From f3081b9d9bc2feea4164b00da0bcaa3a0d9c4fed Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Thu, 23 Oct 2025 16:57:50 -0500
Subject: [PATCH 1/8] Update auth tests

---
 tests/README.md                               |  25 ++-
 .../globus_auth.bash                          | 142 +++++++++++++-----
 2 files changed, 116 insertions(+), 51 deletions(-)
 rename tests/integration/bash_tests/{run_from_chrysalis => run_from_any}/globus_auth.bash (52%)

diff --git a/tests/README.md b/tests/README.md
index d63e7851..72af6ddd 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -32,6 +32,11 @@ python -m unittest tests/integration/python_tests/group_by_command/test_*.py
 python -m unittest tests/integration/python_tests/group_by_workflow/test_*.py
 # Ran 4 tests in 2.666s
 # OK
+
+cd tests/integration/bash_tests/run_from_any/
+# Review the directions at the bottom of globus_auth.bash
+# You will need to modify the file and run several times.
+
 cd tests/integration/bash_tests/run_from_perlmutter/
 time ./follow_symlinks.sh # NOTE: you will have to change out paths for your username
 # real	0m31.851s
@@ -65,24 +70,12 @@ python -m unittest tests/integration/python_tests/group_by_command/test_*.py
 python -m unittest tests/integration/python_tests/group_by_workflow/test_*.py
 # Ran 4 tests in 6.889s
 # OK
-cd tests/integration/bash_tests/run_from_chrysalis/
 
-# Log into globus.org
-# 1. Log into endpoints (LCRC Improv DTN, NERSC Perlmutter) at globus.org: File Manager > Add the endpoints in the "Collection" fields
-# 2. To start fresh, with no consents: https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
-# Then, increment `try_num` below to avoid using an old directory.
-# Alternatively, start fresh by deleting the directory on Perlmutter:
-# `rm -rf /global/homes/f/forsyth/zstash/tests/test_globus_auth_try{try_num}`
-time ./globus_auth.bash try_num # NOTE: you will have to change out paths for your username
-# Paste the URL into your browser
-# Log into Argonne
-# Log into NERSC
-# Provide a label
-# Copy the auth code to the command line
-#
-# real	2m45.954s
-# No errors
+cd tests/integration/bash_tests/run_from_any/
+# Review the directions at the bottom of globus_auth.bash
+# You will need to modify the file and run several times.
 
+cd tests/integration/bash_tests/run_from_chrysalis/
 # If not done above, do the following:
 # Log into globus.org
 # Log into endpoints (LCRC Improv DTN, NERSC Perlmutter) at globus.org: File Manager > Add the endpoints in the "Collection" fields
diff --git a/tests/integration/bash_tests/run_from_chrysalis/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
similarity index 52%
rename from tests/integration/bash_tests/run_from_chrysalis/globus_auth.bash
rename to tests/integration/bash_tests/run_from_any/globus_auth.bash
index a3905bdb..21725c5a 100755
--- a/tests/integration/bash_tests/run_from_chrysalis/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -1,21 +1,4 @@
-setup()
-{
-  echo "##########################################################################################################"
-  local case_name="${1}"
-  local src_dir="${2}"
-  echo "Testing: ${case_name}"
-  full_dir="${src_dir}/${case_name}"
-  rm -rf ${full_dir}
-  mkdir -p ${full_dir}
-  cd ${full_dir}
-
-  mkdir zstash_demo
-  mkdir zstash_demo/empty_dir
-  mkdir zstash_demo/dir
-  echo -n '' > zstash_demo/file_empty.txt
-  echo 'file0 stuff' > zstash_demo/dir/file0.txt
-}
-
+# Assertions ##################################################################
 check_log_has()
 {
     local expected_grep="${1}"
@@ -38,20 +21,74 @@ check_log_does_not_have()
     fi
 }
 
-run_test_cases()
+# Running #####################################################################
+setup()
 {
-    local try_num=$1
+  echo "##########################################################################################################"
+  local case_name="${1}"
+  local src_dir="${2}"
+  echo "Testing: ${case_name}"
+  full_dir="${src_dir}/${case_name}"
+  rm -rf ${full_dir}
+  mkdir -p ${full_dir}
+  cd ${full_dir}
+
+  mkdir zstash_demo
+  mkdir zstash_demo/empty_dir
+  mkdir zstash_demo/dir
+  echo -n '' > zstash_demo/file_empty.txt
+  echo 'file0 stuff' > zstash_demo/dir/file0.txt
+}
+
+get_endpoint()
+{
+    # Usage example:
+    # uuid=$(get_endpoint NERSC_PERLMUTTER_ENDPOINT)
 
-    PERLMUTTER_ENDPOINT=6bdc7956-fc0f-4ad2-989c-7aa5ee643a79
+    local endpoint_name=$1
+    # Define endpoints; see https://app.globus.org/collections
+    LCRC_IMPROV_DTN_ENDPOINT=15288284-7006-4041-ba1a-6b52501e49f1
+    NERSC_PERLMUTTER_ENDPOINT=6bdc7956-fc0f-4ad2-989c-7aa5ee643a79
+    NERSC_HPSS_ENDPOINT=9cd89cfd-6d04-11e5-ba46-22000b92c6ec
+    PIC_COMPY_DTN_ENDPOINT=68fbd2fa-83d7-11e9-8e63-029d279f7e24
+    GLOBUS_TUTORIAL_COLLECTION_1_ENDPOINT=6c54cade-bde5-45c1-bdea-f4bd71dba2cc
+    case ${endpoint_name} in
+        LCRC_IMPROV_DTN_ENDPOINT)
+            echo ${LCRC_IMPROV_DTN_ENDPOINT}
+            ;;
+        NERSC_PERLMUTTER_ENDPOINT)
+            echo ${NERSC_PERLMUTTER_ENDPOINT}
+            ;;
+        NERSC_HPSS_ENDPOINT)
+            echo ${NERSC_HPSS_ENDPOINT}
+            ;;
+        PIC_COMPY_DTN_ENDPOINT)
+            echo ${PIC_COMPY_DTN_ENDPOINT}
+            ;;
+        GLOBUS_TUTORIAL_COLLECTION_1_ENDPOINT)
+            echo ${GLOBUS_TUTORIAL_COLLECTION_1_ENDPOINT}
+            ;;
+        *)
+            echo "Unknown endpoint name: ${endpoint_name}" >&2
+            exit 1
+            ;;
+    esac
+}
 
