R81: reject empty access token on callback+refresh

2026-10-18 04:47:28 +00:00 · 2026-08-13 18:34:11 +01:00
parent 893a7ea251
commit 820d7969e3
4 changed files with 155 additions and 0 deletions
@@ -1129,6 +1129,7 @@ func TestHandleCallback(t *testing.T) {
 			exchangeCodeForToken: func(code string, redirectURL string, codeVerifier string) (*TokenResponse, error) {
 				return &TokenResponse{
 					IDToken:      ts.token,
+					AccessToken:  "test-access-token",
 					RefreshToken: "test-refresh-token",
 				}, nil
 			},
@@ -1203,6 +1204,7 @@ func TestHandleCallback(t *testing.T) {
 				}
 				return &TokenResponse{
 					IDToken:      disallowedToken,
+					AccessToken:  "test-access-token",
 					RefreshToken: "test-refresh-token-disallowed",
 				}, nil
 			},