From ab6c7f3e8ce9b942c8c77352b341e49c17c076fb Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Tue, 21 Apr 2026 09:13:39 -0400
Subject: [PATCH] test(auth): cover refresh-token pass-through and session+demo
 mint

Two middleware gaps from the translation-refactor plan: a
fabro_refresh_* bearer should flow through unchanged, and a session
cookie should still mint a JWT when x-fabro-demo is also set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/crates/fabro-server/src/auth/translate.rs | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/lib/crates/fabro-server/src/auth/translate.rs b/lib/crates/fabro-server/src/auth/translate.rs
index b82fa0429..b8891483f 100644
--- a/lib/crates/fabro-server/src/auth/translate.rs
+++ b/lib/crates/fabro-server/src/auth/translate.rs
@@ -487,6 +487,52 @@ mod tests {
         assert_eq!(json["authorization"], format!("Bearer {WRONG_DEV_TOKEN}"));
     }
 
+    #[tokio::test]
+    async fn auth_translation_passes_refresh_token_through_unchanged() {
+        let state = test_state();
+        let refresh_token = "fabro_refresh_abcdefghijklmnop";
+        let response = translation_router(state)
+            .oneshot(
+                Request::builder()
+                    .uri("/inspect")
+                    .header(header::AUTHORIZATION, format!("Bearer {refresh_token}"))
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        let json = response_json!(response).await;
+        assert_eq!(json["authorization"], format!("Bearer {refresh_token}"));
+    }
+
+    #[tokio::test]
+    async fn auth_translation_mints_from_session_even_when_demo_header_set() {
+        let state = test_state();
+        let cookie = session_cookie(&github_session(), state.as_ref());
+        let response = translation_router(Arc::clone(&state))
+            .oneshot(
+                Request::builder()
+                    .uri("/inspect")
+                    .header(header::COOKIE, cookie)
+                    .header("x-fabro-demo", "1")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        let json = response_json!(response).await;
+        let token = json["authorization"]
+            .as_str()
+            .and_then(|value| value.strip_prefix("Bearer "))
+            .expect("authorization should be minted despite demo header");
+        let claims = auth::verify(&signing_key(), "https://fabro.example", token).unwrap();
+        assert_eq!(claims.login, "octocat");
+        assert_eq!(claims.auth_method, RunAuthMethod::Github);
+        assert_eq!(json["demo"], "1");
+    }
+
     #[tokio::test]
     async fn auth_translation_panics_without_auth_mode_extension() {
         let state = test_state();