-    SRC_DIR=/lcrc/group/e3sm/ac.forsyth2/zstash_testing/test_globus_auth # Chrysalis
-    DST_DIR=globus://${PERLMUTTER_ENDPOINT}/global/homes/f/forsyth/zstash/tests/test_globus_auth_try${try_num} # Perlmutter
-    # To start fresh with try_num=1, delete the above directory on Perlmutter before running. Example:
-    # rm -rf /global/homes/f/forsyth/zstash/tests/test_globus_auth_try1
+run_test_cases()
+{
+    local path_to_repo=$1
+    local dst_endpoint=$2
+    local dst_dir=$3
 
-    GLOBUS_CFG=/home/ac.forsyth2/.globus-native-apps.cfg
-    INI_PATH=/home/ac.forsyth2/.zstash.ini
-    TOKEN_FILE=/home/ac.forsyth2/.zstash_globus_tokens.json
+    src_dir=${path_to_repo}/tests/utils/globus_auth
+    mkdir -p ${src_dir}
+    dst_endpoint_uuid=$(get_endpoint ${dst_endpoint})
+    globus_path=globus://${dst_endpoint_uuid}/${dst_dir}
+
+    GLOBUS_CFG=${HOME}/.globus-native-apps.cfg
+    INI_PATH=${HOME}/.zstash.ini
+    TOKEN_FILE=${HOME}/.zstash_globus_tokens.json
 
     # Start fresh
     rm -rf ${GLOBUS_CFG}
@@ -62,9 +99,9 @@ run_test_cases()
     echo "Exit codes: 0 -- success, 1 -- zstash failed, 2 -- grep check failed"
 
     case_name="run1"
-    setup ${case_name} "${SRC_DIR}"
+    setup ${case_name} "${src_dir}"
     # Expecting to see exactly 1 authentication prompt
-    zstash create --hpss=${DST_DIR}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
     if [ $? != 0 ]; then
         echo "${case_name} failed. Check ${case_name}_create.log for details. Cannot continue."
         exit 1
@@ -85,9 +122,9 @@ run_test_cases()
 
 
     case_name="run2"
-    setup ${case_name} "${SRC_DIR}"
+    setup ${case_name} "${src_dir}"
     # Expecting to see exactly 0 authentication prompts
-    zstash create --hpss=${DST_DIR}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
     if [ $? != 0 ]; then
         echo "${case_name} failed. Check ${case_name}_create.log for details. Cannot continue."
         exit 1
@@ -107,15 +144,50 @@ run_test_cases()
     check_log_does_not_have "INFO: Tokens saved successfully" ${case_name}.log # Differs from run1
 
     # This part replaces the original test_globus.py `testLs` function.
-    zstash ls --hpss=${DST_DIR}/run1 2>&1 | tee run1_ls.log
+    zstash ls --hpss=${globus_path}/run1 2>&1 | tee run1_ls.log
     check_log_has "file_empty.txt" run1_ls.log
     check_log_has "dir/file0.txt" run1_ls.log
     check_log_has "empty_dir" run1_ls.log
-    zstash ls --hpss=${DST_DIR}/run2 2>&1 | tee run2_ls.log
+    zstash ls --hpss=${globus_path}/run2 2>&1 | tee run2_ls.log
     check_log_has "file_empty.txt" run2_ls.log
     check_log_has "dir/file0.txt" run2_ls.log
     check_log_has "empty_dir" run2_ls.log
     # Could also test -l and -v options, but the above code covers the important part.
 }
 
-run_test_cases "$1"
+# Follow these directions #####################################################
+# Modify these parameters as needed.
+
+# Step 1. Update try_num for each new test run to avoid conflicts with previous runs.
+# Alternative: Remove previous test directories manually.
+try_num=16
+
+# Step 2. Set paths for your environment by uncommenting the appropriate lines.
+# Running from Chrysalis:
+path_to_repo = /home/ac.forsyth2/ez/zstash/
+dst_dir = /home/ac.forsyth2/zstash/tests/test_globus_auth_try${try_num}
+# Running from Perlmutter:
+# path_to_repo = /global/homes/f/forsyth/ez/zstash
+# dst_dir = global/homes/f/forsyth/zstash/tests/test_globus_auth_try${try_num}
+# Running from Compy:
+# path_to_repo = /qfs/people/fors729/ez/zstash
+# dst_dir= /qfs/people/fors729/zstash/tests/test_globus_auth_try${try_num}
+
+# Step 3. Run the test cases for each endpoint. 
+# Do once: https://app.globus.org/file-manager?two_pane=true > For "Collection", select the endpoint for the machine you're on, and authenticate if needed.
+# For each line below:
+# A. Uncomment the appropriate line
+# B. https://app.globus.org/file-manager?two_pane=true > For "Collection", select the dst_endpoint name, and authenticate if needed.
+# C. https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
+# D. Run the script with `./globus_auth.bash`
+#  - Paste the URL into your browser
+#  - Authenticate to src_endpoint if needed.
+#  - Authenticate to dst_endpoint if needed.
+#  - Provide a label
+#  - Copy the auth code to the command line
+run_test_cases ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${dst_dir}
+run_test_cases ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${dst_dir}
+run_test_cases ${path_to_repo} NERSC_HPSS_ENDPOINT ${dst_dir}
+run_test_cases ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${dst_dir}
+run_test_cases ${path_to_repo} GLOBUS_TUTORIAL_COLLECTION_1_ENDPOINT ${dst_dir}
+

From 29f3ff2951ac2ed6ee3b718cdfa93ddb0f81b969 Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Thu, 23 Oct 2025 17:53:43 -0500
Subject: [PATCH 2/8] Chrysalis tests pass

---
 .../bash_tests/run_from_any/globus_auth.bash  | 40 ++++++++++---------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/tests/integration/bash_tests/run_from_any/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
index 21725c5a..422e9828 100755
--- a/tests/integration/bash_tests/run_from_any/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -160,20 +160,21 @@ run_test_cases()
 
 # Step 1. Update try_num for each new test run to avoid conflicts with previous runs.
 # Alternative: Remove previous test directories manually.
-try_num=16
+try_num=17
 
