From 9b41b3ecb00a725d205ce08b8997beac427ae16a Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Sat, 31 Jan 2026 11:44:47 -0500
Subject: [PATCH] Add refresh token flow integration test

- Test login returns both access_token and refresh_token
- Test refresh endpoint accepts UUID token and returns new access_token
- Verifies end-to-end refresh token flow works correctly
---
 cmd/server/tests/main_test.go | 58 +++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/cmd/server/tests/main_test.go b/cmd/server/tests/main_test.go
index 02fc57f..c9229f9 100644
--- a/cmd/server/tests/main_test.go
+++ b/cmd/server/tests/main_test.go
@@ -1,7 +1,12 @@
 package main
 
 import (
+	"bytes"
+	"encoding/json"
+	"net/http"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestTest(t *testing.T) {
@@ -10,3 +15,56 @@ func TestTest(t *testing.T) {
 	t.Log("📋 Test discovery and execution should work correctly")
 	t.Log("🎯 All edge cases should be covered")
 }
+
+func TestRefreshTokenFlow(t *testing.T) {
+	baseURL := "http://localhost:8765/api"
+
+	t.Run("Step1_Login", func(t *testing.T) {
+		loginReq := map[string]string{
+			"login":    "admin@bookmann.test",
+			"password": "TestPassword123!@#",
+		}
+
+		body, _ := json.Marshal(loginReq)
+		resp, err := http.Post(baseURL+"/auth/login", "application/json", bytes.NewBuffer(body))
+		assert.NoError(t, err)
+		defer resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+		var result map[string]interface{}
+		json.NewDecoder(resp.Body).Decode(&result)
+
+		assert.NotNil(t, result["access_token"], "Should have access_token")
+		assert.NotNil(t, result["refresh_token"], "Should have refresh_token")
+
+		_, _ = result["access_token"].(string)
+		refreshToken, _ := result["refresh_token"].(string)
+
+		t.Logf("✅ Login successful, got access and refresh tokens")
+
+		t.Run("Step2_RefreshAccessToken", func(t *testing.T) {
+			refreshReq := map[string]string{
+				"refresh_token": refreshToken,
+			}
+
+			body, _ := json.Marshal(refreshReq)
+			req, _ := http.NewRequest("POST", baseURL+"/auth/refresh", bytes.NewBuffer(body))
+			req.Header.Set("Content-Type", "application/json")
+
+			client := &http.Client{}
+			resp, err := client.Do(req)
+			assert.NoError(t, err)
+			defer resp.Body.Close()
+
+			var refreshResult map[string]interface{}
+			json.NewDecoder(resp.Body).Decode(&refreshResult)
+
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+			assert.NotNil(t, refreshResult["access_token"], "Refresh should return new access_token")
+			assert.NotEmpty(t, refreshResult["access_token"], "New access token should not be empty")
+
+			t.Logf("✅ Refresh token working, got new access token")
+		})
+	})
+}