       
    });

     

       
241
       
238
       
 
       


     

       
242
       
239
       
 
       
    test('should throw when did has wrong type', () {

     
···

       
246
       
243
       
 
       
        'session_id': 'sess456',

     

       
247
       
244
       
 
       
      };

     

       
248
       
245
       
 
       


     

       
249
       
249
       
-
       
      expect(

     

       
250
       
250
       
-
       
        () => CovesSession.fromJson(json),

     

       
251
       
251
       
-
       
        throwsA(isA<TypeError>()),

     

       
252
       
252
       
-
       
      );

     

       
246
       
246
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
253
       
247
       
 
       
    });

     

       
254
       
248
       
 
       


     

       
255
       
249
       
 
       
    test('should throw when session_id has wrong type', () {

     
···

       
259
       
253
       
 
       
        'session_id': 123, // Should be String

     

       
260
       
254
       
 
       
      };

     

       
261
       
255
       
 
       


     

       
262
       
262
       
-
       
      expect(

     

       
263
       
263
       
-
       
        () => CovesSession.fromJson(json),

     

       
264
       
264
       
-
       
        throwsA(isA<TypeError>()),

     

       
265
       
265
       
-
       
      );

     

       
256
       
256
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
266
       
257
       
 
       
    });

     

       
267
       
258
       
 
       


     

       
268
       
259
       
 
       
    test('should throw when token field is missing', () {

     

       
269
       
269
       
-
       
      final json = {

     

       
270
       
270
       
-
       
        'did': 'did:plc:test123',

     

       
271
       
271
       
-
       
        'session_id': 'sess456',

     

       
272
       
272
       
-
       
      };

     

       
260
       
260
       
+
       
      final json = {'did': 'did:plc:test123', 'session_id': 'sess456'};

     

       
273
       
261
       
 
       


     

       
274
       
274
       
-
       
      expect(

     

       
275
       
275
       
-
       
        () => CovesSession.fromJson(json),

     

       
276
       
276
       
-
       
        throwsA(isA<TypeError>()),

     

       
277
       
277
       
-
       
      );

     

       
262
       
262
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
278
       
263
       
 
       
    });

     

       
279
       
264
       
 
       


     

       
280
       
265
       
 
       
    test('should throw when did field is missing', () {

     

       
281
       
281
       
-
       
      final json = {

     

       
282
       
282
       
-
       
        'token': 'abc123',

     

       
283
       
283
       
-
       
        'session_id': 'sess456',

     

       
284
       
284
       
-
       
      };

     

       
266
       
266
       
+
       
      final json = {'token': 'abc123', 'session_id': 'sess456'};

     

       
285
       
267
       
 
       


     

       
286
       
286
       
-
       
      expect(

     

       
287
       
287
       
-
       
        () => CovesSession.fromJson(json),

     

       
288
       
288
       
-
       
        throwsA(isA<TypeError>()),

     

       
289
       
289
       
-
       
      );

     

       
268
       
268
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
290
       
269
       
 
       
    });

     

       
291
       
270
       
 
       


     

       
292
       
271
       
 
       
    test('should throw when session_id field is missing', () {

     

       
293
       
293
       
-
       
      final json = {

     

       
294
       
294
       
-
       
        'token': 'abc123',

     

       
295
       
295
       
-
       
        'did': 'did:plc:test123',

     

       
296
       
296
       
-
       
      };

     

       
272
       
272
       
+
       
      final json = {'token': 'abc123', 'did': 'did:plc:test123'};

     

       
297
       
273
       
 
       


     

       
298
       
298
       
-
       
      expect(

     

       
299
       
299
       
-
       
        () => CovesSession.fromJson(json),

     

       
300
       
300
       
-
       
        throwsA(isA<TypeError>()),

     

       
301
       
301
       
-
       
      );

     

       
274
       
274
       
+
       
      expect(() => CovesSession.fromJson(json), throwsA(isA<TypeError>()));

     

       
302
       
275
       
 
       
    });

     

       
303
       
276
       
 
       


     

       
304
       
277
       
 
       
    test('should handle extra fields in JSON', () {

     
···

       
793
       
766
       
 
       
      final stringRep = session.toString();

     

       
794
       
767
       
 
       


     

       
795
       
768
       
 
       
      expect(stringRep, isNot(contains('Bearer')));

     

       
796
       
796
       
-
       
      expect(stringRep, isNot(contains('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9')));

     

       
769
       
769
       
+
       
      expect(

     

       
770
       
770
       
+
       
        stringRep,

     

       
771
       
771
       
+
       
        isNot(contains('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9')),

     

       
772
       
772
       
+
       
      );

     

       
797
       
773
       
 
       
    });

     

       
798
       
774
       
 
       
  });

     

       
799
       
775
       
 
       
}

     

···

       
152
       
152
       
 
       
        await authProvider.signIn('alice.bsky.social');

     

       
153
       
153
       
 
       


     

       
154
       
154
       
 
       
        // Sign out with error

     

       
155
       
155
       
-
       
        when(mockAuthService.signOut())

     

       
156
       
156
       
-
       
            .thenThrow(Exception('Revocation failed'));

     

       
155
       
155
       
+
       
        when(

     

       
156
       
156
       
+
       
          mockAuthService.signOut(),

     

       
157
       
157
       
+
       
        ).thenThrow(Exception('Revocation failed'));

     

       
157
       
158
       
 
       


     

       
158
       
159
       
 
       
        await authProvider.signOut();

     

       
159
       
160
       
 
       


     

···

       
60
       
60
       
 
       
      apiService.dispose();

     

       
61
       
61
       
 
       
    });

     

       
62
       
62
       
 
       


     

       
63
       
63
       
-
       
    test('should call token refresher on 401 response but only retry once',

     

       
64
       
64
       
-
       
        () async {

     

       
63
       
63
       
+
       
    test('should call token refresher on 401 response but only retry once', () async {

     

       
65
       
64
       
 
       
      // This test verifies the interceptor detects 401, calls the refresher,

     

       
66
       
65
       
 
       
      // and only retries ONCE to prevent infinite loops (even if retry returns 401).

     

       
67
       
66
       
 
       


     
···

       
138
       
137
       
 
       
      expect(signOutCallCount, 1);

     

       
139
       
138
       
 
       
    });

     

       
140
       
139
       
 
       


     

       
141
       
141
       
-
       
    test('should NOT retry refresh endpoint on 401 (avoid infinite loop)',

     

       
142
       
142
       
-
       
        () async {

     

       
143
       
143
       
-
       
      // This test verifies that the interceptor checks for /oauth/refresh

     

       
144
       
144
       
-
       
      // in the path to avoid infinite loops. Due to limitations with mocking

     

       
145
       
145
       
-
       
      // complex request/response cycles, we test this by verifying the

     

       
146
       
146
       
-
       
      // signOutHandler gets called when refresh fails.

     

       
147
       
147
       
-
       


     

       
148
       
148
       
-
       
      // Set refresh to fail (simulates refresh endpoint returning 401)

     

       
149
       
149
       
-
       
      shouldRefreshSucceed = false;

     

       
150
       
150
       
-
       


     

       
151
       
151
       
-
       
      const postUri = 'at://did:plc:test/social.coves.post.record/123';

     

       
152
       
152
       
-
       


     

       
153
       
153
       
-
       
      dioAdapter.onGet(

     

       
154
       
154
       
-
       
        '/xrpc/social.coves.community.comment.getComments',

     

       
155
       
155
       
-
       
        (server) => server.reply(401, {

     

       
156
       
156
       
-
       
          'error': 'Unauthorized',

     

       
157
       
157
       
-
       
          'message': 'Token expired',

     

       
158
       
158
       
-
       
        }),

     

       
159
       
159
       
-
       
        queryParameters: {

     

       
160
       
160
       
-
       
          'post': postUri,

     

       
161
       
161
       
-
       
          'sort': 'hot',

     

       
162
       
162
       
-
       
          'depth': 10,

     

       
163
       
163
       
-
       
          'limit': 50,

     

       
164
       
164
       
-
       
        },

     

       
165
       
165
       
-
       
      );

     

       
166
       
166
       
-
       


     

       
167
       
167
       
-
       
      // Make the request and expect it to fail

     

       
168
       
168
       
-
       
      expect(

     

       
169
       
169
       
-
       
        () => apiService.getComments(postUri: postUri),

     

       
170
       
170
       
-
       
        throwsA(isA<Exception>()),

     

       
171
       
171
       
-
       
      );

     

       
172
       
172
       
-
       


     

       
173
       
173
       
-
       
      // Wait for async operations to complete

     

       
174
       
174
       
-
       
      await Future.delayed(const Duration(milliseconds: 100));

     

       
175
       
175
       
-
       


     

       
176
       
176
       
-
       
      // Verify user was signed out (no infinite loop)

     

       
177
       
177
       
-
       
      expect(signOutCallCount, 1);

     

       
178
       
178
       
-
       
    });

     

       
179
       
179
       
-
       


     

       
180
       
180
       
-
       
    test('should sign out user if token refresh throws exception', () async {

     

       
181
       
181
       
-
       
      // Skipped: causes retry loops with http_mock_adapter after disposal

     

       
182
       
182
       
-
       
      // The core functionality is tested by the "should sign out user if token

     

       
183
       
183
       
-
       
      // refresh fails" test above.

     

       
184
       
184
       
-
       
    }, skip: 'Causes retry issues with http_mock_adapter');

     

       
185
       
185
       
-
       


     

       
186
       
186
       
-
       
    test('should handle 401 gracefully when no refresher is provided',

     

       
187
       
187
       
-
       
        () async {

     

       
188
       
188
       
-
       
      // Create API service without refresh capability

     

       
189
       
189
       
-
       
      final apiServiceNoRefresh = CovesApiService(

     

       
190
       
190
       
-
       
        dio: dio,

     

       
191
       
191
       
-
       
        tokenGetter: mockTokenGetter,

     

       
192
       
192
       
-
       
        // No tokenRefresher provided

     

       
193
       
193
       
-
       
        // No signOutHandler provided

     

       
194
       
194
       
-
       
      );

     

       
195
       
195
       
-
       


     

       
196
       
196
       
-
       
      const postUri = 'at://did:plc:test/social.coves.post.record/123';

     

       
197
       
197
       
-
       


     

       
198
       
198
       
-
       
      // Request returns 401

     

       
199
       
199
       
-
       
      dioAdapter.onGet(

     

       
200
       
200
       
-
       
        '/xrpc/social.coves.community.comment.getComments',

     

       
201
       
201
       
-
       
        (server) => server.reply(401, {

     

       
202
       
202
       
-
       
          'error': 'Unauthorized',

     

       
203
       
203
       
-
       
          'message': 'Token expired',

     

       
204
       
204
       
-
       
        }),

     

       
205
       
205
       
-
       
        queryParameters: {

     

       
206
       
206
       
-
       
          'post': postUri,

     

       
207
       
207
       
-
       
          'sort': 'hot',

     

       
208
       
208
       
-
       
          'depth': 10,

     

       
209
       
209
       
-
       
          'limit': 50,

     

       
210
       
210
       
-
       
        },

     

       
211
       
211
       
-
       
      );

     

       
212
       
212
       
-
       


     

       
213
       
213
       
-
       
      // Make the request and expect it to fail with AuthenticationException

     

       
214
       
214
       
-
       
      expect(

     

       
215
       
215
       
-
       
        () => apiServiceNoRefresh.getComments(postUri: postUri),

     

       
216
       
216
       
-
       
        throwsA(isA<Exception>()),

     

       
217
       
217
       
-
       
      );

     

       
218
       
218
       
-
       


     

       
219
       
219
       
-
       
      // Verify refresh was NOT called (no refresher provided)

     

       
220
       
220
       
-
       
      expect(tokenRefreshCallCount, 0);

     

       
221
       
221
       
-
       


     

       
222
       
222
       
-
       
      // Verify sign-out was NOT called (no handler provided)

     

       
223
       
223
       
-
       
      expect(signOutCallCount, 0);

     

       
224
       
224
       
-
       


     

       
225
       
225
       
-
       
      apiServiceNoRefresh.dispose();

     

       
226
       
226
       
-
       
    });

     

       
140
       
140
       
+
       
    test(

     

       
141
       
141
       
+
       
      'should NOT retry refresh endpoint on 401 (avoid infinite loop)',

     

       
142
       
142
       
+
       
      () async {

     

       
143
       
143
       
+
       
        // This test verifies that the interceptor checks for /oauth/refresh

     

       
144
       
144
       
+
       
        // in the path to avoid infinite loops. Due to limitations with mocking

     

       
145
       
145
       
+
       
        // complex request/response cycles, we test this by verifying the

     

       
146
       
146
       
+
       
        // signOutHandler gets called when refresh fails.