 # Step 2. Set paths for your environment by uncommenting the appropriate lines.
-# Running from Chrysalis:
-path_to_repo = /home/ac.forsyth2/ez/zstash/
-dst_dir = /home/ac.forsyth2/zstash/tests/test_globus_auth_try${try_num}
-# Running from Perlmutter:
-# path_to_repo = /global/homes/f/forsyth/ez/zstash
-# dst_dir = global/homes/f/forsyth/zstash/tests/test_globus_auth_try${try_num}
-# Running from Compy:
-# path_to_repo = /qfs/people/fors729/ez/zstash
-# dst_dir= /qfs/people/fors729/zstash/tests/test_globus_auth_try${try_num}
-
-# Step 3. Run the test cases for each endpoint. 
+# Ordered by: Chrysalis, Perlmutter, Compy
+# Running from:
+path_to_repo=/home/ac.forsyth2/ez/zstash/
+# path_to_repo=/global/homes/f/forsyth/ez/zstash
+# path_to_repo=/qfs/people/fors729/ez/zstash
+# Archiving to:
+chrysalis_dst_dir=/home/ac.forsyth2/zstash_tests/test_globus_auth_try${try_num}
+perlmutter_dst_dir=/global/homes/f/forsyth/zstash_tests/test_globus_auth_try${try_num}
+hpss_dst_dir=/home/f/forsyth/zstash_tests/test_globus_auth_try${try_num}
+compy_dst_dir=/compyfs/fors729/zstash_tests/test_globus_auth_try${try_num} # Using /qfs/people/fors729/ will result in permission denied
+
+# Step 3. Run the test cases for each endpoint.
 # Do once: https://app.globus.org/file-manager?two_pane=true > For "Collection", select the endpoint for the machine you're on, and authenticate if needed.
 # For each line below:
 # A. Uncomment the appropriate line
@@ -185,9 +186,12 @@ dst_dir = /home/ac.forsyth2/zstash/tests/test_globus_auth_try${try_num}
 #  - Authenticate to dst_endpoint if needed.
 #  - Provide a label
 #  - Copy the auth code to the command line
-run_test_cases ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${dst_dir}
-run_test_cases ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${dst_dir}
-run_test_cases ${path_to_repo} NERSC_HPSS_ENDPOINT ${dst_dir}
-run_test_cases ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${dst_dir}
-run_test_cases ${path_to_repo} GLOBUS_TUTORIAL_COLLECTION_1_ENDPOINT ${dst_dir}
-
+#  - If the test hangs: check https://app.globus.org/activity for errors.
+#  - If you have to paste an auth code more than once, that counts as an error.
+# E. Cleanup
+#  - Re-comment the line
+#  - `rm -rf ../../../utils/globus_auth` to remove test directories
+run_test_cases ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${chrysalis_dst_dir}
+# run_test_cases ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+# run_test_cases ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
+# run_test_cases ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}

From b5cc002434d51cd7d9f417c8a642186125a00203 Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Thu, 23 Oct 2025 19:45:41 -0500
Subject: [PATCH 3/8] Explain error causes and add tests

---
 .../bash_tests/run_from_any/globus_auth.bash  | 116 ++++++++++++++++--
 zstash/globus_utils.py                        |  37 ++++--
 2 files changed, 136 insertions(+), 17 deletions(-)

diff --git a/tests/integration/bash_tests/run_from_any/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
index 422e9828..6cba4362 100755
--- a/tests/integration/bash_tests/run_from_any/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -21,7 +21,7 @@ check_log_does_not_have()
     fi
 }
 
-# Running #####################################################################
+# Helper functions ############################################################
 setup()
 {
   echo "##########################################################################################################"
@@ -75,7 +75,8 @@ get_endpoint()
     esac
 }
 
-run_test_cases()
+# Tests #######################################################################
+test_single_auth_code()
 {
     local path_to_repo=$1
     local dst_endpoint=$2
@@ -95,7 +96,7 @@ run_test_cases()
     rm -rf ${INI_PATH}
     rm -rf ${TOKEN_FILE}
 
-    echo "Running globus_auth test"
+    echo "Running test_single_auth_code"
     echo "Exit codes: 0 -- success, 1 -- zstash failed, 2 -- grep check failed"
 
     case_name="run1"
@@ -155,12 +156,97 @@ run_test_cases()
     # Could also test -l and -v options, but the above code covers the important part.
 }
 
+test_different_endpoint1()
+{
+    local path_to_repo=$1
+    local dst_endpoint=$2
+    local dst_dir=$3
+
+    src_dir=${path_to_repo}/tests/utils/globus_auth
+    mkdir -p ${src_dir}
+    dst_endpoint_uuid=$(get_endpoint ${dst_endpoint})
+    globus_path=globus://${dst_endpoint_uuid}/${dst_dir}
+
+    echo "Running test_different_endpoint1"
+    echo "Exit codes: 0 -- success, 1 -- failure"
+
+    case_name="different_endpoint1"
+    setup ${case_name} "${src_dir}"
+    # Expecting to see exactly 1 authentication prompt
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    check_log_has "INFO: Found stored refresh token - using it" ${case_name}.log
+    check_log_has "ERROR: One possible cause" ${case_name}.log
+    check_log_has "ERROR: Try deleting" ${case_name}.log
+    check_log_has "ERROR: Another possible cause" ${case_name}.log
+    check_log_has "ERROR: try revoking consents before re-running" ${case_name}.log
+    check_log_has "ERROR: Exception: Insufficient Globus consents" ${case_name}.log
+}
+
+test_different_endpoint2()
+{
+    local path_to_repo=$1
+    local dst_endpoint=$2
+    local dst_dir=$3
+
+    src_dir=${path_to_repo}/tests/utils/globus_auth
+    mkdir -p ${src_dir}
+    dst_endpoint_uuid=$(get_endpoint ${dst_endpoint})
+    globus_path=globus://${dst_endpoint_uuid}/${dst_dir}
+
+    echo "Running test_different_endpoint2"
+    echo "Exit codes: 0 -- success, 1 -- failure"
+
+    case_name="different_endpoint2a"
+    setup ${case_name} "${src_dir}"
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    check_log_has ".zstash_globus_tokens.json exists. We can try to load tokens from it." ${case_name}.log
+    check_log_has ".zstash_globus_tokens.json may be configured for a different Globus endpoint." ${case_name}.log
+    check_log_has "Try deleting" ${case_name}.log
+    check_log_has "globus_sdk.services.auth.errors.AuthAPIError: ('POST', 'https://auth.globus.org/v2/oauth2/token', None, 400, 'Error', 'Bad Request')" ${case_name}.log
+
+    rm -rf ~/.zstash_globus_tokens.json
+    case_name="different_endpoint2b"
+    setup ${case_name} "${src_dir}"
+    # Expecting to see exactly 1 authentication prompt
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    if [ $? != 0 ]; then
+        echo "${case_name} failed. Check ${case_name}_create.log for details."
+        exit 1
+    fi
+}
+
+test_different_endpoint3()
+{
+    local path_to_repo=$1
+    local dst_endpoint=$2
+    local dst_dir=$3
+
+    src_dir=${path_to_repo}/tests/utils/globus_auth
+    mkdir -p ${src_dir}
+    dst_endpoint_uuid=$(get_endpoint ${dst_endpoint})
+    globus_path=globus://${dst_endpoint_uuid}/${dst_dir}
+
+    echo "Running test_different_endpoint3"
+    echo "Exit codes: 0 -- success, 1 -- failure"
+
+    rm -rf ~/.zstash_globus_tokens.json
+    case_name="different_endpoint3"
+    setup ${case_name} "${src_dir}"
+    # Expecting to see exactly 1 authentication prompt
+    zstash create --hpss=${globus_path}/${case_name} zstash_demo 2>&1 | tee ${case_name}.log
+    if [ $? != 0 ]; then
+        echo "${case_name} failed. Check ${case_name}_create.log for details."
+        exit 1
+    fi
+
+}
+
 # Follow these directions #####################################################
 # Modify these parameters as needed.
 
