test(auth): simplify credential regression coverage

Author: betegon

packages/cli/test/e2e/auth.test.ts

@@ -146,11 +146,8 @@ describe("sentry auth whoami", () => {
     expect(result.exitCode).toBe(EXIT.AUTH_NOT_AUTHENTICATED);
   });
 
-  test.each([
-    TEST_TOKEN,
-    ` \n${TEST_TOKEN}\r\t`,
-  ])("shows current user identity with surrounding token whitespace %#", async (token) => {
-    await ctx.setAuthToken(token);
+  test("shows current user identity", async () => {
+    await ctx.setAuthToken(TEST_TOKEN);
 
     const result = await ctx.run(["auth", "whoami"]);
 

packages/cli/test/lib/db/auth.property.test.ts

@@ -3,7 +3,7 @@
  *
  * Verifies invariants that must hold for any valid token values:
  * - SENTRY_AUTH_TOKEN always takes priority over SENTRY_TOKEN
- * - Env vars always take priority over stored tokens
+ * - Stored OAuth takes priority unless SENTRY_FORCE_ENV_TOKEN is set
  * - Env tokens never trigger refresh
  * - AuthConfig.source correctly identifies the origin
  */
@@ -16,7 +16,7 @@ import {
   string,
   stringMatching,
 } from "fast-check";
-import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { describe, expect, test } from "vitest";
 import {
   type AuthSource,
   getAuthConfig,
@@ -27,10 +27,11 @@ import {
   resetAuthTokenCache,
   setAuthToken,
 } from "../../../src/lib/db/auth.js";
-import { useTestConfigDir } from "../../helpers.js";
+import { useEnvSandbox, useTestConfigDir } from "../../helpers.js";
 import { DEFAULT_NUM_RUNS } from "../../model-based/helpers.js";
 
 useTestConfigDir("auth-prop-");
+useEnvSandbox(["SENTRY_AUTH_TOKEN", "SENTRY_TOKEN", "SENTRY_FORCE_ENV_TOKEN"]);
 
 /** Arbitrary for non-empty, trimmed token strings */
 const tokenArb = string({ minLength: 1, maxLength: 100 }).filter(
@@ -40,32 +41,6 @@ const tokenArb = string({ minLength: 1, maxLength: 100 }).filter(
 /** Stored tokens must satisfy the persistence boundary; malformed inputs have separate coverage. */
 const storedTokenArb = stringMatching(/^[\x21-\x7e]{1,100}$/);
 
-/** Save and restore env vars around each test */
-let savedAuthToken: string | undefined;
-let savedSentryToken: string | undefined;
-
-beforeEach(() => {
-  savedAuthToken = process.env.SENTRY_AUTH_TOKEN;
-  savedSentryToken = process.env.SENTRY_TOKEN;
-  delete process.env.SENTRY_AUTH_TOKEN;
-  delete process.env.SENTRY_TOKEN;
-  resetAuthTokenCache();
-  resetAuthRowCache();
-});
-
-afterEach(() => {
-  if (savedAuthToken !== undefined) {
-    process.env.SENTRY_AUTH_TOKEN = savedAuthToken;
-  } else {
-    delete process.env.SENTRY_AUTH_TOKEN;
-  }
-  if (savedSentryToken !== undefined) {
-    process.env.SENTRY_TOKEN = savedSentryToken;
-  } else {
-    delete process.env.SENTRY_TOKEN;
-  }
-});
-
 /** Invalidate between property iterations — env-var mutations bypass setAuthToken. */
 function resetAuthCaches() {
   resetAuthTokenCache();
@@ -99,6 +74,7 @@ describe("property: env var priority", () => {
         // Stored OAuth takes priority — env token is for build tooling
         expect(getAuthToken()).toBe(storedToken);
         expect(getAuthConfig()?.source).toBe("oauth" satisfies AuthSource);
+        expect(isEnvTokenActive()).toBe(true);
       }),
       { numRuns: DEFAULT_NUM_RUNS }
     );
@@ -196,22 +172,6 @@ describe("property: isEnvTokenActive consistency", () => {
       { numRuns: DEFAULT_NUM_RUNS }
     );
   });
-
-  test("stored OAuth takes priority: getAuthConfig returns oauth even when env token is set", () => {
-    fcAssert(
-      property(tokenArb, storedTokenArb, (envToken, storedToken) => {
-        resetAuthCaches();
-        process.env.SENTRY_AUTH_TOKEN = envToken;
-        setAuthToken(storedToken);
-
-        const config = getAuthConfig();
-        expect(config?.source).toBe("oauth");
-        // But isEnvTokenActive is still true (env token exists)
-        expect(isEnvTokenActive()).toBe(true);
-      }),
-      { numRuns: DEFAULT_NUM_RUNS }
-    );
-  });
 });
 