     

       
147
       
147
       
+
       


     

       
148
       
148
       
+
       
        // Set refresh to fail (simulates refresh endpoint returning 401)

     

       
149
       
149
       
+
       
        shouldRefreshSucceed = false;

     

       
150
       
150
       
+
       


     

       
151
       
151
       
+
       
        const postUri = 'at://did:plc:test/social.coves.post.record/123';

     

       
152
       
152
       
+
       


     

       
153
       
153
       
+
       
        dioAdapter.onGet(

     

       
154
       
154
       
+
       
          '/xrpc/social.coves.community.comment.getComments',

     

       
155
       
155
       
+
       
          (server) => server.reply(401, {

     

       
156
       
156
       
+
       
            'error': 'Unauthorized',

     

       
157
       
157
       
+
       
            'message': 'Token expired',

     

       
158
       
158
       
+
       
          }),

     

       
159
       
159
       
+
       
          queryParameters: {

     

       
160
       
160
       
+
       
            'post': postUri,

     

       
161
       
161
       
+
       
            'sort': 'hot',

     

       
162
       
162
       
+
       
            'depth': 10,

     

       
163
       
163
       
+
       
            'limit': 50,

     

       
164
       
164
       
+
       
          },

     

       
165
       
165
       
+
       
        );

     

       
166
       
166
       
+
       


     

       
167
       
167
       
+
       
        // Make the request and expect it to fail

     

       
168
       
168
       
+
       
        expect(

     

       
169
       
169
       
+
       
          () => apiService.getComments(postUri: postUri),

     

       
170
       
170
       
+
       
          throwsA(isA<Exception>()),

     

       
171
       
171
       
+
       
        );

     

       
172
       
172
       
+
       


     

       
173
       
173
       
+
       
        // Wait for async operations to complete

     

       
174
       
174
       
+
       
        await Future.delayed(const Duration(milliseconds: 100));

     

       
175
       
175
       
+
       


     

       
176
       
176
       
+
       
        // Verify user was signed out (no infinite loop)

     

       
177
       
177
       
+
       
        expect(signOutCallCount, 1);

     

       
178
       
178
       
+
       
      },

     

       
179
       
179
       
+
       
    );

     

       
180
       
180
       
+
       


     

       
181
       
181
       
+
       
    test(

     

       
182
       
182
       
+
       
      'should sign out user if token refresh throws exception',

     

       
183
       
183
       
+
       
      () async {

     

       
184
       
184
       
+
       
        // Skipped: causes retry loops with http_mock_adapter after disposal

     

       
185
       
185
       
+
       
        // The core functionality is tested by the "should sign out user if token

     

       
186
       
186
       
+
       
        // refresh fails" test above.

     

       
187
       
187
       
+
       
      },

     

       
188
       
188
       
+
       
      skip: 'Causes retry issues with http_mock_adapter',

     

       
189
       
189
       
+
       
    );

     

       
190
       
190
       
+
       


     

       
191
       
191
       
+
       
    test(

     

       
192
       
192
       
+
       
      'should handle 401 gracefully when no refresher is provided',

     

       
193
       
193
       
+
       
      () async {

     

       
194
       
194
       
+
       
        // Create API service without refresh capability

     

       
195
       
195
       
+
       
        final apiServiceNoRefresh = CovesApiService(

     

       
196
       
196
       
+
       
          dio: dio,

     

       
197
       
197
       
+
       
          tokenGetter: mockTokenGetter,

     

       
198
       
198
       
+
       
          // No tokenRefresher provided

     

       
199
       
199
       
+
       
          // No signOutHandler provided

     

       
200
       
200
       
+
       
        );

     

       
201
       
201
       
+
       


     

       
202
       
202
       
+
       
        const postUri = 'at://did:plc:test/social.coves.post.record/123';

     

       
203
       
203
       
+
       


     

       
204
       
204
       
+
       
        // Request returns 401

     

       
205
       
205
       
+
       
        dioAdapter.onGet(

     

       
206
       
206
       
+
       
          '/xrpc/social.coves.community.comment.getComments',

     

       
207
       
207
       
+
       
          (server) => server.reply(401, {

     

       
208
       
208
       
+
       
            'error': 'Unauthorized',

     

       
209
       
209
       
+
       
            'message': 'Token expired',

     

       
210
       
210
       
+
       
          }),

     

       
211
       
211
       
+
       
          queryParameters: {

     

       
212
       
212
       
+
       
            'post': postUri,

     

       
213
       
213
       
+
       
            'sort': 'hot',

     

       
214
       
214
       
+
       
            'depth': 10,

     

       
215
       
215
       
+
       
            'limit': 50,

     

       
216
       
216
       
+
       
          },

     

       
217
       
217
       
+
       
        );

     

       
218
       
218
       
+
       


     

       
219
       
219
       
+
       
        // Make the request and expect it to fail with AuthenticationException

     

       
220
       
220
       
+
       
        expect(

     

       
221
       
221
       
+
       
          () => apiServiceNoRefresh.getComments(postUri: postUri),

     

       
222
       
222
       
+
       
          throwsA(isA<Exception>()),

     

       
223
       
223
       
+
       
        );

     

       
224
       
224
       
+
       


     

       
225
       
225
       
+
       
        // Verify refresh was NOT called (no refresher provided)

     

       
226
       
226
       
+
       
        expect(tokenRefreshCallCount, 0);

     

       
227
       
227
       
+
       


     

       
228
       
228
       
+
       
        // Verify sign-out was NOT called (no handler provided)

     

       
229
       
229
       
+
       
        expect(signOutCallCount, 0);

     

       
230
       
230
       
+
       


     

       
231
       
231
       
+
       
        apiServiceNoRefresh.dispose();

     

       
232
       
232
       
+
       
      },

     

       
233
       
233
       
+
       
    );

     

       
227
       
234
       
 
       


     

       
228
       
235
       
 
       
    // Skipped: http_mock_adapter cannot handle stateful request/response cycles

     

       
229
       
236
       
 
       


     

···

       
70
       
70
       
 
       
      );

     

       
71
       
71
       
 
       


     

       
72
       
72
       
 
       
      // Mock storage read for the environment-specific key

     

       
73
       
73
       
-
       
      when(mockStorage.read(key: storageKey))

     

       
74
       
74
       
-
       
          .thenAnswer((_) async => session.toJsonString());

     

       
73
       
73
       
+
       
      when(

     

       
74
       
74
       
+
       
        mockStorage.read(key: storageKey),

     

       
75
       
75
       
+
       
      ).thenAnswer((_) async => session.toJsonString());

     

       
75
       
76
       
 
       


     

       
76
       
77
       
 
       
      // Act - Restore session

     

       
77
       
78
       
 
       
      final result = await authService.restoreSession();

     
···

       
100
       
101
       
 
       
        handle: 'alice.bsky.social',

     

       
101
       
102
       
 
       
      );

     

       
102
       
103
       
 
       


     

       
103
       
103
       
-
       
      when(mockStorage.read(key: storageKey))

     

       
104
       
104
       
-
       
          .thenAnswer((_) async => session.toJsonString());

     

       
104
       
104
       
+
       
      when(

     

       
105
       
105
       
+
       
        mockStorage.read(key: storageKey),

     

       
106
       
106
       
+
       
      ).thenAnswer((_) async => session.toJsonString());

     

       
105
       
107
       
 
       
      await authService.restoreSession();

     

       
106
       
108
       
 
       


     

       
107
       
109
       
 
       
      // Mock successful refresh

     

       
108
       
110
       
 
       
      const newToken = 'new-refreshed-token';

     

       
109
       
109
       
-
       
      when(mockDio.post<Map<String, dynamic>>(

     

       
110
       
110
       
-
       
        '/oauth/refresh',

     

       
111
       
111
       
-
       
        data: anyNamed('data'),

     

       
112
       
112
       
-
       
      )).thenAnswer((_) async => Response(

     

       
113
       
113
       
-
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
114
       
114
       
-
       
            statusCode: 200,

     

       
115
       
115
       
-
       
            data: {

     

       
116
       
116
       
-
       
              'sealed_token': newToken,

     

       
117
       
117
       
-
       
              'access_token': 'some-access-token'

     

       
118
       
118
       
-
       
            },

     

       
119
       
119
       
-
       
          ));

     

       
120
       
120
       
-
       


     

       
121
       
121
       
-
       
      when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
122
       
122
       
-
       
          .thenAnswer((_) async => {});

     

       
111
       
111
       
+
       
      when(

     

       
112
       
112
       
+
       
        mockDio.post<Map<String, dynamic>>(

     

       
113
       
113
       
+
       
          '/oauth/refresh',

     

       
114
       
114
       
+
       
          data: anyNamed('data'),

     

       
115
       
115
       
+
       
        ),

     

       
116
       
116
       
+
       
      ).thenAnswer(

     

       
117
       
117
       
+
       
        (_) async => Response(

     

       
118
       
118
       
+
       
          requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
119
       
119
       
+
       
          statusCode: 200,

     

       
120
       
120
       
+
       
          data: {'sealed_token': newToken, 'access_token': 'some-access-token'},

     

       
121
       
121
       
+
       
        ),

     

       
122
       
122
       
+
       
      );

     

       
123
       
123
       
+
       


     

       
124
       
124
       
+
       
      when(

     

       
125
       
125
       
+
       
        mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
126
       
126
       
+
       
      ).thenAnswer((_) async => {});

     

       
123
       
127
       
 
       


     

       
124
       
128
       
 
       
      // Act - Refresh token (which saves the updated session)

     

       
125
       
129
       
 
       
      await authService.refreshToken();

     

       
126
       
130
       
 
       


     

       
127
       
131
       
 
       
      // Assert - Verify environment-specific key was used for saving

     

       
128
       
128
       
-
       
      verify(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
129
       
129
       
-
       
          .called(1);

     

       
132
       
132
       
+
       
      verify(

     

       
133
       
133
       
+
       
        mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
134
       
134
       
+
       
      ).called(1);

     

       
130
       
135
       
 
       


     

       
131
       
136
       
 
       
      // Verify the generic key was never used

     

       
132
       
132
       
-
       
      verifyNever(mockStorage.write(key: 'coves_session', value: anyNamed('value')));

     

       
137
       
137
       
+
       
      verifyNever(

     

       
138
       
138
       
+
       
        mockStorage.write(key: 'coves_session', value: anyNamed('value')),

     

       
139
       
139
       
+
       
      );

     

       
133
       
140
       
 
       
    });

     

       
134
       
141
       
 
       


     

       
135
       
142
       
 
       
    test('should delete sessions using environment-specific keys', () async {

     
···

       
144
       
151
       
 
       
        sessionId: 'session-123',

     

       
145
       
152
       
 
       
      );

     

       
146
       
153
       
 
       


     

       
147
       
147
       
-
       
      when(mockStorage.read(key: storageKey))

     

       
148
       
148
       
-
       
          .thenAnswer((_) async => session.toJsonString());

     

       
154
       
154
       
+
       
      when(

     

       
155
       
155
       
+
       
        mockStorage.read(key: storageKey),

     

       
156
       
156
       
+
       
      ).thenAnswer((_) async => session.toJsonString());

     

       
149
       
157
       
 
       
      await authService.restoreSession();

     

       
150
       
158
       
 
       


     

       
151
       
159
       
 
       
      // Mock logout

     

       
152
       
152
       
-
       
      when(mockDio.post<void>(

     

       
153
       
153
       
-
       
        '/oauth/logout',

     

       
154
       
154
       
-
       
        options: anyNamed('options'),

     

       
155
       
155
       
-
       
      )).thenAnswer((_) async => Response(

     

       
156
       
156
       
-
       
            requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
157
       
157
       
-
       
            statusCode: 200,

     

       
158
       
158
       
-
       
          ));

     

       
160
       
160
       
+
       
      when(

     

       
161
       
161
       
+
       
        mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
162
       
162
       
+
       
      ).thenAnswer(

     

       
163
       
163
       
+
       
        (_) async => Response(

     

       
164
       
164
       
+
       
          requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
165
       
165
       
+
       
          statusCode: 200,

     

       
166
       
166
       
+
       
        ),

     

       
167
       
167
       
+
       
      );

     

       
159
       
168
       
 
       


     

       
160
       
169
       
 
       
      when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
161
       
170
       
 
       


     

···

       
35
       
35
       
 
       
  group('CovesAuthService', () {

     

       
36
       
36
       
 
       
    group('signIn()', () {

     

