Skip to content

test(repo): assert the token date and signature policy - #3123

Open
xsahil03x wants to merge 4 commits into
test/e2e-native-parityfrom
sahil/flu-1083-token-refresh-only-happens-on-error-40-not-on-the-invalid
Open

xsahil03x wants to merge 4 commits into
test/e2e-native-parityfrom
sahil/flu-1083-token-refresh-only-happens-on-error-40-not-on-the-invalid

Conversation

@xsahil03x

@xsahil03x xsahil03x commented Oct 27, 2026 •

Copy link
Copy Markdown
Member

What

The "token date / signature invalidates" e2e tests expected the app to fetch a new token. Three now assert what the SDK does on purpose:

Test Asserts
token date (42) before login login fails with code 42, no second token request
token date (42) after login reconnects with the same token once the date is valid (skipped until mock-server#95)
token signature (43) before login login fails with code 43, no second token request

"token signature invalidates after the user logs in" is removed: a signing secret doesn't go bad mid-session, and the test only timed the SDK's reconnect backoff (about a minute of CI). The env now has assertTokenRequests. UserRobot.assertLoginFailed checks the error the chooser shows.

Why

FLU-1083 asked for a refresh on 41–43. The SDK refreshes on 40 only, and so do iOS, JS and the v11 core (stream_core auth_interceptor.dart, stream_error_code.dart). The backend parses JWTs with no leeway, so 41/42 are clock skew: the same token passes once the server's clock catches up, and a new token from the same issuer would be just as early. 43 is a signing-secret mismatch that no refresh fixes.

The 42-after-login test needs mock-server#95. Until then the mock keeps answering 42 until a new token is fetched, which the real backend doesn't do.

Verification

dart analyze on e2e_app. The two un-skipped tests run in this PR's E2E workflow.

🤖 Generated with Claude Code

The SDK refreshes the token on code 40 only. A token used before its
issue date (42) is reconnected as-is until the server's clock catches
up, and a bad signature (43) is not retried with a new token. The four
tests now assert that instead of a refresh.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 994ebae7-4706-4bb3-b368-ffe3bee1fbb9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

xsahil03x and others added 3 commits October 27, 2026 02:46
Keep the invalid window open past the refresh so the refreshed token is
always rejected, count token requests through an env assertion, and fix
the step and file comments to match what the tests assert.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A signing secret doesn't go bad mid-session, and the test only timed the
SDK's reconnect backoff.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The chooser page is replaced while connecting, so an error it stored
itself was gone by the time the login failed. The auth state now carries
it, and the rebuilt page shows it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012vTgFwqhUc2wKCWrw635yC

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant