wehub-resource-sync
1500 lines
70 KiB
Swift
1500 lines
70 KiB
Swift
import CodexBarCore
|
|
import Foundation
|
|
import Testing
|
|
@testable import CodexBar
|
|
|
|
@MainActor
|
|
extension CodexAccountScopedRefreshTests {
|
|
@Test
|
|
func `same account token refresh fingerprint change keeps codex usage success`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-fingerprint-change")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
let staleReconciliationSnapshot = settings.codexAccountReconciliationSnapshot
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
settings.cachedCodexAccountReconciliationSnapshot = CachedCodexAccountReconciliationSnapshot(
|
|
activeSource: .liveSystem,
|
|
loadedAt: Date(),
|
|
snapshot: staleReconciliationSnapshot)
|
|
await blocker.resume(with: .success(self.codexSnapshot(email: "alpha@example.com", usedPercent: 25)))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex]?.primary?.usedPercent == 25)
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.authFingerprint == "new-token-material")
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change keeps reset backfill`() async {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-reset-backfill")
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let resetsAt = Date().addingTimeInterval(45 * 60)
|
|
let publicationGuard = store.freshCodexAccountScopedRefreshGuard()
|
|
store.lastCodexUsagePublicationGuard = publicationGuard
|
|
store.lastCodexAccountScopedRefreshGuard = publicationGuard
|
|
store.lastKnownResetSnapshots[.codex] = UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 10,
|
|
windowMinutes: 300,
|
|
resetsAt: resetsAt,
|
|
resetDescription: "resets soon"),
|
|
secondary: nil,
|
|
updatedAt: Date(),
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "alpha@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Pro"))
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
self.installImmediateCodexProvider(
|
|
on: store,
|
|
snapshot: self.codexSnapshot(email: "alpha@example.com", usedPercent: 25))
|
|
|
|
await store.refreshProvider(.codex, allowDisabled: true)
|
|
|
|
#expect(store.snapshots[.codex]?.primary?.usedPercent == 25)
|
|
#expect(store.snapshots[.codex]?.primary?.resetsAt == resetsAt)
|
|
#expect(store.lastKnownResetSnapshots[.codex]?.primary?.resetsAt == resetsAt)
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.authFingerprint == "new-token-material")
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change keeps scoped state during prepare`() {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-prepare")
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let resetsAt = Date().addingTimeInterval(45 * 60)
|
|
let cached = UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 10,
|
|
windowMinutes: 300,
|
|
resetsAt: resetsAt,
|
|
resetDescription: "resets soon"),
|
|
secondary: nil,
|
|
updatedAt: Date(),
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "alpha@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Pro"))
|
|
store.snapshots[.codex] = cached
|
|
store.lastKnownResetSnapshots[.codex] = cached
|
|
store.credits = self.credits(remaining: 42)
|
|
store.lastCodexAccountScopedRefreshGuard = store.freshCodexAccountScopedRefreshGuard()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
|
|
let invalidated = store.prepareCodexAccountScopedRefreshIfNeeded()
|
|
|
|
#expect(!invalidated)
|
|
#expect(store.snapshots[.codex]?.primary?.resetsAt == resetsAt)
|
|
#expect(store.lastKnownResetSnapshots[.codex]?.primary?.resetsAt == resetsAt)
|
|
#expect(store.credits?.remaining == 42)
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.authFingerprint == "new-token-material")
|
|
}
|
|
|
|
@Test
|
|
func `usage success applies when auth fingerprint appears after refresh starts`() {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-auth-fingerprint-appears")
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: nil,
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let expectedGuard = store.freshCodexAccountScopedRefreshGuard()
|
|
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
|
|
#expect(store.shouldApplyCodexUsageResult(
|
|
expectedGuard: expectedGuard,
|
|
usage: self.codexSnapshot(email: "alpha@example.com", usedPercent: 25)))
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change discards codex usage failure`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-fingerprint-failure")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
let staleReconciliationSnapshot = settings.codexAccountReconciliationSnapshot
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
settings.cachedCodexAccountReconciliationSnapshot = CachedCodexAccountReconciliationSnapshot(
|
|
activeSource: .liveSystem,
|
|
loadedAt: Date(),
|
|
snapshot: staleReconciliationSnapshot)
|
|