 describe("property: source round-trip", () => {

packages/cli/test/lib/db/auth.test.ts

@@ -7,7 +7,7 @@
  * by property tests (isAuthenticated, getActiveEnvVarName).
  */
 
-import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { describe, expect, test } from "vitest";
 import {
   ANON_IDENTITY,
   clearAuth,
@@ -20,43 +20,17 @@ import {
   isAuthenticated,
   isEnvTokenActive,
   refreshToken,
-  resetAuthRowCache,
   resetAuthTokenCache,
   resetHasStoredCredsCache,
   resetIdentityFingerprintCache,
   setAuthToken,
 } from "../../../src/lib/db/auth.js";
 import { getDatabase } from "../../../src/lib/db/index.js";
 import { MalformedAuthTokenError } from "../../../src/lib/errors.js";
-import { useTestConfigDir } from "../../helpers.js";
+import { useEnvSandbox, useTestConfigDir } from "../../helpers.js";
 
 useTestConfigDir("auth-env-");
-
-let savedAuthToken: string | undefined;
-let savedSentryToken: string | undefined;
-
-beforeEach(() => {
-  savedAuthToken = process.env.SENTRY_AUTH_TOKEN;
-  savedSentryToken = process.env.SENTRY_TOKEN;
-  delete process.env.SENTRY_AUTH_TOKEN;
-  delete process.env.SENTRY_TOKEN;
-  resetIdentityFingerprintCache();
-  resetAuthTokenCache();
-  resetAuthRowCache();
-});
-
-afterEach(() => {
-  if (savedAuthToken !== undefined) {
-    process.env.SENTRY_AUTH_TOKEN = savedAuthToken;
-  } else {
-    delete process.env.SENTRY_AUTH_TOKEN;
-  }
-  if (savedSentryToken !== undefined) {
-    process.env.SENTRY_TOKEN = savedSentryToken;
-  } else {
-    delete process.env.SENTRY_TOKEN;
-  }
-});
+useEnvSandbox(["SENTRY_AUTH_TOKEN", "SENTRY_TOKEN", "SENTRY_FORCE_ENV_TOKEN"]);
 
 describe("env var auth: getAuthToken edge cases", () => {
   test("ignores empty SENTRY_AUTH_TOKEN", () => {
@@ -106,16 +80,6 @@ describe("env var auth: isEnvTokenActive edge case", () => {
 });
 
 describe("env var auth: getActiveEnvVarName", () => {
-  test("returns SENTRY_AUTH_TOKEN when that var is set", () => {
-    process.env.SENTRY_AUTH_TOKEN = "test_token";
-    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
-  });
-
-  test("returns SENTRY_TOKEN when only that var is set", () => {
-    process.env.SENTRY_TOKEN = "test_token";
-    expect(getActiveEnvVarName()).toBe("SENTRY_TOKEN");
-  });
-
   test("prefers SENTRY_AUTH_TOKEN when both are set", () => {
     process.env.SENTRY_AUTH_TOKEN = "primary";
     process.env.SENTRY_TOKEN = "secondary";
@@ -197,11 +161,6 @@ describe("env var auth: getRawEnvToken", () => {
     expect(getActiveEnvVarName()).toBe("SENTRY_TOKEN");
   });
 
-  test("returns SENTRY_TOKEN when SENTRY_AUTH_TOKEN is unset", () => {
-    process.env.SENTRY_TOKEN = "fallback_token";
-    expect(getRawEnvToken()).toBe("fallback_token");
-  });
-
   test("returns undefined when no env var is set", () => {
     expect(getRawEnvToken()).toBeUndefined();
   });

packages/cli/test/lib/sentry-client.auth.test.ts

@@ -58,18 +58,24 @@ describe("authenticated fetch bearer validation", () => {
   let originalFetch: typeof globalThis.fetch;
   let requests: { url: string; authorization: string | null }[];
 
+  /** Mock responses while recording the actual request URL and Authorization. */
+  function mockResponses(
+    respond: (url: string, authorization: string | null) => Response
+  ): typeof fetch {
+    return mockFetch((input, init) => {
+      const url = extractFetchUrl(input);
+      const authorization = new Headers(init?.headers).get("Authorization");
+      requests.push({ url, authorization });
+      return Promise.resolve(respond(url, authorization));
+    });
+  }
+
   beforeEach(async () => {
     await resetHostScopingState();
     resetAuthenticatedFetch();
     originalFetch = globalThis.fetch;
     requests = [];
-    globalThis.fetch = mockFetch((input, init) => {
-      requests.push({
-        url: extractFetchUrl(input),
-        authorization: new Headers(init?.headers).get("Authorization"),
-      });
-      return Promise.resolve(new Response("{}", { status: 200 }));
-    });
+    globalThis.fetch = mockResponses(() => new Response("{}", { status: 200 }));
   });
 
   afterEach(async () => {
@@ -220,23 +226,17 @@ describe("authenticated fetch bearer validation", () => {
 
   test("stores Vary: Authorization with the credential actually sent", async () => {
     storeLegacyToken("\x1fsynthetic-token\x7f");
-    globalThis.fetch = mockFetch((input, init) => {
-      requests.push({
-        url: extractFetchUrl(input),
-        authorization: new Headers(init?.headers).get("Authorization"),
-      });
-      return Promise.resolve(
-        Response.json(
-          { source: "network" },
-          {
-            headers: {
-              "Cache-Control": "private, max-age=300",
-              Vary: "Authorization",
-            },
-          }
-        )
-      );
-    });
+    globalThis.fetch = mockResponses(() =>
+      Response.json(
+        { source: "network" },
+        {
+          headers: {
+            "Cache-Control": "private, max-age=300",
+            Vary: "Authorization",
+          },
+        }
+      )
+    );
 
     await request();
 
@@ -260,7 +260,7 @@ describe("authenticated fetch bearer validation", () => {
       url: "https://other-sentry.example.com",
       org: "synthetic-org",
     });
-    setAuthToken(` \n${token}\t `);
+    storeLegacyToken(` \n${token}\t `);
     await expect(request()).rejects.toBeInstanceOf(HostScopeError);
     expect(requests).toEqual([]);
   });
@@ -319,24 +319,17 @@ describe("authenticated fetch bearer validation", () => {
   ])("retries with a normalized valid refreshed bearer %#", async (token) => {
     process.env.SENTRY_CLIENT_ID = "synthetic-client-id";
     setAuthToken("stored-token", 3600, "synthetic-refresh-token");
-    globalThis.fetch = mockFetch((input, init) => {
-      const url = extractFetchUrl(input);
-      const authorization = new Headers(init?.headers).get("Authorization");
-      requests.push({ url, authorization });
+    globalThis.fetch = mockResponses((url, authorization) => {
       if (url.endsWith("/oauth/token/")) {
-        return Promise.resolve(
-          Response.json({
-            access_token: token,
-            token_type: "bearer",
-            expires_in: 3600,
-          })
-        );
+        return Response.json({
+          access_token: token,
+          token_type: "bearer",
+          expires_in: 3600,
+        });
       }
-      return Promise.resolve(
-        new Response("{}", {
-          status: authorization === "Bearer stored-token" ? 401 : 200,
-        })
-      );
+      return new Response("{}", {
+        status: authorization === "Bearer stored-token" ? 401 : 200,
+      });
     });
 
