From 5f5c41d6b9fa59732d178eb0accfdaeaeceba2ba Mon Sep 17 00:00:00 2001 From: Steven Lee Date: Thu, 25 Jun 2026 17:12:40 +0000 Subject: [PATCH] Stabilize OAuth recovery assertions --- codex-rs/rmcp-client/src/oauth.rs | 5 ++++- codex-rs/rmcp-client/tests/streamable_http_oauth_startup.rs | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/codex-rs/rmcp-client/src/oauth.rs b/codex-rs/rmcp-client/src/oauth.rs index df5506647e..410e0016c5 100644 --- a/codex-rs/rmcp-client/src/oauth.rs +++ b/codex-rs/rmcp-client/src/oauth.rs @@ -1372,7 +1372,10 @@ mod tests { Some("rotated-refresh-token".to_string()) ); let second_tokens = tokens_from_manager(&second_manager).await?; - assert_eq!(second_tokens.token_response, stored.token_response); + assert_token_response_match_without_expiry( + &second_tokens.token_response, + &stored.token_response, + ); Ok(()) } diff --git a/codex-rs/rmcp-client/tests/streamable_http_oauth_startup.rs b/codex-rs/rmcp-client/tests/streamable_http_oauth_startup.rs index d578f40a3e..c0c691980e 100644 --- a/codex-rs/rmcp-client/tests/streamable_http_oauth_startup.rs +++ b/codex-rs/rmcp-client/tests/streamable_http_oauth_startup.rs @@ -587,7 +587,9 @@ async fn persisted_credentials_auth_status_child() -> anyhow::Result<()> { url: UNEXPIRED_SERVER_URL.to_string(), client_id: "test-client-id".to_string(), token_response: WrappedOAuthTokenResponse(response), - expires_at: Some(now.saturating_add(/*rhs*/ 60_000)), + // Keep this outside the 60-second proactive refresh guard band. The test is checking a + // healthy persisted access token, not the boundary where a refresh becomes necessary. + expires_at: Some(now.saturating_add(/*rhs*/ 120_000)), }; save_oauth_tokens( SERVER_NAME,