 # Step 1. Update try_num for each new test run to avoid conflicts with previous runs.
 # Alternative: Remove previous test directories manually.
-try_num=17
+try_num=18
 
 # Step 2. Set paths for your environment by uncommenting the appropriate lines.
 # Ordered by: Chrysalis, Perlmutter, Compy
@@ -191,7 +277,21 @@ compy_dst_dir=/compyfs/fors729/zstash_tests/test_globus_auth_try${try_num} # Usi
 # E. Cleanup
 #  - Re-comment the line
 #  - `rm -rf ../../../utils/globus_auth` to remove test directories
-run_test_cases ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${chrysalis_dst_dir}
-# run_test_cases ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
-# run_test_cases ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
-# run_test_cases ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}
+# test_single_auth_code ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${chrysalis_dst_dir}
+# test_single_auth_code ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+# test_single_auth_code ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
+# test_single_auth_code ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}
+
+# Step 4. Now, some follow-up tests
+
+# Make sure you use a different endpoint than the last one tested above.
+# Uncomment, run (expecting no auth codes to paste), re-comment:
+# test_different_endpoint1 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+
+# Reset consents again: https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
+# Uncomment, run (expecting 1 auth code to paste), re-comment:
+# test_different_endpoint2 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+
+# Uncomment, run (expecting 1 auth code to paste), re-comment:
+test_different_endpoint3 ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
+# Check https://auth.globus.org/v2/web/consents: you should have *two* consents there now.
diff --git a/zstash/globus_utils.py b/zstash/globus_utils.py
index f93c2a3e..cdcb8595 100644
--- a/zstash/globus_utils.py
+++ b/zstash/globus_utils.py
@@ -17,6 +17,7 @@
     TransferData,
 )
 from globus_sdk.response import GlobusHTTPResponse
+from globus_sdk.services.auth.errors import AuthAPIError
 
 from .settings import logger
 
@@ -134,11 +135,19 @@ def get_transfer_client_with_auth(
             logger.info("Found stored refresh token - using it")
             # Create a simple auth client for the RefreshTokenAuthorizer
             auth_client = NativeAppAuthClient(ZSTASH_CLIENT_ID)
-            transfer_authorizer = RefreshTokenAuthorizer(
-                refresh_token=token_data["refresh_token"], auth_client=auth_client
-            )
-            transfer_client = TransferClient(authorizer=transfer_authorizer)
-            return transfer_client
+            try:
+                transfer_authorizer = RefreshTokenAuthorizer(
+                    refresh_token=token_data["refresh_token"], auth_client=auth_client
+                )
+                transfer_client = TransferClient(authorizer=transfer_authorizer)
+                return transfer_client
+            except AuthAPIError as e:
+                logger.error("Stored refresh token is invalid.")
+                logger.error(
+                    f"One possible cause: {TOKEN_FILE} may be configured for a different Globus endpoint. For example, you may have previously set a different destination endpoint for `--hpss=globus://`."
+                )
+                logger.error("Try deleting {TOKEN_FILE} and re-running.")
+                raise e
 
     # No stored tokens, need to authenticate
     logger.info("No stored tokens found - starting authentication")
@@ -262,12 +271,22 @@ def submit_transfer_with_checks(transfer_client, transfer_data) -> GlobusHTTPRes
             logger.error(
                 "With proper scope handling, this block should not be reached."
             )
+
+            logger.error(
+                f"One possible cause: {TOKEN_FILE} may be configured for a different Globus endpoint. For example, you may have previously set a different destination endpoint for `--hpss=globus://`."
+            )
+            logger.error("Try deleting {TOKEN_FILE} and re-running.")
+
+            logger.error(
+                "Another possible cause: insufficient Globus consents. It's possible the consent on https://auth.globus.org/v2/web/consents is for a different destination endpoint."
+            )
+            logger.error(
+                "If you don't need any other Globus consents at the moment, try revoking consents before re-running: https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
+            )
             logger.error(
-                "Please report this bug at https://github.com/E3SM-Project/zstash/issues, with details of what you were trying to do."
+                "If neither of those work, please report this bug at https://github.com/E3SM-Project/zstash/issues, with details of what you were trying to do."
             )
-            raise RuntimeError(
-                "Insufficient Globus consents - please report this bug"
-            ) from err
+            raise RuntimeError("Insufficient Globus consents") from err
         else:
             raise err
     return task

From e30c10835df9a9c25bc0918318e89cd3fe341dbd Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Thu, 23 Oct 2025 21:26:19 -0500
Subject: [PATCH 4/8] Make test more usable

---
 tests/README.md                               |  32 +---
 .../bash_tests/run_from_any/globus_auth.bash  | 161 ++++++++++++------
 2 files changed, 117 insertions(+), 76 deletions(-)

diff --git a/tests/README.md b/tests/README.md
index 72af6ddd..6af9db2d 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -15,7 +15,9 @@ tests/
   utils/ # Utilities for testing
 ```
 
-## Testing example for Perlmutter
+## Testing examples
+
+### Machine Independent
 
 ```bash
 rm -rf build
@@ -35,8 +37,12 @@ python -m unittest tests/integration/python_tests/group_by_workflow/test_*.py
 
 cd tests/integration/bash_tests/run_from_any/
 # Review the directions at the bottom of globus_auth.bash
-# You will need to modify the file and run several times.
+# Run `./globus_auth.bash` with the appropriate parameters.
+```
+
+### Perlmutter-specific
 
