g-orchestrated: Test scopes and errors for a dropped stale refresh

Author: w-goog

GoogleSignIn/Tests/Unit/GIDGoogleUserTest.m

@@ -918,6 +918,7 @@ - (void)testRefreshTokensIfNeededWithCompletion_noRefresh_givenRefreshTokenExpir
 - (void)testRefreshTokensIfNeeded_dropsResponseForReplacedAuthorization {
   GIDGoogleUser *user = [self googleUserWithAccessTokenExpiresIn:-10
                                                 idTokenExpiresIn:kIDTokenExpiresIn];
+  XCTAssertEqualObjects(user.grantedScopes, @[ OIDAuthorizationRequestTestingScope2 ]);
 
   XCTestExpectation *expectation = [self expectationWithDescription:@"Callback is called"];
   [user refreshTokensIfNeededWithCompletion:^(GIDGoogleUser *_Nullable refreshedUser,
@@ -927,18 +928,18 @@ - (void)testRefreshTokensIfNeeded_dropsResponseForReplacedAuthorization {
     XCTAssertNil(error);
   }];
 
-  NSString *updatedIDToken = [self idTokenWithExpiresIn:kNewIDTokenExpiresIn];
+  // The add-scopes flow replaces the authorization while the refresh is in flight.
+  NSArray<NSString *> *scopesAfterAddScopes = @[ OIDAuthorizationRequestTestingScope2, kNewScope ];
   OIDAuthState *updatedAuthState =
-      [OIDAuthState testInstanceWithIDToken:updatedIDToken
-                                accessToken:@"access_token_after_add_scopes"
-                       accessTokenExpiresIn:kAccessTokenExpiresIn
-                               refreshToken:kNewRefreshToken];
+      [self authStateWithGrantedScopes:scopesAfterAddScopes
+                           accessToken:@"access_token_after_add_scopes"];
   [user updateWithTokenResponse:updatedAuthState.lastTokenResponse
           authorizationResponse:updatedAuthState.lastAuthorizationResponse
                     profileData:nil];
 
+  // The stale response carries the old grant's scope and a different access token.
   OIDTokenResponse *staleResponse =
-      [OIDTokenResponse testInstanceWithIDToken:updatedIDToken
+      [OIDTokenResponse testInstanceWithIDToken:[self idTokenWithExpiresIn:kNewIDTokenExpiresIn]
                                     accessToken:kNewAccessToken
                                       expiresIn:@(kAccessTokenExpiresIn)
                                    refreshToken:kRefreshToken
@@ -947,6 +948,39 @@ - (void)testRefreshTokensIfNeeded_dropsResponseForReplacedAuthorization {
   [self waitForExpectationsWithTimeout:1 handler:nil];
 
   XCTAssertEqualObjects(user.accessToken.tokenString, @"access_token_after_add_scopes");
+  XCTAssertEqualObjects(user.grantedScopes, scopesAfterAddScopes);
+}
+
+- (void)testRefreshTokensIfNeeded_dropsErrorForReplacedAuthorization {
+  GIDGoogleUser *user = [self googleUserWithAccessTokenExpiresIn:-10
+                                                idTokenExpiresIn:kIDTokenExpiresIn];
+
+  XCTestExpectation *expectation = [self expectationWithDescription:@"Callback is called"];
+  [user refreshTokensIfNeededWithCompletion:^(GIDGoogleUser *_Nullable refreshedUser,
+                                              NSError *_Nullable error) {
+    [expectation fulfill];
+    XCTAssertNotNil(refreshedUser);
+    XCTAssertNil(error);
+  }];
+
+  // The add-scopes flow replaces the authorization while the refresh is in flight.
+  OIDAuthState *updatedAuthState =
+      [self authStateWithGrantedScopes:@[ OIDAuthorizationRequestTestingScope2, kNewScope ]
+                           accessToken:@"access_token_after_add_scopes"];
+  [user updateWithTokenResponse:updatedAuthState.lastTokenResponse
+          authorizationResponse:updatedAuthState.lastAuthorizationResponse
+                    profileData:nil];
+
+  // A stale OAuth token error for the old grant must not invalidate the new authorization.
+  NSError *staleError = [NSError errorWithDomain:OIDOAuthTokenErrorDomain
+                                            code:OIDErrorCodeOAuthTokenInvalidGrant
+                                        userInfo:nil];
+  _tokenFetchHandler(nil, staleError);
+  [self waitForExpectationsWithTimeout:1 handler:nil];
+
+  XCTAssertTrue(user.authState.isAuthorized);
+  XCTAssertNil(user.authState.authorizationError);
+  XCTAssertEqualObjects(user.accessToken.tokenString, @"access_token_after_add_scopes");
 }
 
 - (void)testWrapperIdentifier_PresentOnRefreshRequestWhenSet {