await blocker.resume(with: .failure(TestRefreshError(message: "old token failure")))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change keeps codex credits success`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-credits-success")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
store._test_codexCreditsLoaderOverride = {
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
return CreditsSnapshot(remaining: 42, events: [], updatedAt: Date())
|
|
}
|
|
defer { store._test_codexCreditsLoaderOverride = nil }
|
|
|
|
await store.refreshCreditsIfNeeded()
|
|
|
|
#expect(store.credits?.remaining == 42)
|
|
#expect(store.lastCreditsSnapshotAccountKey == "alpha@example.com")
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.authFingerprint == "new-token-material")
|
|
#expect(store.lastCreditsError == nil)
|
|
}
|
|
|
|
@Test
|
|
func `credits refresh key separates same account auth fingerprints`() {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-credits-key-auth-fingerprint")
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let oldGuard = CodexAccountScopedRefreshGuard(
|
|
source: .liveSystem,
|
|
identity: .providerAccount(id: "acct-alpha"),
|
|
accountKey: "alpha@example.com",
|
|
authFingerprint: "old-token-material")
|
|
let newGuard = CodexAccountScopedRefreshGuard(
|
|
source: .liveSystem,
|
|
identity: .providerAccount(id: "acct-alpha"),
|
|
accountKey: "alpha@example.com",
|
|
authFingerprint: "new-token-material")
|
|
|
|
#expect(store.codexCreditsRefreshKey(expectedGuard: oldGuard) !=
|
|
store.codexCreditsRefreshKey(expectedGuard: newGuard))
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change keeps dashboard success`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-dashboard-success")
|
|
let codexMetadata = try #require(ProviderDescriptorRegistry.metadata[.codex])
|
|
settings.setProviderEnabled(provider: .codex, metadata: codexMetadata, enabled: true)
|
|
settings.refreshFrequency = .manual
|
|
settings.openAIWebAccessEnabled = true
|
|
settings.codexCookieSource = .auto
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let expectedGuard = store.freshCodexOpenAIWebRefreshGuard()
|
|
store._test_openAIDashboardLoaderOverride = { _, _, _, _ in
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
return self.dashboard(email: "alpha@example.com", creditsRemaining: 64, usedPercent: 27)
|
|
}
|
|
defer { store._test_openAIDashboardLoaderOverride = nil }
|
|
|
|
await store.refreshOpenAIDashboardIfNeeded(force: true, expectedGuard: expectedGuard)
|
|
|
|
#expect(store.openAIDashboard?.creditsRemaining == 64)
|
|
#expect(store.openAIDashboard?.signedInEmail == "alpha@example.com")
|
|
#expect(store.lastOpenAIDashboardError == nil)
|
|
#expect(store.openAIDashboardRequiresLogin == false)
|
|
}
|
|
|
|
@Test
|
|
func `dashboard refresh key separates same account auth fingerprints`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-dashboard-key-auth-fingerprint")
|
|
let codexMetadata = try #require(ProviderDescriptorRegistry.metadata[.codex])
|
|
settings.setProviderEnabled(provider: .codex, metadata: codexMetadata, enabled: true)
|
|
settings.refreshFrequency = .manual
|
|
settings.openAIWebAccessEnabled = true
|
|
settings.codexCookieSource = .auto
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingManagedOpenAIDashboardLoader()
|
|
store._test_openAIDashboardLoaderOverride = { _, _, _, _ in
|
|
try await blocker.awaitResult()
|
|
}
|
|
defer { store._test_openAIDashboardLoaderOverride = nil }
|
|
|
|
let oldGuard = store.freshCodexOpenAIWebRefreshGuard()
|
|
let oldRefreshTask = Task {
|
|
await store.refreshOpenAIDashboardIfNeeded(force: true, expectedGuard: oldGuard)
|
|
}
|
|
await blocker.waitUntilStarted(count: 1)
|
|
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
let newGuard = store.freshCodexOpenAIWebRefreshGuard()
|
|
let newRefreshTask = Task {
|
|
await store.refreshOpenAIDashboardIfNeeded(force: true, expectedGuard: newGuard)
|
|
}
|
|
|
|
let didStartFreshRefresh = await blocker.waitUntilStartedWithin(count: 2)
|
|
#expect(didStartFreshRefresh)
|
|
guard didStartFreshRefresh else {
|
|
await blocker.resumeNext(with: .failure(TestRefreshError(message: "stale dashboard failure")))
|
|
await oldRefreshTask.value
|
|
await newRefreshTask.value
|
|
return
|
|
}
|
|
await blocker.resumeNext(with: .failure(TestRefreshError(message: "old dashboard failure")))
|
|
await blocker.resumeNext(with: .success(self.dashboard(
|
|
email: "alpha@example.com",
|
|
creditsRemaining: 64,
|
|
usedPercent: 27)))
|
|
await oldRefreshTask.value
|
|
await newRefreshTask.value
|
|
|
|
#expect(store.openAIDashboard?.creditsRemaining == 64)
|
|
#expect(store.lastOpenAIDashboardError == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change discards dashboard failure`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-dashboard-failure")