+```bash
 cd tests/integration/bash_tests/run_from_perlmutter/
 time ./follow_symlinks.sh # NOTE: you will have to change out paths for your username
 # real	0m31.851s
@@ -52,29 +58,9 @@ time ./test_ls_globus.bash
 # No errors
 ```
 
-## Testing example for Chrysalis
+### Chrysalis-specific
 
 ```bash
-rm -rf build
-conda clean --all --y
-conda env create -f conda/dev.yml -n zstash_dev_20251017_test1
-conda activate zstash_dev_20251017_test1
-pre-commit run --all-files
-python -m pip install .
-pytest tests/unit/test_*.py
-# 1 passed in 0.84s
-python -m unittest tests/integration/python_tests/group_by_command/test_*.py
-# Ran 69 tests in 110.139s
-# OK (skipped=32)
-# NOTE: Some tests are skipped because Chrysalis doesn't have direct `hsi`/HPSS access
-python -m unittest tests/integration/python_tests/group_by_workflow/test_*.py
-# Ran 4 tests in 6.889s
-# OK
-
-cd tests/integration/bash_tests/run_from_any/
-# Review the directions at the bottom of globus_auth.bash
-# You will need to modify the file and run several times.
-
 cd tests/integration/bash_tests/run_from_chrysalis/
 # If not done above, do the following:
 # Log into globus.org
diff --git a/tests/integration/bash_tests/run_from_any/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
index 6cba4362..e45ee0de 100755
--- a/tests/integration/bash_tests/run_from_any/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -75,6 +75,12 @@ get_endpoint()
     esac
 }
 
+confirm() {
+    read -p "$1 (y/n): " -n 1 -r
+    echo
+    [[ $REPLY =~ ^[Yy]$ ]]
+}
+
 # Tests #######################################################################
 test_single_auth_code()
 {
@@ -92,6 +98,11 @@ test_single_auth_code()
     TOKEN_FILE=${HOME}/.zstash_globus_tokens.json
 
     # Start fresh
+    echo "Reset Globus consents:"
+    echo "https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring > rescind all"
+    if ! confirm "Have you revoked Globus consents?"; then
+        exit 1
+    fi
     rm -rf ${GLOBUS_CFG}
     rm -rf ${INI_PATH}
     rm -rf ${TOKEN_FILE}
@@ -154,6 +165,14 @@ test_single_auth_code()
     check_log_has "dir/file0.txt" run2_ls.log
     check_log_has "empty_dir" run2_ls.log
     # Could also test -l and -v options, but the above code covers the important part.
+
+    if ! confirm "Did you only have to paste an auth code once (for run1, not run2)?"; then
+        echo "Single-authentication test failed"
+        exit 1
+    fi
+    # Cleanup:
+    cd ${path_to_repo}/tests/integration/bash_tests/run_from_any
+    rm -rf ${path_to_repo}/tests/utils/globus_auth
 }
 
 test_different_endpoint1()
@@ -178,8 +197,16 @@ test_different_endpoint1()
     check_log_has "ERROR: One possible cause" ${case_name}.log
     check_log_has "ERROR: Try deleting" ${case_name}.log
     check_log_has "ERROR: Another possible cause" ${case_name}.log
-    check_log_has "ERROR: try revoking consents before re-running" ${case_name}.log
+    check_log_has "try revoking consents before re-running" ${case_name}.log
     check_log_has "ERROR: Exception: Insufficient Globus consents" ${case_name}.log
+
+    if ! confirm "Did you avoid having to paste any auth codes on this run?"; then
+        echo "test_different_endpoint1 failed"
+        exit 1
+    fi
+    # Cleanup:
+    cd ${path_to_repo}/tests/integration/bash_tests/run_from_any
+    rm -rf ${path_to_repo}/tests/utils/globus_auth
 }
 
 test_different_endpoint2()
@@ -193,6 +220,12 @@ test_different_endpoint2()
     dst_endpoint_uuid=$(get_endpoint ${dst_endpoint})
     globus_path=globus://${dst_endpoint_uuid}/${dst_dir}
 
+    echo "Reset Globus consents:"
+    echo "https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring > rescind all"
+    if ! confirm "Have you revoked Globus consents?"; then
+        exit 1
+    fi
+
     echo "Running test_different_endpoint2"
     echo "Exit codes: 0 -- success, 1 -- failure"
 
@@ -213,6 +246,14 @@ test_different_endpoint2()
         echo "${case_name} failed. Check ${case_name}_create.log for details."
         exit 1
     fi
+
+    if ! confirm "Did you only have to paste an auth code once (for 2b, not 2a)?"; then
+        echo "test_different_endpoint2 failed"
+        exit 1
+    fi
+    # Cleanup:
+    cd ${path_to_repo}/tests/integration/bash_tests/run_from_any
+    rm -rf ${path_to_repo}/tests/utils/globus_auth
 }
 
 test_different_endpoint3()
@@ -239,59 +280,73 @@ test_different_endpoint3()
         exit 1
     fi
 
+    if ! confirm "Did you only have to paste an auth code once?"; then
+        echo "test_different_endpoint2 failed"
+        exit 1
+    fi
+    # Cleanup:
+    cd ${path_to_repo}/tests/integration/bash_tests/run_from_any
+    rm -rf ${path_to_repo}/tests/utils/globus_auth
 }
 
