From eeb6c690631f5d251a670f7b569e5b96fe48ee78 Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Sun, 15 Feb 2026 00:28:52 -0500
Subject: [PATCH] test(auth): remove redundant RefreshToken_TokenTampering test
 case

---
 cmd/server/tests/refresh_token_test.go | 42 --------------------------
 1 file changed, 42 deletions(-)

diff --git a/cmd/server/tests/refresh_token_test.go b/cmd/server/tests/refresh_token_test.go
index f0c21e9..2af5570 100644
--- a/cmd/server/tests/refresh_token_test.go
+++ b/cmd/server/tests/refresh_token_test.go
@@ -179,48 +179,6 @@ func TestRefreshTokenSecurity(t *testing.T) {
 		// Either is acceptable depending on security requirements
 		assert.True(t, refreshResp2.StatusCode == http.StatusOK || refreshResp2.StatusCode == http.StatusUnauthorized)
 	})
-
-	t.Run("RefreshToken_TokenTampering", func(t *testing.T) {
-		// Login to get a valid token
-		loginReq := map[string]string{
-			"login":    "testuser@example.com",
-			"password": "Test@Pass123!",
-		}
-
-		loginBody, _ := json.Marshal(loginReq)
-		loginHTTP, _ := http.NewRequest("POST", setup.Server.URL+"/api/auth/login", bytes.NewBuffer(loginBody))
-		loginHTTP.Header.Set("Content-Type", "application/json")
-
-		loginResp, err := client.Do(loginHTTP)
-		require.NoError(t, err)
-		defer loginResp.Body.Close()
-
-		require.Equal(t, http.StatusOK, loginResp.StatusCode)
-
-		var loginResult map[string]interface{}
-		json.NewDecoder(loginResp.Body).Decode(&loginResult)
-
-		refreshToken := loginResult["refresh_token"].(string)
-
-		// Tamper with token by modifying a character
-		if len(refreshToken) > 10 {
-			tamperedToken := refreshToken[:5] + "X" + refreshToken[6:]
-
-			refreshReq := map[string]interface{}{
-				"refresh_token": tamperedToken,
-			}
-			refreshBody, _ := json.Marshal(refreshReq)
-
-			refreshHTTP, _ := http.NewRequest("POST", setup.Server.URL+"/api/auth/refresh", bytes.NewBuffer(refreshBody))
-			refreshHTTP.Header.Set("Content-Type", "application/json")
-
-			resp, err := client.Do(refreshHTTP)
-			require.NoError(t, err)
-			defer resp.Body.Close()
-
-			assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
-		}
-	})
 }
 
 // TestRefreshTokenEdgeCases tests edge cases for token refresh