     expect((await request()).status).toBe(200);
@@ -357,23 +350,16 @@ describe("authenticated fetch bearer validation", () => {
   ])("rejects malformed refreshed credentials without retrying the request %#", async (token) => {
     process.env.SENTRY_CLIENT_ID = "synthetic-client-id";
     setAuthToken("stored-token", 3600, "synthetic-refresh-token");
-    globalThis.fetch = mockFetch((input, init) => {
-      const url = extractFetchUrl(input);
-      requests.push({
-        url,
-        authorization: new Headers(init?.headers).get("Authorization"),
-      });
+    globalThis.fetch = mockResponses((url) => {
       if (url.endsWith("/oauth/token/")) {
-        return Promise.resolve(
-          Response.json({
-            access_token: token,
-            token_type: "bearer",
-            expires_in: 3600,
-            refresh_token: "synthetic-refresh-token",
-          })
-        );
+        return Response.json({
+          access_token: token,
+          token_type: "bearer",
+          expires_in: 3600,
+          refresh_token: "synthetic-refresh-token",
+        });
       }
-      return Promise.resolve(new Response("{}", { status: 401 }));
+      return new Response("{}", { status: 401 });
     });
 
     for (let attempt = 0; attempt < 2; attempt++) {
@@ -408,23 +394,16 @@ describe("authenticated fetch bearer validation", () => {
       process.env[source] = MALFORMED_TOKEN;
     }
     setAuthToken("expired-token", -1, "synthetic-refresh-token");
-    globalThis.fetch = mockFetch((input, init) => {
-      const url = extractFetchUrl(input);
-      requests.push({
-        url,
-        authorization: new Headers(init?.headers).get("Authorization"),
-      });
-      return Promise.resolve(
-        url.endsWith("/oauth/token/")
-          ? Response.json({
-              access_token: "\x1f \nrefreshed-token\r\t\x7f",
-              token_type: "bearer",
-              expires_in: 3600,
-              refresh_token: "replacement-refresh-token",
-            })
-          : Response.json({})
-      );
-    });
+    globalThis.fetch = mockResponses((url) =>
+      url.endsWith("/oauth/token/")
+        ? Response.json({
+            access_token: "\x1f \nrefreshed-token\r\t\x7f",
+            token_type: "bearer",
+            expires_in: 3600,
+            refresh_token: "replacement-refresh-token",
+          })
+        : Response.json({})
+    );
 
     expect((await request()).status).toBe(200);
     expect(getAuthConfig()).toMatchObject({
@@ -440,20 +419,14 @@ describe("authenticated fetch bearer validation", () => {
   test("rejects malformed proactive refresh before storing or using the token", async () => {
     process.env.SENTRY_CLIENT_ID = "synthetic-client-id";
     setAuthToken("expired-token", -1, "synthetic-refresh-token");
-    globalThis.fetch = mockFetch((input, init) => {
-      requests.push({
-        url: extractFetchUrl(input),
-        authorization: new Headers(init?.headers).get("Authorization"),
-      });
-      return Promise.resolve(
-        Response.json({
-          access_token: "opaque-\0-secret-tail",
-          token_type: "bearer",
-          expires_in: 3600,
-          refresh_token: "replacement-refresh-token",
-        })
-      );
-    });
+    globalThis.fetch = mockResponses(() =>
+      Response.json({
+        access_token: "opaque-\0-secret-tail",
+        token_type: "bearer",
+        expires_in: 3600,
+        refresh_token: "replacement-refresh-token",
+      })
+    );
 
     await expect(request()).rejects.toMatchObject({
       reason: "invalid",