 # Follow these directions #####################################################
-# Modify these parameters as needed.
-
-# Step 1. Update try_num for each new test run to avoid conflicts with previous runs.
-# Alternative: Remove previous test directories manually.
-try_num=18
-
-# Step 2. Set paths for your environment by uncommenting the appropriate lines.
-# Ordered by: Chrysalis, Perlmutter, Compy
-# Running from:
-path_to_repo=/home/ac.forsyth2/ez/zstash/
-# path_to_repo=/global/homes/f/forsyth/ez/zstash
-# path_to_repo=/qfs/people/fors729/ez/zstash
-# Archiving to:
-chrysalis_dst_dir=/home/ac.forsyth2/zstash_tests/test_globus_auth_try${try_num}
-perlmutter_dst_dir=/global/homes/f/forsyth/zstash_tests/test_globus_auth_try${try_num}
-hpss_dst_dir=/home/f/forsyth/zstash_tests/test_globus_auth_try${try_num}
-compy_dst_dir=/compyfs/fors729/zstash_tests/test_globus_auth_try${try_num} # Using /qfs/people/fors729/ will result in permission denied
-
-# Step 3. Run the test cases for each endpoint.
-# Do once: https://app.globus.org/file-manager?two_pane=true > For "Collection", select the endpoint for the machine you're on, and authenticate if needed.
-# For each line below:
-# A. Uncomment the appropriate line
-# B. https://app.globus.org/file-manager?two_pane=true > For "Collection", select the dst_endpoint name, and authenticate if needed.
-# C. https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
-# D. Run the script with `./globus_auth.bash`
-#  - Paste the URL into your browser
-#  - Authenticate to src_endpoint if needed.
-#  - Authenticate to dst_endpoint if needed.
-#  - Provide a label
-#  - Copy the auth code to the command line
-#  - If the test hangs: check https://app.globus.org/activity for errors.
-#  - If you have to paste an auth code more than once, that counts as an error.
-# E. Cleanup
-#  - Re-comment the line
-#  - `rm -rf ../../../utils/globus_auth` to remove test directories
-# test_single_auth_code ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${chrysalis_dst_dir}
-# test_single_auth_code ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
-# test_single_auth_code ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
-# test_single_auth_code ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}
-
-# Step 4. Now, some follow-up tests
-
-# Make sure you use a different endpoint than the last one tested above.
-# Uncomment, run (expecting no auth codes to paste), re-comment:
-# test_different_endpoint1 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
-
-# Reset consents again: https://auth.globus.org/v2/web/consents > Manage Your Consents > Globus Endpoint Performance Monitoring > rescind all"
-# Uncomment, run (expecting 1 auth code to paste), re-comment:
-# test_different_endpoint2 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
-
-# Uncomment, run (expecting 1 auth code to paste), re-comment:
+
+# Example usage:
+# ./globus_auth.bash 21 /home/ac.forsyth2/ez/zstash /home/ac.forsyth2/zstash_tests /global/homes/f/forsyth/zstash_tests /home/f/forsyth/zstash_tests /compyfs/fors729/zstash_tests
+
+# Command line parameters:
+try_num="$1"
+path_to_repo="$2" # /home/ac.forsyth2/ez/zstash, /global/homes/f/forsyth/ez/zstash, /qfs/people/fors729/ez/zstash
+chrysalis_dst_basedir="$3" # /home/ac.forsyth2/zstash_tests
+perlmutter_dst_basedir="$4" # /global/homes/f/forsyth/zstash_tests
+hpss_dst_basedir="$5" # /home/f/forsyth/zstash_tests
+compy_dst_basedir="$6" # /compyfs/fors729/zstash_tests (/qfs/people/fors729/ => permission denied)
+
+echo "You may wish to clear your dst directories for a fresh start:"
+echo "Chrysalis: rm -rf ${chrysalis_dst_basedir}/test_globus_auth*"
+echo "Perlmutter: rm -rf ${perlmutter_dst_basedir}/test_globus_auth*"
+echo "Compy: rm -rf ${compy_dst_basedir}/test_globus_auth*"
+echo "This won't work on HPSS, because -rf flags are unsupported:"
+echo "NERSC HPSS: rm -rf ${hpss_dst_basedir}/test_globus_auth*"
+echo ""
+echo "It is therefore advisable to just increment a 'try number' to avoid directory conflicts."
+echo "Currently, try_num=${try_num}"
+if ! confirm "Is the try_num correct?"; then
+    exit 1
+fi
+
+chrysalis_dst_dir=${chrysalis_dst_basedir}/test_globus_auth_try${try_num}
+perlmutter_dst_dir=${perlmutter_dst_basedir}/test_globus_auth_try${try_num}
+hpss_dst_dir=${hpss_dst_basedir}/test_globus_auth_try${try_num}
+compy_dst_dir=${compy_dst_basedir}/test_globus_auth_try${try_num}
+
+echo "Go to https://app.globus.org/file-manager?two_pane=true > For "Collection", choose each of the following endpoints and, if needed, authenticate:"
+echo "LCRC Improv DTN, NERSC Perlmutter, NERSC HPSS, pic#compy-dtn"
+if ! confirm "Have you authenticated into all endpoints?"; then
+    exit 1
+fi
+
+echo "Primary tests: single authentication code tests for each endpoint"
+echo "If a test hangs, check if https://app.globus.org/activity reports any errors on your transfers."
+echo "Testing transfer to LCRC Improv DTN ####################################"
+test_single_auth_code ${path_to_repo} LCRC_IMPROV_DTN_ENDPOINT ${chrysalis_dst_dir}
+echo "Testing transfer to NERSC Perlmutter ###################################"
+test_single_auth_code ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+echo "Testing transfer to NERSC HPSS #########################################"
+test_single_auth_code ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
+echo "Testing transfer to pic#compy-dtn ######################################"
+test_single_auth_code ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}
+
+echo "Follow-up tests: behavior when switching to different endpoints"
+echo "NOTE: if you commented out tests above, and your last endpoint used was NERSC_PERLMUTTER_ENDPOINT, the following test will not work properly."
+echo "Test 1: What if we switch to a different endpoint? #####################"
+test_different_endpoint1 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+echo "Test 2: What if we try a) revoking consents and then b) removing the token file? ###"
+test_different_endpoint2 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+echo "Test 3: What if we switch to a different endpoint again, but first remove the token file? ###"
 test_different_endpoint3 ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
-# Check https://auth.globus.org/v2/web/consents: you should have *two* consents there now.
+echo "Check https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring: you should have *two* consents there now."
+if ! confirm "Does https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring show *two* consents?"; then
+    exit 1
+fi
+echo "All globus_auth tests completed successfully."

From a66e101cf3768d6956acc90b05ff8bf44b25f296 Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Thu, 23 Oct 2025 19:39:17 -0700
Subject: [PATCH 5/8] Fix test_ls_globus

---
 tests/README.md                                              | 5 +++--
 .../bash_tests/run_from_perlmutter/test_ls_globus.bash       | 3 +++
 zstash/globus_utils.py                                       | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/tests/README.md b/tests/README.md
index 6af9db2d..f0ee1c68 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -31,6 +31,7 @@ pytest tests/unit/test_*.py
 python -m unittest tests/integration/python_tests/group_by_command/test_*.py
 # Ran 69 tests in 327.570s
 # OK
+# NOTE: Some tests will be skipped on systems without hsi/HPSS access
 python -m unittest tests/integration/python_tests/group_by_workflow/test_*.py
 # Ran 4 tests in 2.666s
 # OK
@@ -53,8 +54,8 @@ time ./test_update_non_empty_hpss.bash
 