|
|
let codexMetadata = try #require(ProviderDescriptorRegistry.metadata[.codex])
|
|
settings.setProviderEnabled(provider: .codex, metadata: codexMetadata, enabled: true)
|
|
settings.refreshFrequency = .manual
|
|
settings.openAIWebAccessEnabled = true
|
|
settings.codexCookieSource = .auto
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let expectedGuard = store.freshCodexOpenAIWebRefreshGuard()
|
|
store._test_openAIDashboardLoaderOverride = { _, _, _, _ in
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
throw TestRefreshError(message: "old dashboard failure")
|
|
}
|
|
defer { store._test_openAIDashboardLoaderOverride = nil }
|
|
|
|
await store.refreshOpenAIDashboardIfNeeded(force: true, expectedGuard: expectedGuard)
|
|
|
|
#expect(store.openAIDashboard == nil)
|
|
#expect(store.lastOpenAIDashboardError == nil)
|
|
#expect(store.openAIDashboardRequiresLogin == false)
|
|
}
|
|
|
|
@Test
|
|
func `same account token refresh fingerprint change applies dashboard policy failure`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-token-refresh-dashboard-policy-failure")
|
|
let codexMetadata = try #require(ProviderDescriptorRegistry.metadata[.codex])
|
|
settings.setProviderEnabled(provider: .codex, metadata: codexMetadata, enabled: true)
|
|
settings.refreshFrequency = .manual
|
|
settings.openAIWebAccessEnabled = true
|
|
settings.codexCookieSource = .auto
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
defer {
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let expectedGuard = store.freshCodexOpenAIWebRefreshGuard()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-token-material",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-alpha"))
|
|
|
|
await store.applyOpenAIDashboard(
|
|
self.dashboard(email: "other@example.com", creditsRemaining: 64, usedPercent: 27),
|
|
targetEmail: "alpha@example.com",
|
|
expectedGuard: expectedGuard)
|
|
|
|
#expect(store.openAIDashboard == nil)
|
|
#expect(store.lastOpenAIDashboardError?.contains("OpenAI dashboard signed in as other@example.com") == true)
|
|
#expect(store.openAIDashboardRequiresLogin == true)
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh discards selected failure after managed token fingerprint rotates`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-selected-managed-token-failure")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-444444444444"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-333333333333"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-token-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-token-sibling-\(UUID().uuidString)", isDirectory: true)
|
|
try FileManager.default.createDirectory(at: targetHome, withIntermediateDirectories: true)
|
|
try FileManager.default.createDirectory(at: siblingHome, withIntermediateDirectories: true)
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-token@example.com",
|
|
providerAccountID: "acct-managed-token",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-token",
|
|
authFingerprint: "old-managed-token",
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let updatedTarget = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-token@example.com",
|
|
providerAccountID: "acct-managed-token",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-token",
|
|
authFingerprint: "new-managed-token",
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 3,
|
|
lastAuthenticatedAt: 3)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "managed-token-sibling@example.com",
|
|
providerAccountID: "acct-managed-token-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
workspaceAccountID: "acct-managed-token-sibling",
|
|
authFingerprint: "sibling-managed-token",
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
return try await blocker.awaitResult()
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-token-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
let refreshTask = Task { await store.refreshCodexVisibleAccountsForMenu() }
|
|
await blocker.waitUntilStarted()
|
|
try FileManagedCodexAccountStore(fileURL: storeURL).storeAccounts(ManagedCodexAccountSet(
|
|
version: FileManagedCodexAccountStore.currentVersion,
|
|
accounts: [updatedTarget, siblingAccount]))
|
|
await blocker.resume(with: .failure(TestRefreshError(message: "old managed token failure")))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
#expect(!store.codexAccountSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-token"
|
|
})
|
|
#expect(!snapshotStore.storedSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-token"
|
|
})
