test(oidc_web_core): cover OidcWebCore redirect and session flows#374
Merged
Conversation
Drives the hiddenIFrame/newPage/popup authorize and end-session flows, the front-channel logout listener rejection branches, and monitorSessionStatus (result kinds, message guards, pause/resume/cancel). Lifts lib/src/oidc_web_core.dart from 64/183 to 183/193 lines and the package from 67.5% to 93.5%. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McVLYD2qr9r6Hec2MpKZaU
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds Dart browser-flow tests for ChangesOIDC web flow tests
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/oidc_web_core/test/oidc_web_core_flows_test.dart`:
- Around line 262-266: Register an addTearDown callback immediately after
confirming the nullable web_window in the prepareForRedirectFlow test, using the
existing win reference to close the opened window. Keep the current explicit
win.close() behavior intact while ensuring cleanup also runs when the test exits
early or fails before that call.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 84f52674-15e0-4edc-a4c6-e9c9fec87891
📒 Files selected for processing (1)
packages/oidc_web_core/test/oidc_web_core_flows_test.dart
Comment on lines
+262
to
+266
| final win = preparation['web_window'] as web.Window?; | ||
| if (win == null) { | ||
| markTestSkipped('window.open returned null (no user gesture).'); | ||
| return; | ||
| } |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Register an addTearDown to close the opened window.
Unlike the full popup/newPage flow test (which registers addTearDown at line 228), this test opens a window via prepareForRedirectFlow but has no cleanup registered. If the test fails before win.close() at line 279 (e.g., the 450ms delay is interrupted), the window leaks.
🛡️ Proposed fix
final win = preparation['web_window'] as web.Window?;
if (win == null) {
markTestSkipped('window.open returned null (no user gesture).');
return;
}
+ addTearDown(() {
+ if (!win.closed) win.close();
+ });
final future = core.getAuthorizationResponse(📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| final win = preparation['web_window'] as web.Window?; | |
| if (win == null) { | |
| markTestSkipped('window.open returned null (no user gesture).'); | |
| return; | |
| } | |
| final win = preparation['web_window'] as web.Window?; | |
| if (win == null) { | |
| markTestSkipped('window.open returned null (no user gesture).'); | |
| return; | |
| } | |
| addTearDown(() { | |
| if (!win.closed) win.close(); | |
| }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/oidc_web_core/test/oidc_web_core_flows_test.dart` around lines 262 -
266, Register an addTearDown callback immediately after confirming the nullable
web_window in the prepareForRedirectFlow test, using the existing win reference
to close the opened window. Keep the current explicit win.close() behavior
intact while ensuring cleanup also runs when the test exits early or fails
before that call.
… otherwise Both unit_tests legs wedged on the Firefox PR-scope step twice in a row on this PR (four 15-minute step-timeout kills, runs 29160893635 attempts 1-2), always before the first suite's first test completed — the #372 channel-death hang, not a test failure; the same suites pass on Firefox locally and passed on CI at 5e47045. At roughly coin-flip odds per step and two legs per run, whole-job reruns need many rolls to land green. Each PR-scope browser step now tries up to three times, each try bounded at 5 minutes (honest runs take 20-90s; a wedged try produces nothing and is killed by coreutils timeout). A genuine test failure fails all three tries quickly and still blocks the PR. Step timeout-minutes widens 15->18 to fit three bounded tries. Full-sweep steps are unchanged; their comment now carries the measured first/second-browser asymmetry (the second browser reuses the first's dart2js compile cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McVLYD2qr9r6Hec2MpKZaU
…uccess Run 29162293700 exposed the interaction: under coreutils timeout's default process-group isolation, the outer melos exited 1 even though all 47 tests passed and the inner melos run printed SUCCESS (its own summary never printed; exit at 53s with the 300s timer idle). Every non-wrapped run of the same command exits 0. --foreground keeps melos in the step shell's process group — the topology every working run used. On a real timeout the TERM/KILL now reaches only melos, so a wedged dart/browser child can linger until job teardown; the retry spawns fresh processes, so that is acceptable. Also capture and log each try's exit code so failures self-identify in the step output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McVLYD2qr9r6Hec2MpKZaU
…es post-success Two consecutive runs (29162293700, 29162532019) failed both matrix legs the same way: every test passed, the inner melos layer printed SUCCESS, then the outermost melos exited 1 without printing its own summary — and the step shell died without reaching its next statement (no retry echo, with or without timeout's process-group isolation). dart test's exit code is the ground truth those layers were relaying, so the PR-scope steps now invoke it directly in the package directory, with set +e and explicit rc handling so no failed try or failed echo write can kill the loop, three 5-minute-bounded tries as before. The melos test:web:pr:* scripts remain for local use; both sides carry a keep-in-sync note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McVLYD2qr9r6Hec2MpKZaU
…xisting Six consecutive killed tries across two runner VMs (run 29162814103, attempts 1-2, all rc=137) localized the hang: the Firefox tab's event loop freezes for minutes right after library_surface_test's front-channel BroadcastChannel test — the next trivial synchronous test's pass printed 4m39s late, one second before the 300s TERM, with the in-browser per-test timer frozen along with everything else. The same boundary froze runs before this PR's tests existed (5e47045 stable leg), and the identical step passes in ~57s when the freeze doesn't strike (beta, same commit). This is #372, not a regression. A probabilistic multi-minute-to-indefinite freeze can't be made reliably blocking with bounded retries, so the Firefox PR-scope step becomes continue-on-error: still runs, still visible red on a freeze, no longer gates merges. Chrome remains blocking, and every main push keeps the full two-browser sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McVLYD2qr9r6Hec2MpKZaU
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #374 +/- ##
===========================================
+ Coverage 74.48% 92.18% +17.70%
===========================================
Files 158 119 -39
Lines 8446 6131 -2315
Branches 1572 2151 +579
===========================================
- Hits 6291 5652 -639
+ Misses 2155 479 -1676 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a browser (
@TestOn('js')) test suite covering the previouslyuntested flow logic in
OidcWebCore:BroadcastChannel, rejecting non-string / unparseable / state-mismatchmessages, and the
hiddenIframeTimeout->nullpath;_calculatePopupOptions), the"window not prepared" throw, the prepared-window happy path, and
window-closed-before-completion detection;
mismatch, non-string, unparseable, missing
requestType);monitorSessionStatus: changed / unchanged / error / unknown results, theorigin / iframe / non-string message guards, and pause / resume / cancel.
Coverage for
oidc_web_core(chrome, lcov,--report-on=lib):lib/src/oidc_web_core.dartlib/src/oidc_web_crypto.dartThe remaining uncovered lines are defensive / error paths that can't be
reached deterministically in a single same-origin headless context (a
COOP-severed
WindowProxy, the IndexedDB fault handlers, and the cross-tabkey-
addrace); they're enumerated in the test file.🤖 Generated with Claude Code
Summary by CodeRabbit
Tests
prompt=none, prepared-window errors, andwindow_closedoutcomes (when window closing is detectable).Chores / CI
dart testcommands for Chrome/Firefox with bounded retries and timeouts.