TestKratosErrorsIsMasksJWTErrors demonstrates the bug that motivates our Message-based comparison: Kratos errors.Is() only compares Code and Reason. Since all JWT errors share Code=401 and Reason="UNAUTHORIZED", errors.Is() incorrectly matches ANY JWT error against ANY other JWT sentinel.
(t *testing.T)
| 149 | // Since all JWT errors share Code=401 and Reason="UNAUTHORIZED", errors.Is() |
| 150 | // incorrectly matches ANY JWT error against ANY other JWT sentinel. |
| 151 | func TestKratosErrorsIsMasksJWTErrors(t *testing.T) { |
| 152 | // This test proves that the naive errors.Is approach is broken: |
| 153 | // ErrTokenExpired would incorrectly match ErrTokenInvalid via Kratos errors.Is. |
| 154 | if !kratosErrors.Is(jwtMiddleware.ErrTokenExpired, jwtMiddleware.ErrTokenInvalid) { |
| 155 | t.Skip("Kratos errors.Is behavior has changed; this test documents the original masking bug") |
| 156 | } |
| 157 | |
| 158 | // Now verify that our isWrappedErr correctly distinguishes them |
| 159 | st := toGRPCStatus(jwtMiddleware.ErrTokenExpired) |
| 160 | assert.False(t, isWrappedErr(st, jwtMiddleware.ErrTokenInvalid), |
| 161 | "isWrappedErr should NOT match ErrTokenExpired against ErrTokenInvalid") |
| 162 | assert.True(t, isWrappedErr(st, jwtMiddleware.ErrTokenExpired), |
| 163 | "isWrappedErr should match ErrTokenExpired against itself") |
| 164 | } |
| 165 | |
| 166 | // TestIsWrappedErrGRPCWireRoundTrip verifies that isWrappedErr works after a |
| 167 | // full gRPC wire round-trip: KratosError -> GRPCStatus -> proto bytes -> gRPC |
nothing calls this directly
no test coverage detected