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh discards selected failure after managed auth file rotates`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-selected-managed-auth-file-failure")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-121212121212"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-131313131313"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-auth-file-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-auth-file-sibling-\(UUID().uuidString)", isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-file-token@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-file-token")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-file-token@example.com",
|
|
providerAccountID: "acct-managed-file-token",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-file-token",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "managed-file-token-sibling@example.com",
|
|
providerAccountID: "acct-managed-file-token-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
workspaceAccountID: "acct-managed-file-token-sibling",
|
|
authFingerprint: "sibling-managed-file-token",
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
return try await blocker.awaitResult()
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-file-token-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
let refreshTask = Task { await store.refreshCodexVisibleAccountsForMenu() }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-file-token@example.com",
|
|
plan: "Team",
|
|
accountId: "acct-managed-file-token")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .failure(TestRefreshError(message: "old managed auth file failure")))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
#expect(!store.codexAccountSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-file-token"
|
|
})
|
|
#expect(!snapshotStore.storedSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-file-token"
|
|
})
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh keeps selected failure when managed auth file rotated before start`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-selected-managed-auth-file-current-failure")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-161616161616"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-171717171717"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-current-failure-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-current-sibling-\(UUID().uuidString)", isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-current-failure@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-current-failure")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-current-failure@example.com",
|
|
providerAccountID: "acct-managed-current-failure",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-current-failure",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "managed-current-sibling@example.com",
|
|
providerAccountID: "acct-managed-current-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
workspaceAccountID: "acct-managed-current-sibling",
|
|
authFingerprint: "sibling-managed-current",
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-current-failure@example.com",
|
|
plan: "Team",
|
|
accountId: "acct-managed-current-failure")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
throw TestRefreshError(message: "current managed auth file failure")
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-current-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
await store.refreshCodexVisibleAccountsForMenu()
|
|
|
|
#expect(store.errors[.codex] == "current managed auth file failure")
|
|
let targetSnapshot = try #require(store.codexAccountSnapshots.first {
|
|
$0.account.workspaceAccountID == "acct-managed-current-failure"
|
|
})
|
|
#expect(targetSnapshot.error == "current managed auth file failure")
|
|
#expect(targetSnapshot.account.authFingerprint == newFingerprint)
|
|
let persistedTargetSnapshot = try #require(snapshotStore.storedSnapshots.first {
|
|
$0.account.workspaceAccountID == "acct-managed-current-failure"
|
|
})
|
|
#expect(persistedTargetSnapshot.error == "current managed auth file failure")
|
|
#expect(persistedTargetSnapshot.account.authFingerprint == newFingerprint)
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh discards selected success after managed auth file switches accounts`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-selected-managed-auth-file-success")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-141414141414"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-151515151515"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-auth-success-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent(
|
|
"codex-visible-managed-auth-success-sibling-\(UUID().uuidString)",
|
|
isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-old-success@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-old-success")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-old-success@example.com",
|
|
providerAccountID: "acct-managed-old-success",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-old-success",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "managed-success-sibling@example.com",
