test(copilot): add device-code and non-JSON error body redaction cases

ZOOWH · ZOOWH · commit 87871297fcc4 · 2026-07-09T23:58:42.000+08:00
Add regression tests covering the device code flow and non-JSON error bodies alongside the existing token refresh coverage. Also include live proof output showing real Response object redaction via extractProviderErrorDetail. Ref: #102953
diff --git a/src/llm/utils/oauth/github-copilot.test.ts b/src/llm/utils/oauth/github-copilot.test.ts
@@ -309,4 +309,43 @@ describe("GitHub Copilot OAuth error body redaction", () => {
     // Structured code is preserved but raw JSON keys are not leaked
     await expect(refreshGitHubCopilotToken("refresh-token")).rejects.toThrow(/code=rate_limited/);
   });
+
+  it("redacts error body via the device code flow", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(
+            JSON.stringify({ error: "invalid_request", error_description: "missing client_id" }),
+            { status: 400, headers: { "Content-Type": "application/json" } },
+          ),
+      ),
+    );
+
+    await expect(testing.startDeviceFlow("github.com")).rejects.toThrow(
+      "GitHub Copilot device code request failed with status 400",
+    );
+    await expect(testing.startDeviceFlow("github.com")).rejects.not.toThrow(/error_description/);
+  });
+
+  it("handles non-JSON error bodies with bounded detail", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response("Internal Server Error", {
+            status: 500,
+            headers: { "Content-Type": "text/plain" },
+          }),
+      ),
+    );
+
+    // For non-JSON bodies the detail is the body text itself (bounded by readResponseTextLimited).
+    // The error message should include the status code and the bounded body as detail.
+    await expect(refreshGitHubCopilotToken("refresh-token")).rejects.toThrow(
+      /GitHub Copilot token refresh request failed with status 500/,
+    );
+    // Raw JSON syntax like {"error": must never appear for non-JSON responses
+    await expect(refreshGitHubCopilotToken("refresh-token")).rejects.not.toThrow(/\{"error"/);
+  });
 });
