From 57b16df2862cc4c3c4c8ec0e33a6506996718fcf Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Fri, 9 Oct 2026 17:32:28 +0200 Subject: [PATCH] Refresh tests: pin the refresh owner's endurance and the signing-algorithm check Co-Authored-By: Claude Opus 5.5 --- crates/ghostlight-dungeon/src/heimdall.rs | 16 ++++++++++++++++ crates/ghostlight-dungeon/src/runtime.rs | 13 +++++++++++++ 2 files changed, 29 insertions(+) diff --git a/crates/ghostlight-dungeon/src/heimdall.rs b/crates/ghostlight-dungeon/src/heimdall.rs index 7f32c9b..5177cc9 100644 --- a/crates/ghostlight-dungeon/src/heimdall.rs +++ b/crates/ghostlight-dungeon/src/heimdall.rs @@ -1187,6 +1187,22 @@ mod tests { assert!(cache.key("k1", start + JWKS_TTL).is_none(), "stale at the ttl"); } + #[tokio::test] + async fn a_token_signed_with_another_algorithm_is_refused_before_any_key_fetch() { + let token = jsonwebtoken::encode( + &jsonwebtoken::Header::new(Algorithm::HS256), + &serde_json::json!({"sub": "x"}), + &jsonwebtoken::EncodingKey::from_secret(b"secret"), + ) + .unwrap(); + let error = HeimdallClient::fixture() + .verify_access(&token) + .await + .unwrap_err(); + assert!(error.to_string().contains("unsupported signing algorithm"), "{error:#}"); + assert!(error.downcast_ref::().is_none()); + } + #[test] fn a_denied_status_is_the_typed_denial_and_any_other_status_passes() { let diagnostics = vec!["Idempotency key was reused".to_owned()]; diff --git a/crates/ghostlight-dungeon/src/runtime.rs b/crates/ghostlight-dungeon/src/runtime.rs index 9d1e6c7..e1574f4 100644 --- a/crates/ghostlight-dungeon/src/runtime.rs +++ b/crates/ghostlight-dungeon/src/runtime.rs @@ -2548,6 +2548,19 @@ mod tests { } } + /// The daemon's refresh owner serves until it fails: a body that returns + /// at once would be read by `serve` as the owner stopping. + #[tokio::test] + async fn the_session_refresh_owner_keeps_serving() { + let fixture = fixture().await; + let ran = tokio::time::timeout( + Duration::from_millis(300), + maintain_session_refresh(fixture.state.clone()), + ) + .await; + assert!(ran.is_err(), "the refresh owner returned: {ran:?}"); + } + /// PA.f172: `state.play` being `None` — a play table that failed to /// open, for any reason, `PlayTurnStore::open` returning `Err` among /// them — must be visible on `/health`, the same operator-facing surface