|
|
providerAccountID: "acct-managed-success-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
workspaceAccountID: "acct-managed-success-sibling",
|
|
authFingerprint: "sibling-managed-success",
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
return try await blocker.awaitResult()
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-success-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
let refreshTask = Task { await store.refreshCodexVisibleAccountsForMenu() }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-new-success@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-new-success")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .success(UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 64,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-old-success@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Managed Team"))))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
#expect(!store.codexAccountSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-old-success"
|
|
})
|
|
#expect(!snapshotStore.storedSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-old-success"
|
|
})
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh keeps migrated managed account after token rotation`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-migrated-managed-token-rotation")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-171717171717"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-181818181818"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-migrated-managed-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent(
|
|
"codex-visible-migrated-managed-sibling-\(UUID().uuidString)",
|
|
isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "migrated-managed@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-migrated-managed")
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: siblingHome,
|
|
email: "migrated-sibling@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-migrated-sibling")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
let siblingFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: siblingHome.path))
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "migrated-managed@example.com",
|
|
providerAccountID: "acct-migrated-managed",
|
|
workspaceLabel: "Managed Team",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "migrated-sibling@example.com",
|
|
providerAccountID: "acct-migrated-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
authFingerprint: siblingFingerprint,
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
return try await blocker.awaitResult()
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "migrated-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
let refreshTask = Task { await store.refreshCodexVisibleAccountsForMenu() }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "migrated-managed@example.com",
|
|
plan: "Team",
|
|
accountId: "acct-migrated-managed")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .success(UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 64,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "migrated-managed@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Managed Team"))))
|
|
await refreshTask.value
|
|
|
|
let selectedSnapshot = try #require(store.snapshots[.codex])
|
|
#expect(selectedSnapshot.primary?.usedPercent == 64)
|
|
let targetRow = try #require(store.codexAccountSnapshots.first {
|
|
$0.account.workspaceAccountID == "acct-migrated-managed"
|
|
})
|
|
#expect(targetRow.account.authFingerprint == newFingerprint)
|
|
#expect(targetRow.snapshot?.primary?.usedPercent == 64)
|
|
let persistedTarget = try #require(snapshotStore.storedSnapshots.first {
|
|
$0.account.workspaceAccountID == "acct-migrated-managed"
|
|
})
|
|
#expect(persistedTarget.account.authFingerprint == newFingerprint)
|
|
#expect(persistedTarget.snapshot?.primary?.usedPercent == 64)
|
|
}
|
|
|
|
@Test
|
|
func `stacked visible refresh discards selected success after managed auth file email changes`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-selected-managed-auth-email-success")
|
|
settings.refreshFrequency = .manual
|
|
settings.multiAccountMenuLayout = .stacked
|
|
|
|
let targetID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-191919191919"))
|
|
let siblingID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-202020202020"))
|
|
let targetHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-visible-managed-auth-email-\(UUID().uuidString)", isDirectory: true)
|
|
let siblingHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent(
|
|
"codex-visible-managed-auth-email-sibling-\(UUID().uuidString)",
|
|
isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-old-email@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-email-same")