       
37
       
37
       
 
       
      test('should throw ArgumentError when handle is empty', () async {

     

       
38
       
38
       
-
       
        expect(

     

       
39
       
39
       
-
       
          () => authService.signIn(''),

     

       
40
       
40
       
-
       
          throwsA(isA<ArgumentError>()),

     

       
41
       
41
       
-
       
        );

     

       
38
       
38
       
+
       
        expect(() => authService.signIn(''), throwsA(isA<ArgumentError>()));

     

       
42
       
39
       
 
       
      });

     

       
43
       
40
       
 
       


     

       
44
       
44
       
-
       
      test('should throw ArgumentError when handle is whitespace-only',

     

       
45
       
45
       
-
       
          () async {

     

       
46
       
46
       
-
       
        expect(

     

       
47
       
47
       
-
       
          () => authService.signIn('   '),

     

       
48
       
48
       
-
       
          throwsA(isA<ArgumentError>()),

     

       
49
       
49
       
-
       
        );

     

       
50
       
50
       
-
       
      });

     

       
41
       
41
       
+
       
      test(

     

       
42
       
42
       
+
       
        'should throw ArgumentError when handle is whitespace-only',

     

       
43
       
43
       
+
       
        () async {

     

       
44
       
44
       
+
       
          expect(

     

       
45
       
45
       
+
       
            () => authService.signIn('   '),

     

       
46
       
46
       
+
       
            throwsA(isA<ArgumentError>()),

     

       
47
       
47
       
+
       
          );

     

       
48
       
48
       
+
       
        },

     

       
49
       
49
       
+
       
      );

     

       
51
       
50
       
 
       


     

       
52
       
52
       
-
       
      test('should throw appropriate error when user cancels sign-in',

     

       
53
       
53
       
-
       
          () async {

     

       
51
       
51
       
+
       
      test('should throw appropriate error when user cancels sign-in', () async {

     

       
54
       
52
       
 
       
        // Note: FlutterWebAuth2.authenticate is not easily mockable as it's a static method

     

       
55
       
53
       
 
       
        // This test documents expected behavior when authentication is cancelled

     

       
56
       
54
       
 
       
        // In practice, this would throw with CANCELED/cancelled in the message

     
···

       
60
       
58
       
 
       
        // Skipping for now as it requires more complex mocking infrastructure

     

       
61
       
59
       
 
       
      });

     

       
62
       
60
       
 
       


     

       
63
       
63
       
-
       
      test('should throw Exception when network error occurs during OAuth',

     

       
64
       
64
       
-
       
          () async {

     

       
65
       
65
       
-
       
        // Note: Similar to above, FlutterWebAuth2 static methods are difficult to mock

     

       
66
       
66
       
-
       
        // This test documents expected behavior

     

       
67
       
67
       
-
       
        // The actual implementation catches exceptions and rethrows with context

     

       
68
       
68
       
-
       
      });

     

       
61
       
61
       
+
       
      test(

     

       
62
       
62
       
+
       
        'should throw Exception when network error occurs during OAuth',

     

       
63
       
63
       
+
       
        () async {

     

       
64
       
64
       
+
       
          // Note: Similar to above, FlutterWebAuth2 static methods are difficult to mock

     

       
65
       
65
       
+
       
          // This test documents expected behavior

     

       
66
       
66
       
+
       
          // The actual implementation catches exceptions and rethrows with context

     

       
67
       
67
       
+
       
        },

     

       
68
       
68
       
+
       
      );

     

       
69
       
69
       
 
       


     

       
70
       
70
       
 
       
      test('should trim handle before processing', () async {

     

       
71
       
71
       
 
       
        // This test verifies the handle trimming logic

     
···

       
86
       
86
       
 
       
        );

     

       
87
       
87
       
 
       
        final jsonString = session.toJsonString();

     

       
88
       
88
       
 
       


     

       
89
       
89
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
90
       
90
       
-
       
            .thenAnswer((_) async => jsonString);

     

       
89
       
89
       
+
       
        when(

     

       
90
       
90
       
+
       
          mockStorage.read(key: storageKey),

     

       
91
       
91
       
+
       
        ).thenAnswer((_) async => jsonString);

     

       
91
       
92
       
 
       


     

       
92
       
93
       
 
       
        // Act

     

       
93
       
94
       
 
       
        final result = await authService.restoreSession();

     
···

       
103
       
104
       
 
       


     

       
104
       
105
       
 
       
      test('should return null when no stored session exists', () async {

     

       
105
       
106
       
 
       
        // Arrange

     

       
106
       
106
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
107
       
107
       
-
       
            .thenAnswer((_) async => null);

     

       
107
       
107
       
+
       
        when(mockStorage.read(key: storageKey)).thenAnswer((_) async => null);

     

       
108
       
108
       
 
       


     

       
109
       
109
       
 
       
        // Act

     

       
110
       
110
       
 
       
        final result = await authService.restoreSession();

     
···

       
117
       
117
       
 
       
      test('should handle corrupted storage data gracefully', () async {

     

       
118
       
118
       
 
       
        // Arrange

     

       
119
       
119
       
 
       
        const corruptedJson = 'not-valid-json{]';

     

       
120
       
120
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
121
       
121
       
-
       
            .thenAnswer((_) async => corruptedJson);

     

       
122
       
122
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
123
       
123
       
-
       
            .thenAnswer((_) async => {});

     

       
120
       
120
       
+
       
        when(

     

       
121
       
121
       
+
       
          mockStorage.read(key: storageKey),

     

       
122
       
122
       
+
       
        ).thenAnswer((_) async => corruptedJson);

     

       
123
       
123
       
+
       
        when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
124
       
124
       
 
       


     

       
125
       
125
       
 
       
        // Act

     

       
126
       
126
       
 
       
        final result = await authService.restoreSession();

     
···

       
131
       
131
       
 
       
        verify(mockStorage.delete(key: storageKey)).called(1);

     

       
132
       
132
       
 
       
      });

     

       
133
       
133
       
 
       


     

       
134
       
134
       
-
       
      test('should handle session JSON with missing required fields gracefully',

     

       
135
       
135
       
-
       
          () async {

     

       
136
       
136
       
-
       
        // Arrange

     

       
137
       
137
       
-
       
        const invalidJson = '{"token": "test"}'; // Missing required fields (did, session_id)

     

       
138
       
138
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
139
       
139
       
-
       
            .thenAnswer((_) async => invalidJson);

     

       
140
       
140
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
141
       
141
       
-
       
            .thenAnswer((_) async => {});

     

       
142
       
142
       
-
       


     

       
143
       
143
       
-
       
        // Act

     

       
144
       
144
       
-
       
        final result = await authService.restoreSession();

     

       
145
       
145
       
-
       


     

       
146
       
146
       
-
       
        // Assert

     

       
147
       
147
       
-
       
        // Should return null and clear corrupted storage

     

       
148
       
148
       
-
       
        expect(result, isNull);

     

       
149
       
149
       
-
       
        verify(mockStorage.read(key: storageKey)).called(1);

     

       
150
       
150
       
-
       
        verify(mockStorage.delete(key: storageKey)).called(1);

     

       
151
       
151
       
-
       
      });

     

       
134
       
134
       
+
       
      test(

     

       
135
       
135
       
+
       
        'should handle session JSON with missing required fields gracefully',

     

       
136
       
136
       
+
       
        () async {

     

       
137
       
137
       
+
       
          // Arrange

     

       
138
       
138
       
+
       
          const invalidJson =

     

       
139
       
139
       
+
       
              '{"token": "test"}'; // Missing required fields (did, session_id)

     

       
140
       
140
       
+
       
          when(

     

       
141
       
141
       
+
       
            mockStorage.read(key: storageKey),

     

       
142
       
142
       
+
       
          ).thenAnswer((_) async => invalidJson);

     

       
143
       
143
       
+
       
          when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
144
       
144
       
+
       


     

       
145
       
145
       
+
       
          // Act

     

       
146
       
146
       
+
       
          final result = await authService.restoreSession();

     

       
147
       
147
       
+
       


     

       
148
       
148
       
+
       
          // Assert

     

       
149
       
149
       
+
       
          // Should return null and clear corrupted storage

     

       
150
       
150
       
+
       
          expect(result, isNull);

     

       
151
       
151
       
+
       
          verify(mockStorage.read(key: storageKey)).called(1);

     

       
152
       
152
       
+
       
          verify(mockStorage.delete(key: storageKey)).called(1);

     

       
153
       
153
       
+
       
        },

     

       
154
       
154
       
+
       
      );

     

       
152
       
155
       
 
       


     

       
153
       
156
       
 
       
      test('should handle storage read errors gracefully', () async {

     

       
154
       
157
       
 
       
        // Arrange

     

       
155
       
155
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
156
       
156
       
-
       
            .thenThrow(Exception('Storage error'));

     

       
157
       
157
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
158
       
158
       
-
       
            .thenAnswer((_) async => {});

     

       
158
       
158
       
+
       
        when(

     

       
159
       
159
       
+
       
          mockStorage.read(key: storageKey),

     

       
160
       
160
       
+
       
        ).thenThrow(Exception('Storage error'));

     

       
161
       
161
       
+
       
        when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
159
       
162
       
 
       


     

       
160
       
163
       
 
       
        // Act

     

       
161
       
164
       
 
       
        final result = await authService.restoreSession();

     
···

       
169
       
172
       
 
       
    group('refreshToken()', () {

     

       
170
       
173
       
 
       
      test('should throw StateError when no session exists', () async {

     

       
171
       
174
       
 
       
        // Act & Assert

     

       
172
       
172
       
-
       
        expect(

     

       
173
       
173
       
-
       
          () => authService.refreshToken(),

     

       
174
       
174
       
-
       
          throwsA(isA<StateError>()),

     

       
175
       
175
       
-
       
        );

     

       
175
       
175
       
+
       
        expect(() => authService.refreshToken(), throwsA(isA<StateError>()));

     

       
176
       
176
       
 
       
      });

     

       
177
       
177
       
 
       


     

       
178
       
178
       
-
       
      test('should successfully refresh token and return updated session',

     

       
179
       
179
       
-
       
          () async {

     

       
180
       
180
       
-
       
        // Arrange - First restore a session

     

       
181
       
181
       
-
       
        const initialSession = CovesSession(

     

       
182
       
182
       
-
       
          token: 'old-token',

     

       
183
       
183
       
-
       
          did: 'did:plc:test123',

     

       
184
       
184
       
-
       
          sessionId: 'session-123',

     

       
185
       
185
       
-
       
          handle: 'alice.bsky.social',

     

       
186
       
186
       
-
       
        );

     

       
187
       
187
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
188
       
188
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
189
       
189
       
-
       
        await authService.restoreSession();

     

       
190
       
190
       
-
       


     

       
191
       
191
       
-
       
        // Mock successful refresh response

     

       
192
       
192
       
-
       
        const newToken = 'new-refreshed-token';

     

       
193
       
193
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
194
       
194
       
-
       
          '/oauth/refresh',

     

       
195
       
195
       
-
       
          data: anyNamed('data'),

     

       
196
       
196
       
-
       
        )).thenAnswer((_) async => Response(

     

       
178
       
178
       
+
       
      test(

     

       
179
       
179
       
+
       
        'should successfully refresh token and return updated session',

     

       
180
       
180
       
+
       
        () async {

     

       
181
       
181
       
+
       
          // Arrange - First restore a session

     

       
182
       
182
       
+
       
          const initialSession = CovesSession(

     

       
183
       
183
       
+
       
            token: 'old-token',

     

       
184
       
184
       
+
       
            did: 'did:plc:test123',

     

       
185
       
185
       
+
       
            sessionId: 'session-123',

     

       
186
       
186
       
+
       
            handle: 'alice.bsky.social',

     

       
187
       
187
       
+
       
          );

     

       
188
       
188
       
+
       
          when(

     

       
189
       
189
       
+
       
            mockStorage.read(key: storageKey),

     

       
190
       
190
       
+
       
          ).thenAnswer((_) async => initialSession.toJsonString());

     

       
191
       
191
       
+
       
          await authService.restoreSession();

     

       
192
       
192
       
+
       


     

       
193
       
193
       
+
       
          // Mock successful refresh response

     

       
194
       
194
       
+
       
          const newToken = 'new-refreshed-token';

     

       
195
       
195
       
+
       
          when(

     

       
196
       
196
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
197
       
197
       
+
       
              '/oauth/refresh',

     

       
198
       
198
       
+
       
              data: anyNamed('data'),

     

       
199
       
199
       
+
       
            ),

     

       
200
       
200
       
+
       
          ).thenAnswer(

     

       
201
       
201
       
+
       
            (_) async => Response(

     