 # Log into globus.org
 # Log into endpoints (NERSC Perlmutter, Globus Tutorial Collection 1) at globus.org: File Manager > Add the endpoints in the "Collection" fields
-time ./test_ls_globus.bash
-# real	0m26.930s
+time ./test_ls_globus.bash # NOTE: You may be asked to paste an auth-code
+# real	0m40.297s
 # No errors
 ```
 
diff --git a/tests/integration/bash_tests/run_from_perlmutter/test_ls_globus.bash b/tests/integration/bash_tests/run_from_perlmutter/test_ls_globus.bash
index 2315a2a2..62ddd923 100755
--- a/tests/integration/bash_tests/run_from_perlmutter/test_ls_globus.bash
+++ b/tests/integration/bash_tests/run_from_perlmutter/test_ls_globus.bash
@@ -4,6 +4,9 @@ hpss_globus_endpoint="6c54cade-bde5-45c1-bdea-f4bd71dba2cc"
 hpss_path="globus://${hpss_globus_endpoint}/~/zstash_test/"
 cache=zstash # Set via `self.cache = "zstash"`
 
+# Start fresh by deleting token file:
+rm ~/.zstash_globus_tokens.json
+
 # From Claude:
 check_log_has()
 {
diff --git a/zstash/globus_utils.py b/zstash/globus_utils.py
index cdcb8595..e5346f69 100644
--- a/zstash/globus_utils.py
+++ b/zstash/globus_utils.py
@@ -146,7 +146,7 @@ def get_transfer_client_with_auth(
                 logger.error(
                     f"One possible cause: {TOKEN_FILE} may be configured for a different Globus endpoint. For example, you may have previously set a different destination endpoint for `--hpss=globus://`."
                 )
-                logger.error("Try deleting {TOKEN_FILE} and re-running.")
+                logger.error(f"Try deleting {TOKEN_FILE} and re-running.")
                 raise e
 
     # No stored tokens, need to authenticate
@@ -275,7 +275,7 @@ def submit_transfer_with_checks(transfer_client, transfer_data) -> GlobusHTTPRes
             logger.error(
                 f"One possible cause: {TOKEN_FILE} may be configured for a different Globus endpoint. For example, you may have previously set a different destination endpoint for `--hpss=globus://`."
             )
-            logger.error("Try deleting {TOKEN_FILE} and re-running.")
+            logger.error(f"Try deleting {TOKEN_FILE} and re-running.")
 
             logger.error(
                 "Another possible cause: insufficient Globus consents. It's possible the consent on https://auth.globus.org/v2/web/consents is for a different destination endpoint."

From 1eb3ad49257d81d37e8463c691aaff43d891ceb3 Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Fri, 24 Oct 2025 14:25:46 -0500
Subject: [PATCH 6/8] Chrysalis fixes

---
 tests/README.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tests/README.md b/tests/README.md
index f0ee1c68..1b644ca9 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -67,7 +67,16 @@ cd tests/integration/bash_tests/run_from_chrysalis/
 # Log into globus.org
 # Log into endpoints (LCRC Improv DTN, NERSC Perlmutter) at globus.org: File Manager > Add the endpoints in the "Collection" fields
 
-# In all cases, do:
+# Reset completely:
+# Revoke consents: https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring > rescind all
+# Run the following lines to set up the database_corruption test
+# Alternative option: Rerun the `test_single_auth_code ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}` line from `globus_auth.bash`
+rm ~/.zstash_globus_tokens.json
+mkdir zstash_demo; echo 'file0 stuff' > zstash_demo/file0.txt
+# NERSC_PERLMUTTER_ENDPOINT=6bdc7956-fc0f-4ad2-989c-7aa5ee643a79
+zstash create --hpss=globus://6bdc7956-fc0f-4ad2-989c-7aa5ee643a79//global/homes/f/forsyth/zstash/tests/test_database_corruption_setup23 zstash_demo
+# You'll have to paste an auth code here, but NOT during the database_corruption test.
+rm -rf zstash_demo/
 # Then, increment `try_num` below to avoid using an old directory.
 # Alternatively, start fresh by deleting the directory on Perlmutter:
 # `rm -rf /global/homes/f/forsyth/zstash/tests/test_database_corruption_try{try_num}`

From 37a20035f71ce7164ddb5307ddb9bb04805899fc Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Fri, 24 Oct 2025 14:14:08 -0700
Subject: [PATCH 7/8] Perlmutter fixes

---
 .../bash_tests/run_from_any/globus_auth.bash  | 59 ++++++++++++++-----
 1 file changed, 44 insertions(+), 15 deletions(-)

diff --git a/tests/integration/bash_tests/run_from_any/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
index e45ee0de..a2945da7 100755
--- a/tests/integration/bash_tests/run_from_any/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -125,7 +125,7 @@ test_single_auth_code()
     check_log_has "INFO: Token file ${TOKEN_FILE} does NOT exist. This means we won't be able to load tokens from it." ${case_name}.log
     # From get_local_endpoint_id
     check_log_has "INFO: Writing to empty ${INI_PATH}" ${case_name}.log
-    check_log_has "INFO: Setting local_endpoint_id based on FQDN chrlogin2.lcrc.anl.gov:" ${case_name}.log
+    check_log_has "INFO: Setting local_endpoint_id based on" ${case_name}.log
     # From get_transfer_client_with_auth
     check_log_has "INFO: No stored tokens found - starting authentication" ${case_name}.log
     check_log_has "Please go to this URL and login:" ${case_name}.log # Our one expected authentication prompt
@@ -148,7 +148,7 @@ test_single_auth_code()
     check_log_has "INFO: Token file ${TOKEN_FILE} exists. We can try to load tokens from it." ${case_name}.log # Differs from run1
     # From get_local_endpoint_id
     check_log_has "INFO: Setting local_endpoint_id based on ${INI_PATH}" ${case_name}.log # Differs from run1
-    check_log_has "INFO: Setting local_endpoint_id based on FQDN chrlogin2.lcrc.anl.gov:" ${case_name}.log
+    check_log_has "INFO: Setting local_endpoint_id based on" ${case_name}.log
     # From get_transfer_client_with_auth
     check_log_has "INFO: Found stored refresh token - using it" ${case_name}.log # Differs from run1
