test: E2E ログインでトークン実効性を検証し logout 無効化窓の flake を解消 (closes #142) (#143)

Author: miya0001

CHANGELOG.md

@@ -7,6 +7,11 @@
 
 ## [Unreleased]
 
+### 2026-07-14
+- **Test**: E2E の auth 系シナリオ (whoami / auto-refresh) が間欠的に 401 で落ちる flake を修正 (#142, #143)
+  - 真因はサーバーの logout が「現在秒 +1 まで」の全トークンを無効化するため、直後 (同一壁時計秒) に正規ログインで発行された新トークンまで無効化窓に入ること。ローカルモードでは無効化レコードがインメモリ保持のため、E2E の DB クリーンアップでは除去できない
+  - `loginAs` で取得したトークンを `/me` で実効性検証し、無効化窓を跨ぐバックオフ (計 2 秒) 付きでリトライするように変更
+
 ## [0.17.0] - 2026-06-12
 
 ### 2026-06-10

tests/e2e/support/world.ts

@@ -114,11 +114,17 @@ setWorldConstructor(GdbWorld);
 
 /**
  * Internal helper: login with given credentials and write the token to CLI config.
- * Retries up to 3 times to handle race conditions where the DB was just
- * cleared and the server hasn't yet recreated users.
+ * Retries to handle two failure windows:
+ * - the DB was just cleared and the server hasn't yet recreated users
+ * - the server's logout invalidates ALL of the user's tokens issued in the
+ *   same wall-clock second (`invalidatedBefore = now + 1s`), so a token minted
+ *   right after a logout in a preceding scenario is dead on arrival even
+ *   though the login itself succeeded (#142). The token is therefore verified
+ *   against /me before being handed to the scenario; the backoff spans more
+ *   than one second so at least one attempt lands past the invalidation window.
  */
 async function loginAs(world: GdbWorld, email: string, password: string): Promise<Record<string, unknown>> {
-  const maxRetries = 3;
+  const maxRetries = 5;
   let lastError: Error | undefined;
 
   for (let attempt = 0; attempt < maxRetries; attempt++) {
@@ -142,6 +148,14 @@ async function loginAs(world: GdbWorld, email: string, password: string): Promis
         continue;
       }
 
+      const meRes = await fetch(new URL("/me", world.serverUrl).toString(), {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      if (!meRes.ok) {
+        lastError = new Error(`Fresh token rejected by /me: HTTP ${meRes.status} (token invalidation window, see #142)`);
+        continue;
+      }
+
       const profile: Record<string, unknown> = { url: world.serverUrl, token };
       if (data.refreshToken) profile.refreshToken = data.refreshToken;
       world.writeConfig({