       
197
       
202
       
 
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
198
       
203
       
 
       
              statusCode: 200,

     

       
199
       
199
       
-
       
              data: {'sealed_token': newToken, 'access_token': 'some-access-token'},

     

       
200
       
200
       
-
       
            ));

     

       
201
       
201
       
-
       


     

       
202
       
202
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
203
       
203
       
-
       
            .thenAnswer((_) async => {});

     

       
204
       
204
       
-
       


     

       
205
       
205
       
-
       
        // Act

     

       
206
       
206
       
-
       
        final result = await authService.refreshToken();

     

       
204
       
204
       
+
       
              data: {

     

       
205
       
205
       
+
       
                'sealed_token': newToken,

     

       
206
       
206
       
+
       
                'access_token': 'some-access-token',

     

       
207
       
207
       
+
       
              },

     

       
208
       
208
       
+
       
            ),

     

       
209
       
209
       
+
       
          );

     

       
207
       
210
       
 
       


     

       
208
       
208
       
-
       
        // Assert

     

       
209
       
209
       
-
       
        expect(result.token, newToken);

     

       
210
       
210
       
-
       
        expect(result.did, 'did:plc:test123');

     

       
211
       
211
       
-
       
        expect(result.sessionId, 'session-123');

     

       
212
       
212
       
-
       
        expect(result.handle, 'alice.bsky.social');

     

       
213
       
213
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
214
       
214
       
-
       
          '/oauth/refresh',

     

       
215
       
215
       
-
       
          data: anyNamed('data'),

     

       
216
       
216
       
-
       
        )).called(1);

     

       
217
       
217
       
-
       
        verify(mockStorage.write(

     

       
218
       
218
       
-
       
          key: storageKey,

     

       
219
       
219
       
-
       
          value: anyNamed('value'),

     

       
220
       
220
       
-
       
        )).called(1);

     

       
221
       
221
       
-
       
      });

     

       
211
       
211
       
+
       
          when(

     

       
212
       
212
       
+
       
            mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
213
       
213
       
+
       
          ).thenAnswer((_) async => {});

     

       
214
       
214
       
+
       


     

       
215
       
215
       
+
       
          // Act

     

       
216
       
216
       
+
       
          final result = await authService.refreshToken();

     

       
217
       
217
       
+
       


     

       
218
       
218
       
+
       
          // Assert

     

       
219
       
219
       
+
       
          expect(result.token, newToken);

     

       
220
       
220
       
+
       
          expect(result.did, 'did:plc:test123');

     

       
221
       
221
       
+
       
          expect(result.sessionId, 'session-123');

     

       
222
       
222
       
+
       
          expect(result.handle, 'alice.bsky.social');

     

       
223
       
223
       
+
       
          verify(

     

       
224
       
224
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
225
       
225
       
+
       
              '/oauth/refresh',

     

       
226
       
226
       
+
       
              data: anyNamed('data'),

     

       
227
       
227
       
+
       
            ),

     

       
228
       
228
       
+
       
          ).called(1);

     

       
229
       
229
       
+
       
          verify(

     

       
230
       
230
       
+
       
            mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
231
       
231
       
+
       
          ).called(1);

     

       
232
       
232
       
+
       
        },

     

       
233
       
233
       
+
       
      );

     

       
222
       
234
       
 
       


     

       
223
       
235
       
 
       
      test('should throw "Session expired" on 401 response', () async {

     

       
224
       
236
       
 
       
        // Arrange - First restore a session

     
···

       
227
       
239
       
 
       
          did: 'did:plc:test123',

     

       
228
       
240
       
 
       
          sessionId: 'session-123',

     

       
229
       
241
       
 
       
        );

     

       
230
       
230
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
231
       
231
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
242
       
242
       
+
       
        when(

     

       
243
       
243
       
+
       
          mockStorage.read(key: storageKey),

     

       
244
       
244
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
232
       
245
       
 
       
        await authService.restoreSession();

     

       
233
       
246
       
 
       


     

       
234
       
247
       
 
       
        // Mock 401 response

     

       
235
       
235
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
236
       
236
       
-
       
          '/oauth/refresh',

     

       
237
       
237
       
-
       
          data: anyNamed('data'),

     

       
238
       
238
       
-
       
        )).thenThrow(

     

       
248
       
248
       
+
       
        when(

     

       
249
       
249
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
250
       
250
       
+
       
            '/oauth/refresh',

     

       
251
       
251
       
+
       
            data: anyNamed('data'),

     

       
252
       
252
       
+
       
          ),

     

       
253
       
253
       
+
       
        ).thenThrow(

     

       
239
       
254
       
 
       
          DioException(

     

       
240
       
255
       
 
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
241
       
256
       
 
       
            type: DioExceptionType.badResponse,

     
···

       
250
       
265
       
 
       
        expect(

     

       
251
       
266
       
 
       
          () => authService.refreshToken(),

     

       
252
       
267
       
 
       
          throwsA(

     

       
253
       
253
       
-
       
            predicate((e) =>

     

       
254
       
254
       
-
       
                e is Exception && e.toString().contains('Session expired')),

     

       
268
       
268
       
+
       
            predicate(

     

       
269
       
269
       
+
       
              (e) => e is Exception && e.toString().contains('Session expired'),

     

       
270
       
270
       
+
       
            ),

     

       
255
       
271
       
 
       
          ),

     

       
256
       
272
       
 
       
        );

     

       
257
       
273
       
 
       
      });

     
···

       
263
       
279
       
 
       
          did: 'did:plc:test123',

     

       
264
       
280
       
 
       
          sessionId: 'session-123',

     

       
265
       
281
       
 
       
        );

     

       
266
       
266
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
267
       
267
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
282
       
282
       
+
       
        when(

     

       
283
       
283
       
+
       
          mockStorage.read(key: storageKey),

     

       
284
       
284
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
268
       
285
       
 
       
        await authService.restoreSession();

     

       
269
       
286
       
 
       


     

       
270
       
287
       
 
       
        // Mock network error

     

       
271
       
271
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
272
       
272
       
-
       
          '/oauth/refresh',

     

       
273
       
273
       
-
       
          data: anyNamed('data'),

     

       
274
       
274
       
-
       
        )).thenThrow(

     

       
288
       
288
       
+
       
        when(

     

       
289
       
289
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
290
       
290
       
+
       
            '/oauth/refresh',

     

       
291
       
291
       
+
       
            data: anyNamed('data'),

     

       
292
       
292
       
+
       
          ),

     

       
293
       
293
       
+
       
        ).thenThrow(

     

       
275
       
294
       
 
       
          DioException(

     

       
276
       
295
       
 
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
277
       
296
       
 
       
            type: DioExceptionType.connectionError,

     
···

       
283
       
302
       
 
       
        expect(

     

       
284
       
303
       
 
       
          () => authService.refreshToken(),

     

       
285
       
304
       
 
       
          throwsA(

     

       
286
       
286
       
-
       
            predicate((e) =>

     

       
287
       
287
       
-
       
                e is Exception &&

     

       
288
       
288
       
-
       
                e.toString().contains('Token refresh failed')),

     

       
305
       
305
       
+
       
            predicate(

     

       
306
       
306
       
+
       
              (e) =>

     

       
307
       
307
       
+
       
                  e is Exception &&

     

       
308
       
308
       
+
       
                  e.toString().contains('Token refresh failed'),

     

       
309
       
309
       
+
       
            ),

     

       
289
       
310
       
 
       
          ),

     

       
290
       
311
       
 
       
        );

     

       
291
       
312
       
 
       
      });

     

       
292
       
313
       
 
       


     

       
293
       
293
       
-
       
      test('should throw Exception when response is missing sealed_token', () async {

     

       
294
       
294
       
-
       
        // Arrange - First restore a session

     

       
295
       
295
       
-
       
        const session = CovesSession(

     

       
296
       
296
       
-
       
          token: 'old-token',

     

       
297
       
297
       
-
       
          did: 'did:plc:test123',

     

       
298
       
298
       
-
       
          sessionId: 'session-123',

     

       
299
       
299
       
-
       
        );

     

       
300
       
300
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
301
       
301
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
302
       
302
       
-
       
        await authService.restoreSession();

     

       
303
       
303
       
-
       


     

       
304
       
304
       
-
       
        // Mock response without sealed_token

     

       
305
       
305
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
306
       
306
       
-
       
          '/oauth/refresh',

     

       
307
       
307
       
-
       
          data: anyNamed('data'),

     

       
308
       
308
       
-
       
        )).thenAnswer((_) async => Response(

     

       
314
       
314
       
+
       
      test(

     

       
315
       
315
       
+
       
        'should throw Exception when response is missing sealed_token',

     

       
316
       
316
       
+
       
        () async {

     

       
317
       
317
       
+
       
          // Arrange - First restore a session

     

       
318
       
318
       
+
       
          const session = CovesSession(

     

       
319
       
319
       
+
       
            token: 'old-token',

     

       
320
       
320
       
+
       
            did: 'did:plc:test123',

     

       
321
       
321
       
+
       
            sessionId: 'session-123',

     

       
322
       
322
       
+
       
          );

     

       
323
       
323
       
+
       
          when(

     

       
324
       
324
       
+
       
            mockStorage.read(key: storageKey),

     

       
325
       
325
       
+
       
          ).thenAnswer((_) async => session.toJsonString());

     

       
326
       
326
       
+
       
          await authService.restoreSession();

     

       
327
       
327
       
+
       


     

       
328
       
328
       
+
       
          // Mock response without sealed_token

     

       
329
       
329
       
+
       
          when(

     

       
330
       
330
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
331
       
331
       
+
       
              '/oauth/refresh',

     

       
332
       
332
       
+
       
              data: anyNamed('data'),

     

       
333
       
333
       
+
       
            ),

     

       
334
       
334
       
+
       
          ).thenAnswer(

     

       
335
       
335
       
+
       
            (_) async => Response(

     

       
309
       
336
       
 
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
310
       
337
       
 
       
              statusCode: 200,

     

       
311
       
338
       
 
       
              data: {'access_token': 'some-token'}, // No sealed_token field

     

       
312
       
312
       
-
       
            ));

     

       
313
       
313
       
-
       


     

       
314
       
314
       
-
       
        // Act & Assert

     

       
315
       
315
       
-
       
        expect(

     

       
316
       
316
       
-
       
          () => authService.refreshToken(),

     

       
317
       
317
       
-
       
          throwsA(

     

       
318
       
318
       
-
       
            predicate((e) =>

     

       
319
       
319
       
-
       
                e is Exception &&

     

       
320
       
320
       
-
       
                e.toString().contains('Invalid refresh response')),

     

       
321
       
321
       
-
       
          ),

     

       
322
       
322
       
-
       
        );

     

       
323
       
323
       
-
       
      });

     

       
339
       
339
       
+
       
            ),

     

       
340
       
340
       
+
       
          );

     

       
324
       
341
       
 
       


     

       
325
       
325
       
-
       
      test('should throw Exception when response sealed_token is empty', () async {

     

       
326
       
326
       
-
       
        // Arrange - First restore a session

     

       
327
       
327
       
-
       
        const session = CovesSession(

     

       
328
       
328
       
-
       
          token: 'old-token',

     

       
329
       
329
       
-
       
          did: 'did:plc:test123',

     

       
330
       
330
       
-
       
          sessionId: 'session-123',

     

       
331
       
331
       
-
       
        );

     

       
332
       
332
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
333
       
333
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
334
       
334
       
-
       
        await authService.restoreSession();

     

       
342
       
342
       
+
       
          // Act & Assert

     

       
343
       
343
       
+
       
          expect(

     

       
344
       
344
       
+
       
            () => authService.refreshToken(),

     

       
345
       
345
       
+
       
            throwsA(

     

       
346
       
346
       
+
       
              predicate(

     

       
347
       
347
       
+
       
                (e) =>

     

       
348
       
348
       
+
       
                    e is Exception &&

     

       
349
       
349
       
+
       
                    e.toString().contains('Invalid refresh response'),

     

       
350
       
350
       
+
       
              ),

     

       
351
       
351
       
+
       
            ),

     

       
352
       
352
       
+
       
          );

     

       
353
       
353
       
+
       
        },

     

       
354
       
354
       
+
       
      );

     

       
335
       
355
       
 
       


     

       
336
       
336
       
-
       
        // Mock response with empty sealed_token

     

       
337
       
337
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
338
       
338
       
-
       
          '/oauth/refresh',

     

       
339
       
339
       
-
       
          data: anyNamed('data'),

     

       
340
       
340
       
-
       
        )).thenAnswer((_) async => Response(

     

