1

src/services/apiClient.test.ts

@@ -8,6 +8,7 @@ import {
   fetchWithApiAuth,
   getStoredAccessToken,
   isTimeoutError,
+  refreshStoredAccessToken,
   requestJson,
   setStoredAccessToken,
 } from './apiClient';
@@ -312,6 +313,27 @@ describe('apiClient', () => {
     expect(getStoredAccessToken()).toBe('still-valid-token');
   });
 
+  it('keeps local token when explicit refresh opts out of clearing on failure', async () => {
+    setStoredAccessToken('usable-local-token', { emit: false });
+    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+
+    await expect(
+      refreshStoredAccessToken({ clearOnFailure: false }),
+    ).rejects.toMatchObject({
+      status: 401,
+    });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/auth/refresh',
+      expect.objectContaining({
+        method: 'POST',
+        credentials: 'same-origin',
+      }),
+    );
+    expect(dispatchEventMock).not.toHaveBeenCalled();
+    expect(getStoredAccessToken()).toBe('usable-local-token');
+  });
+
   it('keeps the refreshed token when the retried protected request is still unauthorized', async () => {
     setStoredAccessToken('expired-token', { emit: false });
     fetchMock