fix: address Copilot review comments on PR #5205

- msal-config-schema: reject unparseable version instead of coercing to "null"
- HttpMockRouter: reset RegExp lastIndex so global/sticky match patterns are reusable across requests
- extract decodeJwtSegment into its own file, fix atob/UTF-8 round-trip for non-ASCII claims
- service-discovery docs: dedupe heading, close dangling code fence

Author: odinr

packages/framework/src/__tests__/mock/documented-usage.test.ts

@@ -1,5 +1,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
+import { decodeJwtSegment } from '@equinor/fusion-framework-module-msal/mock';
+
 import { init } from '../../init.js';
 import { createMockService, FrameworkMockConfigurator, mockFramework } from '../../mock/index.js';
 
@@ -71,7 +73,7 @@ describe('documented usage', () => {
     });
 
     const token = await fusion.modules.auth.acquireAccessToken();
-    const claims = JSON.parse(atob(token?.split('.')[1] ?? ''));
+    const claims = JSON.parse(decodeJwtSegment(token?.split('.')[1] ?? ''));
 
     // MsalProvider — not the mock — turns "no scopes requested" into `${clientId}/.default`
     expect(claims.scp).toBe('my-app/.default');

packages/modules/http/src/mock/HttpMockRouter.ts

@@ -22,6 +22,21 @@ interface RegisteredMiddleware {
   handler: HttpMockMiddleware;
 }
 
+/**
+ * Tests `url` against a match constraint.
+ *
+ * @remarks
+ * A `g`/`y` `RegExp` is stateful — `.test()` advances its `lastIndex`, so the
+ * same registration would match on one call and silently miss on the next.
+ * Resetting `lastIndex` first keeps a registered pattern reusable across requests.
+ */
+function matchesUrl(match: string | RegExp, url: string): boolean {
+  // A plain substring constraint has no statefulness to reset.
+  if (typeof match === 'string') return url.includes(match);
+  match.lastIndex = 0;
+  return match.test(url);
+}
+
 /**
  * Runs a chain of middleware against requests and answers them without
  * reaching the network.
@@ -161,13 +176,9 @@ export class HttpMockRouter {
       // Skip handlers registered for another HTTP method.
       if (registered.method && registered.method !== method) continue;
       // Only apply URL matching when the registration specifies a URL constraint.
-      if (registered.match !== undefined) {
-        const matched =
-          typeof registered.match === 'string'
-            ? url.includes(registered.match)
-            : registered.match.test(url);
+      if (registered.match !== undefined && !matchesUrl(registered.match, url)) {
         // Continue searching when this handler's URL constraint does not match.
-        if (!matched) continue;
+        continue;
       }
       // clone the request so one middleware reading the body (e.g. `.json()`) does not
       // exhaust it for the next middleware in the chain

packages/modules/msal/src/mock/create-mock-token.ts

@@ -66,7 +66,7 @@ const base64Url = (value: string): string => {
  * ```typescript
  * const token = createMockToken({ name: 'Test User', scp: 'Files.Read' });
  * const [, payload] = token.split('.');
- * JSON.parse(atob(payload)).name; // 'Test User'
+ * JSON.parse(decodeJwtSegment(payload)).name; // 'Test User'
  * ```
  */
 export const createMockToken = (claims: MockTokenClaims = {}): string => {

packages/modules/msal/src/mock/decode-jwt-segment.ts

@@ -0,0 +1,22 @@
+/**
+ * Decodes a base64url segment of a {@link createMockToken} JWT back to its JSON string.
+ *
+ * @remarks
+ * Plain `atob` alone mangles non-ASCII claims: it treats its output as latin1,
+ * while segments are UTF-8 encoded. This reverses that encoding and also
+ * restores the standard base64 alphabet/padding `atob` expects.
+ *
+ * @param segment - A base64url segment, e.g. from splitting a JWT on `.`.
+ * @returns The decoded UTF-8 string.
+ */
+export function decodeJwtSegment(segment: string): string {
+  const base64 = segment
+    .replace(/-/g, '+')
+    .replace(/_/g, '/')
+    .padEnd(segment.length + ((4 - (segment.length % 4)) % 4), '=');
+  const binary = atob(base64);
+  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+
+export default decodeJwtSegment;

packages/modules/msal/src/mock/index.ts

@@ -26,3 +26,4 @@ export { createMsalMockClient } from './create-msal-mock-client';
 export { MsalMockConfigurator } from './MsalMockConfigurator';
 export { enableMsalMock, msalMockModule, type AuthConfigMockFn } from './module';
 export { createMockToken, type MockTokenClaims } from './create-mock-token';
+export { decodeJwtSegment } from './decode-jwt-segment';

packages/modules/msal/src/msal-config-schema.ts

@@ -30,7 +30,16 @@ export const MsalConfigSchema = z.object({
         Object.values(CacheLookupPolicy).includes(val as CacheLookupPolicy),
     )
     .optional(),
-  version: z.string().transform((x: string) => String(semver.coerce(x))),
+  version: z.string().transform((value, ctx) => {
+    const coerced = semver.coerce(value);
+    // `semver.coerce` returns `null` for an unparseable version; without this guard it
+    // would silently become the literal string "null" instead of failing validation.
+    if (!coerced) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid MSAL module version' });
+      return z.NEVER;
+    }
+    return coerced.version;
+  }),
   telemetry: TelemetryConfigSchema,
 });
 

packages/modules/service-discovery/docs/api-reference.md

@@ -27,3 +27,4 @@ type Service = {
   overridden?: boolean; // True when session-overridden
   defaultScopes: string[]; // @deprecated — use `scopes`
 };
+```

packages/modules/service-discovery/docs/session-overrides.md

@@ -1,7 +1,5 @@
 # Session Overrides
 
-## Session Overrides
-
 > [!TIP]
 > Session overrides let you redirect services to local or staging URLs during development without touching application config.