       
356
       
356
       
+
       
      test(

     

       
357
       
357
       
+
       
        'should throw Exception when response sealed_token is empty',

     

       
358
       
358
       
+
       
        () async {

     

       
359
       
359
       
+
       
          // Arrange - First restore a session

     

       
360
       
360
       
+
       
          const session = CovesSession(

     

       
361
       
361
       
+
       
            token: 'old-token',

     

       
362
       
362
       
+
       
            did: 'did:plc:test123',

     

       
363
       
363
       
+
       
            sessionId: 'session-123',

     

       
364
       
364
       
+
       
          );

     

       
365
       
365
       
+
       
          when(

     

       
366
       
366
       
+
       
            mockStorage.read(key: storageKey),

     

       
367
       
367
       
+
       
          ).thenAnswer((_) async => session.toJsonString());

     

       
368
       
368
       
+
       
          await authService.restoreSession();

     

       
369
       
369
       
+
       


     

       
370
       
370
       
+
       
          // Mock response with empty sealed_token

     

       
371
       
371
       
+
       
          when(

     

       
372
       
372
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
373
       
373
       
+
       
              '/oauth/refresh',

     

       
374
       
374
       
+
       
              data: anyNamed('data'),

     

       
375
       
375
       
+
       
            ),

     

       
376
       
376
       
+
       
          ).thenAnswer(

     

       
377
       
377
       
+
       
            (_) async => Response(

     

       
341
       
378
       
 
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
342
       
379
       
 
       
              statusCode: 200,

     

       
343
       
343
       
-
       
              data: {'sealed_token': '', 'access_token': 'some-token'}, // Empty sealed_token

     

       
344
       
344
       
-
       
            ));

     

       
380
       
380
       
+
       
              data: {

     

       
381
       
381
       
+
       
                'sealed_token': '',

     

       
382
       
382
       
+
       
                'access_token': 'some-token',

     

       
383
       
383
       
+
       
              }, // Empty sealed_token

     

       
384
       
384
       
+
       
            ),

     

       
385
       
385
       
+
       
          );

     

       
345
       
386
       
 
       


     

       
346
       
346
       
-
       
        // Act & Assert

     

       
347
       
347
       
-
       
        expect(

     

       
348
       
348
       
-
       
          () => authService.refreshToken(),

     

       
349
       
349
       
-
       
          throwsA(

     

       
350
       
350
       
-
       
            predicate((e) =>

     

       
351
       
351
       
-
       
                e is Exception &&

     

       
352
       
352
       
-
       
                e.toString().contains('Invalid refresh response')),

     

       
353
       
353
       
-
       
          ),

     

       
354
       
354
       
-
       
        );

     

       
355
       
355
       
-
       
      });

     

       
387
       
387
       
+
       
          // Act & Assert

     

       
388
       
388
       
+
       
          expect(

     

       
389
       
389
       
+
       
            () => authService.refreshToken(),

     

       
390
       
390
       
+
       
            throwsA(

     

       
391
       
391
       
+
       
              predicate(

     

       
392
       
392
       
+
       
                (e) =>

     

       
393
       
393
       
+
       
                    e is Exception &&

     

       
394
       
394
       
+
       
                    e.toString().contains('Invalid refresh response'),

     

       
395
       
395
       
+
       
              ),

     

       
396
       
396
       
+
       
            ),

     

       
397
       
397
       
+
       
          );

     

       
398
       
398
       
+
       
        },

     

       
399
       
399
       
+
       
      );

     

       
356
       
400
       
 
       
    });

     

       
357
       
401
       
 
       


     

       
358
       
402
       
 
       
    group('signOut()', () {

     

       
359
       
359
       
-
       
      test('should clear session and storage on successful server-side logout',

     

       
360
       
360
       
-
       
          () async {

     

       
361
       
361
       
-
       
        // Arrange - First restore a session

     

       
362
       
362
       
-
       
        const session = CovesSession(

     

       
363
       
363
       
-
       
          token: 'test-token',

     

       
364
       
364
       
-
       
          did: 'did:plc:test123',

     

       
365
       
365
       
-
       
          sessionId: 'session-123',

     

       
366
       
366
       
-
       
        );

     

       
367
       
367
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
368
       
368
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
369
       
369
       
-
       
        await authService.restoreSession();

     

       
370
       
370
       
-
       


     

       
371
       
371
       
-
       
        // Mock successful logout

     

       
372
       
372
       
-
       
        when(mockDio.post<void>(

     

       
373
       
373
       
-
       
          '/oauth/logout',

     

       
374
       
374
       
-
       
          options: anyNamed('options'),

     

       
375
       
375
       
-
       
        )).thenAnswer((_) async => Response(

     

       
403
       
403
       
+
       
      test(

     

       
404
       
404
       
+
       
        'should clear session and storage on successful server-side logout',

     

       
405
       
405
       
+
       
        () async {

     

       
406
       
406
       
+
       
          // Arrange - First restore a session

     

       
407
       
407
       
+
       
          const session = CovesSession(

     

       
408
       
408
       
+
       
            token: 'test-token',

     

       
409
       
409
       
+
       
            did: 'did:plc:test123',

     

       
410
       
410
       
+
       
            sessionId: 'session-123',

     

       
411
       
411
       
+
       
          );

     

       
412
       
412
       
+
       
          when(

     

       
413
       
413
       
+
       
            mockStorage.read(key: storageKey),

     

       
414
       
414
       
+
       
          ).thenAnswer((_) async => session.toJsonString());

     

       
415
       
415
       
+
       
          await authService.restoreSession();

     

       
416
       
416
       
+
       


     

       
417
       
417
       
+
       
          // Mock successful logout

     

       
418
       
418
       
+
       
          when(

     

       
419
       
419
       
+
       
            mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
420
       
420
       
+
       
          ).thenAnswer(

     

       
421
       
421
       
+
       
            (_) async => Response(

     

       
376
       
422
       
 
       
              requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
377
       
423
       
 
       
              statusCode: 200,

     

       
378
       
378
       
-
       
            ));

     

       
424
       
424
       
+
       
            ),

     

       
425
       
425
       
+
       
          );

     

       
379
       
426
       
 
       


     

       
380
       
380
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
381
       
381
       
-
       
            .thenAnswer((_) async => {});

     

       
427
       
427
       
+
       
          when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
382
       
428
       
 
       


     

       
383
       
383
       
-
       
        // Act

     

       
384
       
384
       
-
       
        await authService.signOut();

     

       
429
       
429
       
+
       
          // Act

     

       
430
       
430
       
+
       
          await authService.signOut();

     

       
385
       
431
       
 
       


     

       
386
       
386
       
-
       
        // Assert

     

       
387
       
387
       
-
       
        expect(authService.session, isNull);

     

       
388
       
388
       
-
       
        expect(authService.isAuthenticated, isFalse);

     

       
389
       
389
       
-
       
        verify(mockDio.post<void>(

     

       
390
       
390
       
-
       
          '/oauth/logout',

     

       
391
       
391
       
-
       
          options: anyNamed('options'),

     

       
392
       
392
       
-
       
        )).called(1);

     

       
393
       
393
       
-
       
        verify(mockStorage.delete(key: storageKey)).called(1);

     

       
394
       
394
       
-
       
      });

     

       
432
       
432
       
+
       
          // Assert

     

       
433
       
433
       
+
       
          expect(authService.session, isNull);

     

       
434
       
434
       
+
       
          expect(authService.isAuthenticated, isFalse);

     

       
435
       
435
       
+
       
          verify(

     

       
436
       
436
       
+
       
            mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
437
       
437
       
+
       
          ).called(1);

     

       
438
       
438
       
+
       
          verify(mockStorage.delete(key: storageKey)).called(1);

     

       
439
       
439
       
+
       
        },

     

       
440
       
440
       
+
       
      );

     

       
395
       
441
       
 
       


     

       
396
       
396
       
-
       
      test('should clear local state even when server revocation fails',

     

       
397
       
397
       
-
       
          () async {

     

       
398
       
398
       
-
       
        // Arrange - First restore a session

     

       
399
       
399
       
-
       
        const session = CovesSession(

     

       
400
       
400
       
-
       
          token: 'test-token',

     

       
401
       
401
       
-
       
          did: 'did:plc:test123',

     

       
402
       
402
       
-
       
          sessionId: 'session-123',

     

       
403
       
403
       
-
       
        );

     

       
404
       
404
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
405
       
405
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
406
       
406
       
-
       
        await authService.restoreSession();

     

       
407
       
407
       
-
       


     

       
408
       
408
       
-
       
        // Mock server error

     

       
409
       
409
       
-
       
        when(mockDio.post<void>(

     

       
410
       
410
       
-
       
          '/oauth/logout',

     

       
411
       
411
       
-
       
          options: anyNamed('options'),

     

       
412
       
412
       
-
       
        )).thenThrow(

     

       
413
       
413
       
-
       
          DioException(

     

       
414
       
414
       
-
       
            requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
415
       
415
       
-
       
            type: DioExceptionType.connectionError,

     

       
416
       
416
       
-
       
            message: 'Connection failed',

     

       
417
       
417
       
-
       
          ),

     

       
418
       
418
       
-
       
        );

     

       
442
       
442
       
+
       
      test(

     

       
443
       
443
       
+
       
        'should clear local state even when server revocation fails',

     

       
444
       
444
       
+
       
        () async {

     

       
445
       
445
       
+
       
          // Arrange - First restore a session

     

       
446
       
446
       
+
       
          const session = CovesSession(

     

       
447
       
447
       
+
       
            token: 'test-token',

     

       
448
       
448
       
+
       
            did: 'did:plc:test123',

     

       
449
       
449
       
+
       
            sessionId: 'session-123',

     

       
450
       
450
       
+
       
          );

     

       
451
       
451
       
+
       
          when(

     

       
452
       
452
       
+
       
            mockStorage.read(key: storageKey),

     

       
453
       
453
       
+
       
          ).thenAnswer((_) async => session.toJsonString());

     

       
454
       
454
       
+
       
          await authService.restoreSession();

     

       
455
       
455
       
+
       


     

       
456
       
456
       
+
       
          // Mock server error

     

       
457
       
457
       
+
       
          when(

     

       
458
       
458
       
+
       
            mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
459
       
459
       
+
       
          ).thenThrow(

     

       
460
       
460
       
+
       
            DioException(

     

       
461
       
461
       
+
       
              requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
462
       
462
       
+
       
              type: DioExceptionType.connectionError,

     

       
463
       
463
       
+
       
              message: 'Connection failed',

     

       
464
       
464
       
+
       
            ),

     

       
465
       
465
       
+
       
          );

     

       
419
       
466
       
 
       


     

       
420
       
420
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
421
       
421
       
-
       
            .thenAnswer((_) async => {});

     

       
467
       
467
       
+
       
          when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
422
       
468
       
 
       


     

       
423
       
423
       
-
       
        // Act

     

       
424
       
424
       
-
       
        await authService.signOut();

     

       
469
       
469
       
+
       
          // Act

     

       
470
       
470
       
+
       
          await authService.signOut();

     

       
425
       
471
       
 
       


     

       
426
       
426
       
-
       
        // Assert

     

       
427
       
427
       
-
       
        expect(authService.session, isNull);

     

       
428
       
428
       
-
       
        expect(authService.isAuthenticated, isFalse);

     

       
429
       
429
       
-
       
        verify(mockStorage.delete(key: storageKey)).called(1);

     

       
430
       
430
       
-
       
      });

     

       
472
       
472
       
+
       
          // Assert

     

       
473
       
473
       
+
       
          expect(authService.session, isNull);

     

       
474
       
474
       
+
       
          expect(authService.isAuthenticated, isFalse);

     

       
475
       
475
       
+
       
          verify(mockStorage.delete(key: storageKey)).called(1);

     

       
476
       
476
       
+
       
        },

     

       
477
       
477
       
+
       
      );

     

       
431
       
478
       
 
       


     

       
432
       
479
       
 
       
      test('should work even when no session exists', () async {

     

       
433
       
480
       
 
       
        // Arrange

     

       
434
       
434
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
435
       
435
       
-
       
            .thenAnswer((_) async => {});

     

       
481
       
481
       
+
       
        when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
436
       
482
       
 
       


     

       
437
       
483
       
 
       
        // Act

     

       
438
       
484
       
 
       
        await authService.signOut();

     
···

       
441
       
487
       
 
       
        expect(authService.session, isNull);

     

       
442
       
488
       
 
       
        expect(authService.isAuthenticated, isFalse);

     

       
443
       
489
       
 
       
        verify(mockStorage.delete(key: storageKey)).called(1);

     

