feat(zarinhub): automate access token refresh

backend/internal/zarinhub/token_manager_test.go

@@ -0,0 +1,222 @@
+package zarinhub
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestTokenManagerAuthenticatesAndCachesToken(t *testing.T) {
+	var calls int
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+
+		var request tokenRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+		if request.Username != "test-username" || request.Password != "test-password" {
+			t.Errorf("credentials = %q/%q", request.Username, request.Password)
+		}
+		if request.RefreshToken != "" {
+			t.Errorf("refresh token = %q, want empty", request.RefreshToken)
+		}
+
+		writeTokenResponse(t, w, "access-1", "refresh-1", 28800)
+	}))
+	defer server.Close()
+
+	manager := NewTokenManager(
+		server.Client(),
+		server.URL,
+		"test-username",
+		"test-password",
+	)
+
+	for range 2 {
+		token, err := manager.AccessToken(context.Background())
+		if err != nil {
+			t.Fatalf("AccessToken() error = %v", err)
+		}
+		if token != "access-1" {
+			t.Errorf("token = %q, want access-1", token)
+		}
+	}
+
+	if calls != 1 {
+		t.Errorf("authentication calls = %d, want 1", calls)
+	}
+}
+
+func TestTokenManagerRefreshesExpiringToken(t *testing.T) {
+	var calls int
+	currentTime := time.Date(2026, 9, 21, 12, 0, 0, 0, time.UTC)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+
+		var request tokenRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+
+		if calls == 1 {
+			writeTokenResponse(t, w, "access-1", "refresh-1", 120)
+			return
+		}
+
+		if request.RefreshToken != "refresh-1" {
+			t.Errorf("refresh token = %q, want refresh-1", request.RefreshToken)
+		}
+		if request.Username != "" || request.Password != "" {
+			t.Error("refresh request included credentials")
+		}
+		writeTokenResponse(t, w, "access-2", "refresh-2", 28800)
+	}))
+	defer server.Close()
+
+	manager := NewTokenManager(server.Client(), server.URL, "test-username", "test-password")
+	manager.now = func() time.Time { return currentTime }
+
+	if _, err := manager.AccessToken(context.Background()); err != nil {
+		t.Fatalf("initial AccessToken() error = %v", err)
+	}
+
+	currentTime = currentTime.Add(61 * time.Second)
+	token, err := manager.AccessToken(context.Background())
+	if err != nil {
+		t.Fatalf("refreshed AccessToken() error = %v", err)
+	}
+	if token != "access-2" {
+		t.Errorf("token = %q, want access-2", token)
+	}
+}
+
+func TestTokenManagerFallsBackToCredentialsWhenRefreshIsRejected(t *testing.T) {
+	var calls int
+	currentTime := time.Date(2026, 9, 21, 12, 0, 0, 0, time.UTC)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+
+		var request tokenRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+
+		switch calls {
+		case 1:
+			writeTokenResponse(t, w, "access-1", "refresh-1", 61)
+		case 2:
+			if request.RefreshToken != "refresh-1" {
+				t.Errorf("refresh token = %q, want refresh-1", request.RefreshToken)
+			}
+			w.WriteHeader(http.StatusUnauthorized)
+		case 3:
+			if request.Username != "test-username" || request.Password != "test-password" {
+				t.Error("credential fallback did not include API credentials")
+			}
+			writeTokenResponse(t, w, "access-2", "refresh-2", 28800)
+		default:
+			t.Errorf("unexpected authentication call %d", calls)
+		}
+	}))
+	defer server.Close()
+
+	manager := NewTokenManager(server.Client(), server.URL, "test-username", "test-password")
+	manager.now = func() time.Time { return currentTime }
+
+	if _, err := manager.AccessToken(context.Background()); err != nil {
+		t.Fatalf("initial AccessToken() error = %v", err)
+	}
+
+	currentTime = currentTime.Add(2 * time.Second)
+	token, err := manager.AccessToken(context.Background())
+	if err != nil {
+		t.Fatalf("fallback AccessToken() error = %v", err)
+	}
+	if token != "access-2" {
+		t.Errorf("token = %q, want access-2", token)
+	}
+	if calls != 3 {
+		t.Errorf("authentication calls = %d, want 3", calls)
+	}
+}
+
+func TestTokenManagerSharesConcurrentAuthentication(t *testing.T) {
+	var (
+		mu    sync.Mutex
+		calls int
+	)
+	release := make(chan struct{})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		calls++
+		mu.Unlock()
+		<-release
+		writeTokenResponse(t, w, "shared-access", "shared-refresh", 28800)
+	}))
+	defer server.Close()
+
+	manager := NewTokenManager(server.Client(), server.URL, "test-username", "test-password")
+	results := make(chan string, 5)
+	errors := make(chan error, 5)
+
+	for range 5 {
+		go func() {
+			token, err := manager.AccessToken(context.Background())
+			results <- token
+			errors <- err
+		}()
+	}
+
+	time.Sleep(20 * time.Millisecond)
+	close(release)
+
+	for range 5 {
+		if err := <-errors; err != nil {
+			t.Errorf("AccessToken() error = %v", err)
+		}
+		if token := <-results; token != "shared-access" {
+			t.Errorf("token = %q, want shared-access", token)
+		}
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	if calls != 1 {
+		t.Errorf("authentication calls = %d, want 1", calls)
+	}
+}
+
+func writeTokenResponse(
+	t *testing.T,
+	w http.ResponseWriter,
+	accessToken string,
+	refreshToken string,
+	expiresIn int,
+) {
+	t.Helper()
+	w.Header().Set("Content-Type", "application/json")
+
+	err := json.NewEncoder(w).Encode(map[string]any{
+		"data": map[string]any{
+			"accessToken":  accessToken,
+			"tokenType":    "Bearer",
+			"expiresTn":    expiresIn,
+			"refreshToken": refreshToken,
+		},
+		"meta": map[string]any{
+			"isSuccess": true,
+		},
+	})
+	if err != nil {
+		t.Fatalf("encode response: %v", err)
+	}
+}