Function callback_server_handles_cors_preflight

crates/openshell-cli/src/auth.rs:765–818

()

    #[tokio::test]
    async fn callback_server_handles_cors_preflight() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let (tx, rx) = oneshot::channel();

        tokio::spawn(run_callback_server(
            listener,
            tx,
            "ABC-1234".to_string(),
            TEST_GATEWAY.to_string(),
        ));

        // Send OPTIONS preflight with correct origin.
        let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
        let preflight = format!(
            "OPTIONS /callback HTTP/1.1\r\n\
             Host: 127.0.0.1\r\n\
             Origin: {TEST_GATEWAY}\r\n\r\n"
        );
        stream.write_all(preflight.as_bytes()).await.unwrap();

        let mut buf = vec![0u8; 4096];
        let n = stream.read(&mut buf).await.unwrap();
        let response = String::from_utf8_lossy(&buf[..n]);
        let expected_header = format!("access-control-allow-origin: {TEST_GATEWAY}");
        assert!(
            response.contains("204 No Content"),
            "preflight should return 204:\n{response}"
        );
        assert!(
            response
                .lines()
                .any(|line| line.eq_ignore_ascii_case(&expected_header)),
            "preflight should reflect gateway origin:\n{response}"
        );

        // Now send the actual POST — the server should still be listening.
        let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
        let body = r#"{"token":"jwt-after-preflight","code":"ABC-1234"}"#;
        let request = format!(
            "POST /callback HTTP/1.1\r\n\
             Host: 127.0.0.1\r\n\
             Origin: {TEST_GATEWAY}\r\n\
             Content-Type: application/json\r\n\
             Content-Length: {}\r\n\r\n\
             {}",
            body.len(),
            body,
        );
        stream.write_all(request.as_bytes()).await.unwrap();

        let token = rx.await.unwrap();
        assert_eq!(token, "jwt-after-preflight");
    }

    #[tokio::test]
    async fn callback_server_handles_fragmented_post_body() {