       
444
       
444
       
-
       
        verifyNever(mockDio.post<void>(

     

       
445
       
445
       
-
       
          '/oauth/logout',

     

       
446
       
446
       
-
       
          options: anyNamed('options'),

     

       
447
       
447
       
-
       
        ));

     

       
490
       
490
       
+
       
        verifyNever(

     

       
491
       
491
       
+
       
          mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
492
       
492
       
+
       
        );

     

       
448
       
493
       
 
       
      });

     

       
449
       
494
       
 
       


     

       
450
       
495
       
 
       
      test('should clear local state even when storage delete fails', () async {

     
···

       
454
       
499
       
 
       
          did: 'did:plc:test123',

     

       
455
       
500
       
 
       
          sessionId: 'session-123',

     

       
456
       
501
       
 
       
        );

     

       
457
       
457
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
458
       
458
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
502
       
502
       
+
       
        when(

     

       
503
       
503
       
+
       
          mockStorage.read(key: storageKey),

     

       
504
       
504
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
459
       
505
       
 
       
        await authService.restoreSession();

     

       
460
       
506
       
 
       


     

       
461
       
461
       
-
       
        when(mockDio.post<void>(

     

       
462
       
462
       
-
       
          '/oauth/logout',

     

       
463
       
463
       
-
       
          options: anyNamed('options'),

     

       
464
       
464
       
-
       
        )).thenAnswer((_) async => Response(

     

       
465
       
465
       
-
       
              requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
466
       
466
       
-
       
              statusCode: 200,

     

       
467
       
467
       
-
       
            ));

     

       
507
       
507
       
+
       
        when(

     

       
508
       
508
       
+
       
          mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
509
       
509
       
+
       
        ).thenAnswer(

     

       
510
       
510
       
+
       
          (_) async => Response(

     

       
511
       
511
       
+
       
            requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
512
       
512
       
+
       
            statusCode: 200,

     

       
513
       
513
       
+
       
          ),

     

       
514
       
514
       
+
       
        );

     

       
468
       
515
       
 
       


     

       
469
       
469
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
470
       
470
       
-
       
            .thenThrow(Exception('Storage error'));

     

       
516
       
516
       
+
       
        when(

     

       
517
       
517
       
+
       
          mockStorage.delete(key: storageKey),

     

       
518
       
518
       
+
       
        ).thenThrow(Exception('Storage error'));

     

       
471
       
519
       
 
       


     

       
472
       
520
       
 
       
        // Act & Assert - Should not throw

     

       
473
       
521
       
 
       
        expect(() => authService.signOut(), throwsA(isA<Exception>()));

     
···

       
485
       
533
       
 
       
          did: 'did:plc:test123',

     

       
486
       
534
       
 
       
          sessionId: 'session-123',

     

       
487
       
535
       
 
       
        );

     

       
488
       
488
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
489
       
489
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
536
       
536
       
+
       
        when(

     

       
537
       
537
       
+
       
          mockStorage.read(key: storageKey),

     

       
538
       
538
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
490
       
539
       
 
       
        await authService.restoreSession();

     

       
491
       
540
       
 
       


     

       
492
       
541
       
 
       
        // Act

     
···

       
511
       
560
       
 
       
          did: 'did:plc:test123',

     

       
512
       
561
       
 
       
          sessionId: 'session-123',

     

       
513
       
562
       
 
       
        );

     

       
514
       
514
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
515
       
515
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
563
       
563
       
+
       
        when(

     

       
564
       
564
       
+
       
          mockStorage.read(key: storageKey),

     

       
565
       
565
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
516
       
566
       
 
       
        await authService.restoreSession();

     

       
517
       
567
       
 
       


     

       
518
       
518
       
-
       
        when(mockDio.post<void>(

     

       
519
       
519
       
-
       
          '/oauth/logout',

     

       
520
       
520
       
-
       
          options: anyNamed('options'),

     

       
521
       
521
       
-
       
        )).thenAnswer((_) async => Response(

     

       
522
       
522
       
-
       
              requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
523
       
523
       
-
       
              statusCode: 200,

     

       
524
       
524
       
-
       
            ));

     

       
525
       
525
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
526
       
526
       
-
       
            .thenAnswer((_) async => {});

     

       
568
       
568
       
+
       
        when(

     

       
569
       
569
       
+
       
          mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
570
       
570
       
+
       
        ).thenAnswer(

     

       
571
       
571
       
+
       
          (_) async => Response(

     

       
572
       
572
       
+
       
            requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
573
       
573
       
+
       
            statusCode: 200,

     

       
574
       
574
       
+
       
          ),

     

       
575
       
575
       
+
       
        );

     

       
576
       
576
       
+
       
        when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
527
       
577
       
 
       


     

       
528
       
578
       
 
       
        // Act

     

       
529
       
579
       
 
       
        await authService.signOut();

     
···

       
547
       
597
       
 
       
          did: 'did:plc:test123',

     

       
548
       
598
       
 
       
          sessionId: 'session-123',

     

       
549
       
599
       
 
       
        );

     

       
550
       
550
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
551
       
551
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
600
       
600
       
+
       
        when(

     

       
601
       
601
       
+
       
          mockStorage.read(key: storageKey),

     

       
602
       
602
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
552
       
603
       
 
       
        await authService.restoreSession();

     

       
553
       
604
       
 
       


     

       
554
       
605
       
 
       
        // Assert

     
···

       
562
       
613
       
 
       
          did: 'did:plc:test123',

     

       
563
       
614
       
 
       
          sessionId: 'session-123',

     

       
564
       
615
       
 
       
        );

     

       
565
       
565
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
566
       
566
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
616
       
616
       
+
       
        when(

     

       
617
       
617
       
+
       
          mockStorage.read(key: storageKey),

     

       
618
       
618
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
567
       
619
       
 
       
        await authService.restoreSession();

     

       
568
       
620
       
 
       


     

       
569
       
569
       
-
       
        when(mockDio.post<void>(

     

       
570
       
570
       
-
       
          '/oauth/logout',

     

       
571
       
571
       
-
       
          options: anyNamed('options'),

     

       
572
       
572
       
-
       
        )).thenAnswer((_) async => Response(

     

       
573
       
573
       
-
       
              requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
574
       
574
       
-
       
              statusCode: 200,

     

       
575
       
575
       
-
       
            ));

     

       
576
       
576
       
-
       
        when(mockStorage.delete(key: storageKey))

     

       
577
       
577
       
-
       
            .thenAnswer((_) async => {});

     

       
621
       
621
       
+
       
        when(

     

       
622
       
622
       
+
       
          mockDio.post<void>('/oauth/logout', options: anyNamed('options')),

     

       
623
       
623
       
+
       
        ).thenAnswer(

     

       
624
       
624
       
+
       
          (_) async => Response(

     

       
625
       
625
       
+
       
            requestOptions: RequestOptions(path: '/oauth/logout'),

     

       
626
       
626
       
+
       
            statusCode: 200,

     

       
627
       
627
       
+
       
          ),

     

       
628
       
628
       
+
       
        );

     

       
629
       
629
       
+
       
        when(mockStorage.delete(key: storageKey)).thenAnswer((_) async => {});

     

       
578
       
630
       
 
       


     

       
579
       
631
       
 
       
        // Act

     

       
580
       
632
       
 
       
        await authService.signOut();

     
···

       
592
       
644
       
 
       
          did: 'did:plc:test123',

     

       
593
       
645
       
 
       
          sessionId: 'session-123',

     

       
594
       
646
       
 
       
        );

     

       
595
       
595
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
596
       
596
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
647
       
647
       
+
       
        when(

     

       
648
       
648
       
+
       
          mockStorage.read(key: storageKey),

     

       
649
       
649
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
597
       
650
       
 
       


     

       
598
       
651
       
 
       
        // Act

     

       
599
       
652
       
 
       
        await authService.restoreSession();

     
···

       
611
       
664
       
 
       
          did: 'did:plc:test123',

     

       
612
       
665
       
 
       
          sessionId: 'session-123',

     

       
613
       
666
       
 
       
        );

     

       
614
       
614
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
615
       
615
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
667
       
667
       
+
       
        when(

     

       
668
       
668
       
+
       
          mockStorage.read(key: storageKey),

     

       
669
       
669
       
+
       
        ).thenAnswer((_) async => initialSession.toJsonString());

     

       
616
       
670
       
 
       
        await authService.restoreSession();

     

       
617
       
671
       
 
       


     

       
618
       
672
       
 
       
        const newToken = 'new-token';

     

       
619
       
619
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
620
       
620
       
-
       
          '/oauth/refresh',

     

       
621
       
621
       
-
       
          data: anyNamed('data'),

     

       
622
       
622
       
-
       
        )).thenAnswer((_) async => Response(

     

       
623
       
623
       
-
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
624
       
624
       
-
       
              statusCode: 200,

     

       
625
       
625
       
-
       
              data: {'sealed_token': newToken, 'access_token': 'some-access-token'},

     

       
626
       
626
       
-
       
            ));

     

       
627
       
627
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
628
       
628
       
-
       
            .thenAnswer((_) async => {});

     

       
673
       
673
       
+
       
        when(

     

       
674
       
674
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
675
       
675
       
+
       
            '/oauth/refresh',

     

       
676
       
676
       
+
       
            data: anyNamed('data'),

     

       
677
       
677
       
+
       
          ),

     

       
678
       
678
       
+
       
        ).thenAnswer(

     

       
679
       
679
       
+
       
          (_) async => Response(

     

       
680
       
680
       
+
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
681
       
681
       
+
       
            statusCode: 200,

     

       
682
       
682
       
+
       
            data: {

     

       
683
       
683
       
+
       
              'sealed_token': newToken,

     

       
684
       
684
       
+
       
              'access_token': 'some-access-token',

     

       
685
       
685
       
+
       
            },

     

       
686
       
686
       
+
       
          ),

     

       
687
       
687
       
+
       
        );

     

       
688
       
688
       
+
       
        when(

     

       
689
       
689
       
+
       
          mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
690
       
690
       
+
       
        ).thenAnswer((_) async => {});

     

       
629
       
691
       
 
       


     

       
630
       
692
       
 
       
        // Act

     

       
631
       
693
       
 
       
        await authService.refreshToken();

     
···

       
637
       
699
       
 
       
    });

     

       
638
       
700
       
 
       


     

       
639
       
701
       
 
       
    group('refreshToken() - Concurrency Protection', () {

     

       
640
       
640
       
-
       
      test('should only make one API request for concurrent refresh calls',

     

       
641
       
641
       
-
       
          () async {

     

       
642
       
642
       
-
       
        // Arrange - First restore a session

     

       
643
       
643
       
-
       
        const initialSession = CovesSession(

     

       
644
       
644
       
-
       
          token: 'old-token',

     

       
645
       
645
       
-
       
          did: 'did:plc:test123',

     

       
646
       
646
       
-
       
          sessionId: 'session-123',

     

       
647
       
647
       
-
       
          handle: 'alice.bsky.social',

     

       
648
       
648
       
-
       
        );

     

       
649
       
649
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
650
       
650
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
651
       
651
       
-
       
        await authService.restoreSession();

     

       
652
       
652
       
-
       


     

       
653
       
653
       
-
       
        const newToken = 'new-refreshed-token';

     

       
654
       
654
       
-
       


     

       
655
       
655
       
-
       
        // Mock refresh response with a delay to simulate network latency

     

       
656
       
656
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
657
       
657
       
-
       
          '/oauth/refresh',

     

       
658
       
658
       
-
       
          data: anyNamed('data'),

     

       
659
       
659
       
-
       
        )).thenAnswer((_) async {

     

       
660
       
660
       
-
       
          await Future.delayed(const Duration(milliseconds: 100));

     

       
661
       
661
       
-
       
          return Response(

     

       
662
       
662
       
-
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
663
       
663
       
-
       
            statusCode: 200,

     

       
664
       
664
       
-
       
            data: {'sealed_token': newToken, 'access_token': 'some-access-token'},

     

       
702
       
702
       
+
       
      test(

     

       
703
       
703
       
+
       
        'should only make one API request for concurrent refresh calls',

     

       
704
       
704
       
+
       
        () async {

     

       
705
       
705
       
+
       
          // Arrange - First restore a session

     

       
706
       
706
       
+
       
          const initialSession = CovesSession(

     

       
707
       
707
       
+
       
            token: 'old-token',

     

       
708
       
708
       
+
       
            did: 'did:plc:test123',

     

       
709
       
709
       
+
       
            sessionId: 'session-123',

     

       
710
       
710
       
+
       
            handle: 'alice.bsky.social',

     

       
665
       
711
       
 
       