     check_log_does_not_have "Please go to this URL and login:" ${case_name}.log # There should be no login prompts for run2!
@@ -296,11 +296,45 @@ test_different_endpoint3()
 
 # Command line parameters:
 try_num="$1"
-path_to_repo="$2" # /home/ac.forsyth2/ez/zstash, /global/homes/f/forsyth/ez/zstash, /qfs/people/fors729/ez/zstash
-chrysalis_dst_basedir="$3" # /home/ac.forsyth2/zstash_tests
-perlmutter_dst_basedir="$4" # /global/homes/f/forsyth/zstash_tests
-hpss_dst_basedir="$5" # /home/f/forsyth/zstash_tests
-compy_dst_basedir="$6" # /compyfs/fors729/zstash_tests (/qfs/people/fors729/ => permission denied)
+src_machine="$2" # chrysalis, perlmutter, compy
+path_to_repo="$3" # /home/ac.forsyth2/ez/zstash, /global/homes/f/forsyth/ez/zstash, /qfs/people/fors729/ez/zstash
+chrysalis_dst_basedir="$4" # /home/ac.forsyth2/zstash_tests
+perlmutter_dst_basedir="$5" # /global/homes/f/forsyth/zstash_tests
+hpss_dst_basedir="$6" # /home/f/forsyth/zstash_tests
+compy_dst_basedir="$7" # /compyfs/fors729/zstash_tests (/qfs/people/fors729/ => permission denied)
+
+chrysalis_dst_dir=${chrysalis_dst_basedir}/test_globus_auth_try${try_num}
+perlmutter_dst_dir=${perlmutter_dst_basedir}/test_globus_auth_try${try_num}
+hpss_dst_dir=${hpss_dst_basedir}/test_globus_auth_try${try_num}
+compy_dst_dir=${compy_dst_basedir}/test_globus_auth_try${try_num}
+
+# Determine which endpoints to use for the endpoint-switching tests
+# switch1 should never be the last-tested endpoint (i.e., compy)
+# Neither switch1 nor switch2 should be the src endpoint.
+case ${src_machine} in
+    chrysalis)
+        dst_endpoint_switch1=NERSC_PERLMUTTER_ENDPOINT
+        dst_endpoint_switch2=NERSC_HPSS_ENDPOINT
+        dst_dir_switch1=${perlmutter_dst_dir}
+        dst_dir_switch2=${hpss_dst_dir}
+        ;;
+    perlmutter)
+        dst_endpoint_switch1=LCRC_IMPROV_DTN_ENDPOINT
+        dst_endpoint_switch2=PIC_COMPY_DTN_ENDPOINT
+        dst_dir_switch1=${chrysalis_dst_dir}
+        dst_dir_switch2=${compy_dst_dir}
+        ;;
+    compy)
+        dst_endpoint_switch1=NERSC_PERLMUTTER_ENDPOINT
+        dst_endpoint_switch2=NERSC_HPSS_ENDPOINT
+        dst_dir_switch1=${perlmutter_dst_dir}
+        dst_dir_switch2=${hpss_dst_dir}
+        ;;
+    *)
+        echo "Unknown machine name: ${src_machine}" >&2
+        exit 1
+        ;;
+esac
 
 echo "You may wish to clear your dst directories for a fresh start:"
 echo "Chrysalis: rm -rf ${chrysalis_dst_basedir}/test_globus_auth*"
@@ -315,11 +349,6 @@ if ! confirm "Is the try_num correct?"; then
     exit 1
 fi
 
-chrysalis_dst_dir=${chrysalis_dst_basedir}/test_globus_auth_try${try_num}
-perlmutter_dst_dir=${perlmutter_dst_basedir}/test_globus_auth_try${try_num}
-hpss_dst_dir=${hpss_dst_basedir}/test_globus_auth_try${try_num}
-compy_dst_dir=${compy_dst_basedir}/test_globus_auth_try${try_num}
-
 echo "Go to https://app.globus.org/file-manager?two_pane=true > For "Collection", choose each of the following endpoints and, if needed, authenticate:"
 echo "LCRC Improv DTN, NERSC Perlmutter, NERSC HPSS, pic#compy-dtn"
 if ! confirm "Have you authenticated into all endpoints?"; then
@@ -340,11 +369,11 @@ test_single_auth_code ${path_to_repo} PIC_COMPY_DTN_ENDPOINT ${compy_dst_dir}
 echo "Follow-up tests: behavior when switching to different endpoints"
 echo "NOTE: if you commented out tests above, and your last endpoint used was NERSC_PERLMUTTER_ENDPOINT, the following test will not work properly."
 echo "Test 1: What if we switch to a different endpoint? #####################"
-test_different_endpoint1 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+test_different_endpoint1 ${path_to_repo} ${dst_endpoint_switch1} ${dst_dir_switch1}
 echo "Test 2: What if we try a) revoking consents and then b) removing the token file? ###"
-test_different_endpoint2 ${path_to_repo} NERSC_PERLMUTTER_ENDPOINT ${perlmutter_dst_dir}
+test_different_endpoint2 ${path_to_repo} ${dst_endpoint_switch1} ${dst_dir_switch1}
 echo "Test 3: What if we switch to a different endpoint again, but first remove the token file? ###"
-test_different_endpoint3 ${path_to_repo} NERSC_HPSS_ENDPOINT ${hpss_dst_dir}
+test_different_endpoint3 ${path_to_repo} ${dst_endpoint_switch2} ${dst_dir_switch2}
 echo "Check https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring: you should have *two* consents there now."
 if ! confirm "Does https://auth.globus.org/v2/web/consents > Globus Endpoint Performance Monitoring show *two* consents?"; then
     exit 1

From b9322253cbf84011858d662f5c1adac0e4bbfe4c Mon Sep 17 00:00:00 2001
From: Ryan Forsyth <forsyth2@llnl.gov>
Date: Fri, 24 Oct 2025 15:04:02 -0700
Subject: [PATCH 8/8] Compy fixes

---
 tests/integration/bash_tests/run_from_any/globus_auth.bash | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/integration/bash_tests/run_from_any/globus_auth.bash b/tests/integration/bash_tests/run_from_any/globus_auth.bash
index a2945da7..94998c42 100755
--- a/tests/integration/bash_tests/run_from_any/globus_auth.bash
+++ b/tests/integration/bash_tests/run_from_any/globus_auth.bash
@@ -292,7 +292,10 @@ test_different_endpoint3()
 # Follow these directions #####################################################
 
 # Example usage:
-# ./globus_auth.bash 21 /home/ac.forsyth2/ez/zstash /home/ac.forsyth2/zstash_tests /global/homes/f/forsyth/zstash_tests /home/f/forsyth/zstash_tests /compyfs/fors729/zstash_tests
+# ./globus_auth.bash 21 chrysalis /home/ac.forsyth2/ez/zstash /home/ac.forsyth2/zstash_tests /global/homes/f/forsyth/zstash_tests /home/f/forsyth/zstash_tests /compyfs/fors729/zstash_tests
+
+# NOTE: This test will not work from a repo on Compy located in /qfs/people/...
+# pic#compy-dtn will only transfer to/from /compyfs/...
 
 # Command line parameters:
 try_num="$1"