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: siblingHome,
|
|
email: "managed-email-sibling@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-email-sibling")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
let siblingFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: siblingHome.path))
|
|
let targetAccount = ManagedCodexAccount(
|
|
id: targetID,
|
|
email: "managed-old-email@example.com",
|
|
providerAccountID: "acct-managed-email-same",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-email-same",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: targetHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let siblingAccount = ManagedCodexAccount(
|
|
id: siblingID,
|
|
email: "managed-email-sibling@example.com",
|
|
providerAccountID: "acct-managed-email-sibling",
|
|
workspaceLabel: "Sibling Team",
|
|
workspaceAccountID: "acct-managed-email-sibling",
|
|
authFingerprint: siblingFingerprint,
|
|
managedHomePath: siblingHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [targetAccount, siblingAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: targetHome)
|
|
try? FileManager.default.removeItem(at: siblingHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: targetID)
|
|
|
|
let snapshotStore = RecordingCodexAccountUsageSnapshotStore(initialSnapshots: [])
|
|
let store = UsageStore(
|
|
fetcher: UsageFetcher(environment: [:]),
|
|
browserDetection: BrowserDetection(cacheTTL: 0),
|
|
settings: settings,
|
|
codexAccountUsageSnapshotStore: snapshotStore,
|
|
startupBehavior: .testing)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
let targetHomePath = targetHome.path
|
|
let now = Date()
|
|
self.installContextualCodexProvider(on: store) { context in
|
|
if context.env["CODEX_HOME"] == targetHomePath {
|
|
return try await blocker.awaitResult()
|
|
}
|
|
return UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 9,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-email-sibling@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Sibling Team"))
|
|
}
|
|
|
|
let refreshTask = Task { await store.refreshCodexVisibleAccountsForMenu() }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: targetHome,
|
|
email: "managed-new-email@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-email-same")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: targetHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .success(UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 64,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: now,
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-old-email@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Managed Team"))))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
#expect(!store.codexAccountSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-email-same"
|
|
})
|
|
#expect(!snapshotStore.storedSnapshots.contains {
|
|
$0.account.workspaceAccountID == "acct-managed-email-same"
|
|
})
|
|
}
|
|
|
|
@Test
|
|
func `managed failure guard reads current auth file fingerprint`() throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-managed-auth-file-fingerprint")
|
|
settings.refreshFrequency = .manual
|
|
let accountID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-555555555555"))
|
|
let managedHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-managed-auth-file-\(UUID().uuidString)", isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "managed-auth@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-auth")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
let managedAccount = ManagedCodexAccount(
|
|
id: accountID,
|
|
email: "managed-auth@example.com",
|
|
providerAccountID: "acct-managed-auth",
|
|
workspaceLabel: "Managed Auth",
|
|
workspaceAccountID: "acct-managed-auth",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: managedHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [managedAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: managedHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: accountID)
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let expectedGuard = store.freshCodexAccountScopedRefreshGuard()
|
|
#expect(expectedGuard.authFingerprint == oldFingerprint)
|
|
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "managed-auth@example.com",
|
|
plan: "Team",
|
|
accountId: "acct-managed-auth")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
|
|
#expect(store.freshCodexAccountScopedRefreshGuard().authFingerprint == newFingerprint)
|
|
#expect(!store.shouldApplyCodexScopedFailure(expectedGuard: expectedGuard))
|
|
#expect(!store.shouldApplyCodexScopedNonUsageFailure(expectedGuard: expectedGuard))
|
|
|
|
try FileManager.default.removeItem(at: managedHome)
|
|
#expect(store.freshCodexAccountScopedRefreshGuard().authFingerprint == nil)
|
|