          );

     

       
666
       
666
       
-
       
        });

     

       
667
       
667
       
-
       


     

       
668
       
668
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
669
       
669
       
-
       
            .thenAnswer((_) async => {});

     

       
670
       
670
       
-
       


     

       
671
       
671
       
-
       
        // Act - Launch 3 concurrent refresh calls

     

       
672
       
672
       
-
       
        final results = await Future.wait([

     

       
673
       
673
       
-
       
          authService.refreshToken(),

     

       
674
       
674
       
-
       
          authService.refreshToken(),

     

       
675
       
675
       
-
       
          authService.refreshToken(),

     

       
676
       
676
       
-
       
        ]);

     

       
677
       
677
       
-
       


     

       
678
       
678
       
-
       
        // Assert - All calls should return the same refreshed session

     

       
679
       
679
       
-
       
        expect(results.length, 3);

     

       
680
       
680
       
-
       
        expect(results[0].token, newToken);

     

       
681
       
681
       
-
       
        expect(results[1].token, newToken);

     

       
682
       
682
       
-
       
        expect(results[2].token, newToken);

     

       
712
       
712
       
+
       
          when(

     

       
713
       
713
       
+
       
            mockStorage.read(key: storageKey),

     

       
714
       
714
       
+
       
          ).thenAnswer((_) async => initialSession.toJsonString());

     

       
715
       
715
       
+
       
          await authService.restoreSession();

     

       
716
       
716
       
+
       


     

       
717
       
717
       
+
       
          const newToken = 'new-refreshed-token';

     

       
718
       
718
       
+
       


     

       
719
       
719
       
+
       
          // Mock refresh response with a delay to simulate network latency

     

       
720
       
720
       
+
       
          when(

     

       
721
       
721
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
722
       
722
       
+
       
              '/oauth/refresh',

     

       
723
       
723
       
+
       
              data: anyNamed('data'),

     

       
724
       
724
       
+
       
            ),

     

       
725
       
725
       
+
       
          ).thenAnswer((_) async {

     

       
726
       
726
       
+
       
            await Future.delayed(const Duration(milliseconds: 100));

     

       
727
       
727
       
+
       
            return Response(

     

       
728
       
728
       
+
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
729
       
729
       
+
       
              statusCode: 200,

     

       
730
       
730
       
+
       
              data: {

     

       
731
       
731
       
+
       
                'sealed_token': newToken,

     

       
732
       
732
       
+
       
                'access_token': 'some-access-token',

     

       
733
       
733
       
+
       
              },

     

       
734
       
734
       
+
       
            );

     

       
735
       
735
       
+
       
          });

     

       
736
       
736
       
+
       


     

       
737
       
737
       
+
       
          when(

     

       
738
       
738
       
+
       
            mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
739
       
739
       
+
       
          ).thenAnswer((_) async => {});

     

       
740
       
740
       
+
       


     

       
741
       
741
       
+
       
          // Act - Launch 3 concurrent refresh calls

     

       
742
       
742
       
+
       
          final results = await Future.wait([

     

       
743
       
743
       
+
       
            authService.refreshToken(),

     

       
744
       
744
       
+
       
            authService.refreshToken(),

     

       
745
       
745
       
+
       
            authService.refreshToken(),

     

       
746
       
746
       
+
       
          ]);

     

       
747
       
747
       
+
       


     

       
748
       
748
       
+
       
          // Assert - All calls should return the same refreshed session

     

       
749
       
749
       
+
       
          expect(results.length, 3);

     

       
750
       
750
       
+
       
          expect(results[0].token, newToken);

     

       
751
       
751
       
+
       
          expect(results[1].token, newToken);

     

       
752
       
752
       
+
       
          expect(results[2].token, newToken);

     

       
753
       
753
       
+
       


     

       
754
       
754
       
+
       
          // Verify only one API call was made

     

       
755
       
755
       
+
       
          verify(

     

       
756
       
756
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
757
       
757
       
+
       
              '/oauth/refresh',

     

       
758
       
758
       
+
       
              data: anyNamed('data'),

     

       
759
       
759
       
+
       
            ),

     

       
760
       
760
       
+
       
          ).called(1);

     

       
683
       
761
       
 
       


     

       
684
       
684
       
-
       
        // Verify only one API call was made

     

       
685
       
685
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
686
       
686
       
-
       
          '/oauth/refresh',

     

       
687
       
687
       
-
       
          data: anyNamed('data'),

     

       
688
       
688
       
-
       
        )).called(1);

     

       
689
       
689
       
-
       


     

       
690
       
690
       
-
       
        // Verify only one storage write was made

     

       
691
       
691
       
-
       
        verify(mockStorage.write(

     

       
692
       
692
       
-
       
          key: storageKey,

     

       
693
       
693
       
-
       
          value: anyNamed('value'),

     

       
694
       
694
       
-
       
        )).called(1);

     

       
695
       
695
       
-
       
      });

     

       
762
       
762
       
+
       
          // Verify only one storage write was made

     

       
763
       
763
       
+
       
          verify(

     

       
764
       
764
       
+
       
            mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
765
       
765
       
+
       
          ).called(1);

     

       
766
       
766
       
+
       
        },

     

       
767
       
767
       
+
       
      );

     

       
696
       
768
       
 
       


     

       
697
       
769
       
 
       
      test('should propagate errors to all concurrent waiters', () async {

     

       
698
       
770
       
 
       
        // Arrange - First restore a session

     
···

       
701
       
773
       
 
       
          did: 'did:plc:test123',

     

       
702
       
774
       
 
       
          sessionId: 'session-123',

     

       
703
       
775
       
 
       
        );

     

       
704
       
704
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
705
       
705
       
-
       
            .thenAnswer((_) async => session.toJsonString());

     

       
776
       
776
       
+
       
        when(

     

       
777
       
777
       
+
       
          mockStorage.read(key: storageKey),

     

       
778
       
778
       
+
       
        ).thenAnswer((_) async => session.toJsonString());

     

       
706
       
779
       
 
       
        await authService.restoreSession();

     

       
707
       
780
       
 
       


     

       
708
       
781
       
 
       
        // Mock 401 response with delay

     

       
709
       
709
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
710
       
710
       
-
       
          '/oauth/refresh',

     

       
711
       
711
       
-
       
          data: anyNamed('data'),

     

       
712
       
712
       
-
       
        )).thenAnswer((_) async {

     

       
782
       
782
       
+
       
        when(

     

       
783
       
783
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
784
       
784
       
+
       
            '/oauth/refresh',

     

       
785
       
785
       
+
       
            data: anyNamed('data'),

     

       
786
       
786
       
+
       
          ),

     

       
787
       
787
       
+
       
        ).thenAnswer((_) async {

     

       
713
       
788
       
 
       
          await Future.delayed(const Duration(milliseconds: 100));

     

       
714
       
789
       
 
       
          throw DioException(

     

       
715
       
790
       
 
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     
···

       
744
       
819
       
 
       
        expect(errorCount, 3);

     

       
745
       
820
       
 
       


     

       
746
       
821
       
 
       
        // Verify only one API call was made

     

       
747
       
747
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
748
       
748
       
-
       
          '/oauth/refresh',

     

       
749
       
749
       
-
       
          data: anyNamed('data'),

     

       
750
       
750
       
-
       
        )).called(1);

     

       
822
       
822
       
+
       
        verify(

     

       
823
       
823
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
824
       
824
       
+
       
            '/oauth/refresh',

     

       
825
       
825
       
+
       
            data: anyNamed('data'),

     

       
826
       
826
       
+
       
          ),

     

       
827
       
827
       
+
       
        ).called(1);

     

       
751
       
828
       
 
       
      });

     

       
752
       
829
       
 
       


     

       
753
       
830
       
 
       
      test('should allow new refresh after previous one completes', () async {

     
···

       
757
       
834
       
 
       
          did: 'did:plc:test123',

     

       
758
       
835
       
 
       
          sessionId: 'session-123',

     

       
759
       
836
       
 
       
        );

     

       
760
       
760
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
761
       
761
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
837
       
837
       
+
       
        when(

     

       
838
       
838
       
+
       
          mockStorage.read(key: storageKey),

     

       
839
       
839
       
+
       
        ).thenAnswer((_) async => initialSession.toJsonString());

     

       
762
       
840
       
 
       
        await authService.restoreSession();

     

       
763
       
841
       
 
       


     

       
764
       
842
       
 
       
        const newToken1 = 'new-token-1';

     

       
765
       
843
       
 
       
        const newToken2 = 'new-token-2';

     

       
766
       
844
       
 
       


     

       
767
       
845
       
 
       
        // Mock first refresh

     

       
768
       
768
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
769
       
769
       
-
       
          '/oauth/refresh',

     

       
770
       
770
       
-
       
          data: anyNamed('data'),

     

       
771
       
771
       
-
       
        )).thenAnswer((_) async => Response(

     

       
772
       
772
       
-
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
773
       
773
       
-
       
              statusCode: 200,

     

       
774
       
774
       
-
       
              data: {'sealed_token': newToken1, 'access_token': 'some-access-token'},

     

       
775
       
775
       
-
       
            ));

     

       
846
       
846
       
+
       
        when(

     

       
847
       
847
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
848
       
848
       
+
       
            '/oauth/refresh',

     

       
849
       
849
       
+
       
            data: anyNamed('data'),

     

       
850
       
850
       
+
       
          ),

     

       
851
       
851
       
+
       
        ).thenAnswer(

     

       
852
       
852
       
+
       
          (_) async => Response(

     

       
853
       
853
       
+
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
854
       
854
       
+
       
            statusCode: 200,

     

       
855
       
855
       
+
       
            data: {

     

       
856
       
856
       
+
       
              'sealed_token': newToken1,

     

       
857
       
857
       
+
       
              'access_token': 'some-access-token',

     

       
858
       
858
       
+
       
            },

     

       
859
       
859
       
+
       
          ),

     

       
860
       
860
       
+
       
        );

     

       
776
       
861
       
 
       


     

       
777
       
777
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
778
       
778
       
-
       
            .thenAnswer((_) async => {});

     

       
862
       
862
       
+
       
        when(

     

       
863
       
863
       
+
       
          mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
864
       
864
       
+
       
        ).thenAnswer((_) async => {});

     

       
779
       
865
       
 
       


     

       
780
       
866
       
 
       
        // Act - First refresh

     

       
781
       
867
       
 
       
        final result1 = await authService.refreshToken();

     
···

       
784
       
870
       
 
       
        expect(result1.token, newToken1);

     

       
785
       
871
       
 
       


     

       
786
       
872
       
 
       
        // Now update the mock for the second refresh

     

       
787
       
787
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
788
       
788
       
-
       
          '/oauth/refresh',

     

       
789
       
789
       
-
       
          data: anyNamed('data'),

     

       
790
       
790
       
-
       
        )).thenAnswer((_) async => Response(

     

       
791
       
791
       
-
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
792
       
792
       
-
       
              statusCode: 200,

     

       
793
       
793
       
-
       
              data: {'sealed_token': newToken2, 'access_token': 'some-access-token'},

     

       
794
       
794
       
-
       
            ));

     

       
873
       
873
       
+
       
        when(

     

       
874
       
874
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
875
       
875
       
+
       
            '/oauth/refresh',

     

       
876
       
876
       
+
       
            data: anyNamed('data'),

     

       
877
       
877
       
+
       
          ),

     

       
878
       
878
       
+
       
        ).thenAnswer(

     

       
879
       
879
       
+
       
          (_) async => Response(

     

       
880
       
880
       
+
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
881
       
881
       
+
       
            statusCode: 200,

     

       
882
       
882
       
+
       
            data: {

     

       
883
       
883
       
+
       
              'sealed_token': newToken2,

     

       
884
       
884
       
+
       
              'access_token': 'some-access-token',

     

       
885
       
885
       
+
       
            },

     

       
886
       
886
       
+
       
          ),

     

       
887
       
887
       
+
       
        );

     

       
795
       
888
       
 
       


     

       
796
       
889
       
 
       
        // Act - Second refresh (should be allowed since first completed)

     

       
797
       
890
       
 
       
        final result2 = await authService.refreshToken();

     
···

       
800
       
893
       
 
       
        expect(result2.token, newToken2);

     

       
801
       
894
       
 
       


     

       
802
       
895
       
 
       
        // Verify two separate API calls were made

     

       
803
       
803
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
804
       
804
       
-
       
          '/oauth/refresh',

     

       
805
       
805
       
-
       
          data: anyNamed('data'),

     

       
806
       
806
       
-
       
        )).called(2);

     

       
896
       
896
       
+
       
        verify(

     