let staleUsage = UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 41,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: Date(),
|
|
identity: ProviderIdentitySnapshot(
|
|
providerID: .codex,
|
|
accountEmail: "managed-auth@example.com",
|
|
accountOrganization: nil,
|
|
loginMethod: "Managed Auth"))
|
|
#expect(!store.shouldApplyCodexUsageResult(expectedGuard: expectedGuard, usage: staleUsage))
|
|
#expect(!store.shouldApplyCodexScopedFailure(expectedGuard: expectedGuard))
|
|
#expect(!store.shouldApplyCodexScopedNonUsageFailure(expectedGuard: expectedGuard))
|
|
}
|
|
|
|
@Test
|
|
func `stale auth fingerprint cache at refresh start keeps current codex usage success`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-stale-start-cache-current-auth")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-email-only-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
let staleReconciliationSnapshot = settings.codexAccountReconciliationSnapshot
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-email-only-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
settings.cachedCodexAccountReconciliationSnapshot = CachedCodexAccountReconciliationSnapshot(
|
|
activeSource: .liveSystem,
|
|
loadedAt: Date(),
|
|
snapshot: staleReconciliationSnapshot)
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
await blocker.resume(with: .success(self.codexSnapshot(email: "alpha@example.com", usedPercent: 33)))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex]?.primary?.usedPercent == 33)
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.authFingerprint == "new-email-only-auth")
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same provider account live email change discards stale codex usage success`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-provider-email-change")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "old@example.com",
|
|
authFingerprint: "old-provider-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-shared"))
|
|
let staleReconciliationSnapshot = settings.codexAccountReconciliationSnapshot
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "new@example.com",
|
|
authFingerprint: "new-provider-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .providerAccount(id: "acct-shared"))
|
|
settings.cachedCodexAccountReconciliationSnapshot = CachedCodexAccountReconciliationSnapshot(
|
|
activeSource: .liveSystem,
|
|
loadedAt: Date(),
|
|
snapshot: staleReconciliationSnapshot)
|
|
await blocker.resume(with: .success(self.codexSnapshot(email: "old@example.com", usedPercent: 25)))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same provider account managed email change discards stale codex usage success`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-managed-provider-email-change")
|
|
settings.refreshFrequency = .manual
|
|
|
|
let accountID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-161616161616"))
|
|
let managedHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-managed-provider-email-\(UUID().uuidString)", isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "old-managed@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-shared")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
let managedAccount = ManagedCodexAccount(
|
|
id: accountID,
|
|
email: "old-managed@example.com",
|
|
providerAccountID: "acct-managed-shared",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-shared",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: managedHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [managedAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: managedHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: accountID)
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "new-managed@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-shared")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .success(self.codexSnapshot(email: "old-managed@example.com", usedPercent: 25)))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `managed codex usage success without email applies when auth guard matches`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-managed-usage-without-email")
|
|
settings.refreshFrequency = .manual
|
|
|
|
let accountID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-171717171717"))
|
|
let managedHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-managed-usage-without-email-\(UUID().uuidString)", isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "email-less-managed@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-email-less")
|
|
let authFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
let managedAccount = ManagedCodexAccount(
|
|
id: accountID,
|
|
email: "email-less-managed@example.com",
|
|
providerAccountID: "acct-managed-email-less",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-email-less",
|
|
authFingerprint: authFingerprint,