       
897
       
897
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
898
       
898
       
+
       
            '/oauth/refresh',

     

       
899
       
899
       
+
       
            data: anyNamed('data'),

     

       
900
       
900
       
+
       
          ),

     

       
901
       
901
       
+
       
        ).called(2);

     

       
807
       
902
       
 
       
      });

     

       
808
       
903
       
 
       


     

       
809
       
904
       
 
       
      test('should allow new refresh after previous one fails', () async {

     
···

       
813
       
908
       
 
       
          did: 'did:plc:test123',

     

       
814
       
909
       
 
       
          sessionId: 'session-123',

     

       
815
       
910
       
 
       
        );

     

       
816
       
816
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
817
       
817
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
911
       
911
       
+
       
        when(

     

       
912
       
912
       
+
       
          mockStorage.read(key: storageKey),

     

       
913
       
913
       
+
       
        ).thenAnswer((_) async => initialSession.toJsonString());

     

       
818
       
914
       
 
       
        await authService.restoreSession();

     

       
819
       
915
       
 
       


     

       
820
       
916
       
 
       
        // Mock first refresh to fail

     

       
821
       
821
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
822
       
822
       
-
       
          '/oauth/refresh',

     

       
823
       
823
       
-
       
          data: anyNamed('data'),

     

       
824
       
824
       
-
       
        )).thenThrow(

     

       
917
       
917
       
+
       
        when(

     

       
918
       
918
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
919
       
919
       
+
       
            '/oauth/refresh',

     

       
920
       
920
       
+
       
            data: anyNamed('data'),

     

       
921
       
921
       
+
       
          ),

     

       
922
       
922
       
+
       
        ).thenThrow(

     

       
825
       
923
       
 
       
          DioException(

     

       
826
       
924
       
 
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
827
       
925
       
 
       
            type: DioExceptionType.connectionError,

     
···

       
845
       
943
       
 
       


     

       
846
       
944
       
 
       
        // Now mock a successful second refresh

     

       
847
       
945
       
 
       
        const newToken = 'new-token-after-retry';

     

       
848
       
848
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
849
       
849
       
-
       
          '/oauth/refresh',

     

       
850
       
850
       
-
       
          data: anyNamed('data'),

     

       
851
       
851
       
-
       
        )).thenAnswer((_) async => Response(

     

       
852
       
852
       
-
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
853
       
853
       
-
       
              statusCode: 200,

     

       
854
       
854
       
-
       
              data: {'sealed_token': newToken, 'access_token': 'some-access-token'},

     

       
855
       
855
       
-
       
            ));

     

       
946
       
946
       
+
       
        when(

     

       
947
       
947
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
948
       
948
       
+
       
            '/oauth/refresh',

     

       
949
       
949
       
+
       
            data: anyNamed('data'),

     

       
950
       
950
       
+
       
          ),

     

       
951
       
951
       
+
       
        ).thenAnswer(

     

       
952
       
952
       
+
       
          (_) async => Response(

     

       
953
       
953
       
+
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
954
       
954
       
+
       
            statusCode: 200,

     

       
955
       
955
       
+
       
            data: {

     

       
956
       
956
       
+
       
              'sealed_token': newToken,

     

       
957
       
957
       
+
       
              'access_token': 'some-access-token',

     

       
958
       
958
       
+
       
            },

     

       
959
       
959
       
+
       
          ),

     

       
960
       
960
       
+
       
        );

     

       
856
       
961
       
 
       


     

       
857
       
857
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
858
       
858
       
-
       
            .thenAnswer((_) async => {});

     

       
962
       
962
       
+
       
        when(

     

       
963
       
963
       
+
       
          mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
964
       
964
       
+
       
        ).thenAnswer((_) async => {});

     

       
859
       
965
       
 
       


     

       
860
       
966
       
 
       
        // Act - Second refresh (should be allowed and succeed)

     

       
861
       
967
       
 
       
        final result = await authService.refreshToken();

     
···

       
864
       
970
       
 
       
        expect(result.token, newToken);

     

       
865
       
971
       
 
       


     

       
866
       
972
       
 
       
        // Verify two separate API calls were made

     

       
867
       
867
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
868
       
868
       
-
       
          '/oauth/refresh',

     

       
869
       
869
       
-
       
          data: anyNamed('data'),

     

       
870
       
870
       
-
       
        )).called(2);

     

       
973
       
973
       
+
       
        verify(

     

       
974
       
974
       
+
       
          mockDio.post<Map<String, dynamic>>(

     

       
975
       
975
       
+
       
            '/oauth/refresh',

     

       
976
       
976
       
+
       
            data: anyNamed('data'),

     

       
977
       
977
       
+
       
          ),

     

       
978
       
978
       
+
       
        ).called(2);

     

       
871
       
979
       
 
       
      });

     

       
872
       
980
       
 
       


     

       
873
       
981
       
 
       
      test(

     

       
874
       
874
       
-
       
          'should handle concurrent calls where one arrives after refresh completes',

     

       
875
       
875
       
-
       
          () async {

     

       
876
       
876
       
-
       
        // Arrange - First restore a session

     

       
877
       
877
       
-
       
        const initialSession = CovesSession(

     

       
878
       
878
       
-
       
          token: 'old-token',

     

       
879
       
879
       
-
       
          did: 'did:plc:test123',

     

       
880
       
880
       
-
       
          sessionId: 'session-123',

     

       
881
       
881
       
-
       
        );

     

       
882
       
882
       
-
       
        when(mockStorage.read(key: storageKey))

     

       
883
       
883
       
-
       
            .thenAnswer((_) async => initialSession.toJsonString());

     

       
884
       
884
       
-
       
        await authService.restoreSession();

     

       
885
       
885
       
-
       


     

       
886
       
886
       
-
       
        const newToken1 = 'new-token-1';

     

       
887
       
887
       
-
       
        const newToken2 = 'new-token-2';

     

       
888
       
888
       
-
       


     

       
889
       
889
       
-
       
        var callCount = 0;

     

       
890
       
890
       
-
       


     

       
891
       
891
       
-
       
        // Mock refresh with different responses

     

       
892
       
892
       
-
       
        when(mockDio.post<Map<String, dynamic>>(

     

       
893
       
893
       
-
       
          '/oauth/refresh',

     

       
894
       
894
       
-
       
          data: anyNamed('data'),

     

       
895
       
895
       
-
       
        )).thenAnswer((_) async {

     

       
896
       
896
       
-
       
          callCount++;

     

       
897
       
897
       
-
       
          await Future.delayed(const Duration(milliseconds: 50));

     

       
898
       
898
       
-
       
          return Response(

     

       
899
       
899
       
-
       
            requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
900
       
900
       
-
       
            statusCode: 200,

     

       
901
       
901
       
-
       
            data: {'sealed_token': callCount == 1 ? newToken1 : newToken2, 'access_token': 'some-access-token'},

     

       
982
       
982
       
+
       
        'should handle concurrent calls where one arrives after refresh completes',

     

       
983
       
983
       
+
       
        () async {

     

       
984
       
984
       
+
       
          // Arrange - First restore a session

     

       
985
       
985
       
+
       
          const initialSession = CovesSession(

     

       
986
       
986
       
+
       
            token: 'old-token',

     

       
987
       
987
       
+
       
            did: 'did:plc:test123',

     

       
988
       
988
       
+
       
            sessionId: 'session-123',

     

       
902
       
989
       
 
       
          );

     

       
903
       
903
       
-
       
        });

     

       
904
       
904
       
-
       


     

       
905
       
905
       
-
       
        when(mockStorage.write(key: storageKey, value: anyNamed('value')))

     

       
906
       
906
       
-
       
            .thenAnswer((_) async => {});

     

       
907
       
907
       
-
       


     

       
908
       
908
       
-
       
        // Act - Start first refresh

     

       
909
       
909
       
-
       
        final future1 = authService.refreshToken();

     

       
990
       
990
       
+
       
          when(

     

       
991
       
991
       
+
       
            mockStorage.read(key: storageKey),

     

       
992
       
992
       
+
       
          ).thenAnswer((_) async => initialSession.toJsonString());

     

       
993
       
993
       
+
       
          await authService.restoreSession();

     

       
910
       
994
       
 
       


     

       
911
       
911
       
-
       
        // Wait for it to complete

     

       
912
       
912
       
-
       
        final result1 = await future1;

     

       
995
       
995
       
+
       
          const newToken1 = 'new-token-1';

     

       
996
       
996
       
+
       
          const newToken2 = 'new-token-2';

     

       
913
       
997
       
 
       


     

       
914
       
914
       
-
       
        // Start second refresh after first completes

     

       
915
       
915
       
-
       
        final result2 = await authService.refreshToken();

     

       
998
       
998
       
+
       
          var callCount = 0;

     

       
916
       
999
       
 
       


     

       
917
       
917
       
-
       
        // Assert

     

       
918
       
918
       
-
       
        expect(result1.token, newToken1);

     

       
919
       
919
       
-
       
        expect(result2.token, newToken2);

     

       
920
       
920
       
-
       


     

       
921
       
921
       
-
       
        // Verify two separate API calls were made

     

       
922
       
922
       
-
       
        verify(mockDio.post<Map<String, dynamic>>(

     

       
923
       
923
       
-
       
          '/oauth/refresh',

     

       
924
       
924
       
-
       
          data: anyNamed('data'),

     

       
925
       
925
       
-
       
        )).called(2);

     

       
926
       
926
       
-
       
      });

     

       
1000
       
1000
       
+
       
          // Mock refresh with different responses

     

       
1001
       
1001
       
+
       
          when(

     

       
1002
       
1002
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
1003
       
1003
       
+
       
              '/oauth/refresh',

     

       
1004
       
1004
       
+
       
              data: anyNamed('data'),

     

       
1005
       
1005
       
+
       
            ),

     

       
1006
       
1006
       
+
       
          ).thenAnswer((_) async {

     

       
1007
       
1007
       
+
       
            callCount++;

     

       
1008
       
1008
       
+
       
            await Future.delayed(const Duration(milliseconds: 50));

     

       
1009
       
1009
       
+
       
            return Response(

     

       
1010
       
1010
       
+
       
              requestOptions: RequestOptions(path: '/oauth/refresh'),

     

       
1011
       
1011
       
+
       
              statusCode: 200,

     

       
1012
       
1012
       
+
       
              data: {

     

       
1013
       
1013
       
+
       
                'sealed_token': callCount == 1 ? newToken1 : newToken2,

     

       
1014
       
1014
       
+
       
                'access_token': 'some-access-token',

     

       
1015
       
1015
       
+
       
              },

     

       
1016
       
1016
       
+
       
            );

     

       
1017
       
1017
       
+
       
          });

     

       
1018
       
1018
       
+
       


     

       
1019
       
1019
       
+
       
          when(

     

       
1020
       
1020
       
+
       
            mockStorage.write(key: storageKey, value: anyNamed('value')),

     

       
1021
       
1021
       
+
       
          ).thenAnswer((_) async => {});

     

       
1022
       
1022
       
+
       


     

       
1023
       
1023
       
+
       
          // Act - Start first refresh

     

       
1024
       
1024
       
+
       
          final future1 = authService.refreshToken();

     

       
1025
       
1025
       
+
       


     

       
1026
       
1026
       
+
       
          // Wait for it to complete

     

       
1027
       
1027
       
+
       
          final result1 = await future1;

     

       
1028
       
1028
       
+
       


     

       
1029
       
1029
       
+
       
          // Start second refresh after first completes

     

       
1030
       
1030
       
+
       
          final result2 = await authService.refreshToken();

     

       
1031
       
1031
       
+
       


     

       
1032
       
1032
       
+
       
          // Assert

     

       
1033
       
1033
       
+
       
          expect(result1.token, newToken1);

     

       
1034
       
1034
       
+
       
          expect(result2.token, newToken2);

     

       
1035
       
1035
       
+
       


     

       
1036
       
1036
       
+
       
          // Verify two separate API calls were made

     

       
1037
       
1037
       
+
       
          verify(

     

       
1038
       
1038
       
+
       
            mockDio.post<Map<String, dynamic>>(

     

       
1039
       
1039
       
+
       
              '/oauth/refresh',

     

       
1040
       
1040
       
+
       
              data: anyNamed('data'),

     

       
1041
       
1041
       
+
       
            ),

     

       
1042
       
1042
       
+
       
          ).called(2);

     

       
1043
       
1043
       
+
       
        },

     

       
1044
       
1044
       
+
       
      );

     

       
927
       
1045
       
 
       
    });

     

       
928
       
1046
       
 
       
  });

     

       
929
       
1047
       
 
       
}