|
|
managedHomePath: managedHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [managedAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: managedHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: accountID)
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
await blocker.resume(with: .success(UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 25,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: Date())))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex]?.primary?.usedPercent == 25)
|
|
#expect(store.snapshots[.codex]?.accountEmail(for: .codex) == "email-less-managed@example.com")
|
|
#expect(store.errors[.codex] == nil)
|
|
#expect(store.lastCodexAccountScopedRefreshGuard?.accountKey == "email-less-managed@example.com")
|
|
#expect(store.codexAccountSnapshots.first?.account.email == "email-less-managed@example.com")
|
|
#expect(store.codexAccountSnapshots.first?.snapshot?.accountEmail(for: .codex) ==
|
|
"email-less-managed@example.com")
|
|
}
|
|
|
|
@Test
|
|
func `same provider account managed email change discards stale codex usage success without email`() async throws {
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-managed-provider-email-change-without-email")
|
|
settings.refreshFrequency = .manual
|
|
|
|
let accountID = try #require(UUID(uuidString: "DDDDDDDD-EEEE-FFFF-AAAA-181818181818"))
|
|
let managedHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent(
|
|
"codex-managed-provider-email-without-email-\(UUID().uuidString)",
|
|
isDirectory: true)
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "old-managed-empty@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-shared-empty")
|
|
let oldFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
let managedAccount = ManagedCodexAccount(
|
|
id: accountID,
|
|
email: "old-managed-empty@example.com",
|
|
providerAccountID: "acct-managed-shared-empty",
|
|
workspaceLabel: "Managed Team",
|
|
workspaceAccountID: "acct-managed-shared-empty",
|
|
authFingerprint: oldFingerprint,
|
|
managedHomePath: managedHome.path,
|
|
createdAt: 1,
|
|
updatedAt: 2,
|
|
lastAuthenticatedAt: 2)
|
|
let storeURL = try self.makeManagedAccountStoreURL(accounts: [managedAccount])
|
|
defer {
|
|
settings._test_managedCodexAccountStoreURL = nil
|
|
try? FileManager.default.removeItem(at: storeURL)
|
|
try? FileManager.default.removeItem(at: managedHome)
|
|
}
|
|
settings._test_managedCodexAccountStoreURL = storeURL
|
|
settings.codexActiveSource = .managedAccount(id: accountID)
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
try Self.writeCodexAuthFile(
|
|
homeURL: managedHome,
|
|
email: "new-managed-empty@example.com",
|
|
plan: "Pro",
|
|
accountId: "acct-managed-shared-empty")
|
|
let newFingerprint = try #require(CodexAuthFingerprint.fingerprint(homePath: managedHome.path))
|
|
#expect(newFingerprint != oldFingerprint)
|
|
await blocker.resume(with: .success(UsageSnapshot(
|
|
primary: RateWindow(
|
|
usedPercent: 25,
|
|
windowMinutes: 300,
|
|
resetsAt: nil,
|
|
resetDescription: nil),
|
|
secondary: nil,
|
|
updatedAt: Date())))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
|
|
@Test
|
|
func `same email email-only auth fingerprint switch discards stale codex usage success`() async {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = 60
|
|
let settings = self.makeSettingsStore(
|
|
suite: "CodexAccountScopedRefreshTests-email-only-fingerprint-switch")
|
|
defer {
|
|
SettingsStore.codexAccountReconciliationSnapshotCacheIntervalOverrideForTesting = nil
|
|
settings._test_liveSystemCodexAccount = nil
|
|
}
|
|
settings.refreshFrequency = .manual
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "old-email-only-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
let staleReconciliationSnapshot = settings.codexAccountReconciliationSnapshot
|
|
|
|
let store = self.makeUsageStore(settings: settings)
|
|
let blocker = BlockingCodexFetchStrategy()
|
|
self.installBlockingCodexProvider(on: store, blocker: blocker)
|
|
|
|
let refreshTask = Task { await store.refreshProvider(.codex, allowDisabled: true) }
|
|
await blocker.waitUntilStarted()
|
|
settings._test_liveSystemCodexAccount = ObservedSystemCodexAccount(
|
|
email: "alpha@example.com",
|
|
authFingerprint: "new-email-only-auth",
|
|
codexHomePath: "/Users/test/.codex",
|
|
observedAt: Date(),
|
|
identity: .emailOnly(normalizedEmail: "alpha@example.com"))
|
|
settings.cachedCodexAccountReconciliationSnapshot = CachedCodexAccountReconciliationSnapshot(
|
|
activeSource: .liveSystem,
|
|
loadedAt: Date(),
|
|
snapshot: staleReconciliationSnapshot)
|
|
await blocker.resume(with: .success(self.codexSnapshot(email: "alpha@example.com", usedPercent: 25)))
|
|
await refreshTask.value
|
|
|
|
#expect(store.snapshots[.codex] == nil)
|
|
#expect(store.errors[.codex] == nil)
|
|
}
|
|
}
|