1

src/services/apiClient.test.ts

@@ -3,6 +3,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   AUTH_STATE_EVENT,
   ApiClientError,
+  BACKGROUND_AUTH_REQUEST_OPTIONS,
   clearStoredAccessToken,
   fetchWithApiAuth,
   getStoredAccessToken,
@@ -265,6 +266,52 @@ describe('apiClient', () => {
     expect(getStoredAccessToken()).toBe('still-valid-token');
   });
 
+  it('keeps auth state untouched when local auth impact receives 401 with bearer token', async () => {
+    setStoredAccessToken('still-valid-token', { emit: false });
+    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+
+    const response = await fetchWithApiAuth(
+      '/api/profile/save-archives',
+      { method: 'GET' },
+      {
+        authImpact: 'local',
+      },
+    );
+
+    expect(response.status).toBe(401);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(dispatchEventMock).not.toHaveBeenCalled();
+    expect(getStoredAccessToken()).toBe('still-valid-token');
+  });
+
+  it('does not clear local token when background refresh fails before a request', async () => {
+    setStoredAccessToken('still-valid-token', { emit: false });
+    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+
+    const response = await fetchWithApiAuth(
+      '/api/runtime/puzzle/runs',
+      { method: 'POST' },
+      BACKGROUND_AUTH_REQUEST_OPTIONS,
+    );
+
+    expect(response.status).toBe(401);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/runtime/puzzle/runs',
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer still-valid-token',
+        }),
+      }),
+    );
+    expect(fetchMock).not.toHaveBeenCalledWith(
+      '/api/auth/refresh',
+      expect.anything(),
+    );
+    expect(dispatchEventMock).not.toHaveBeenCalled();
+    expect(getStoredAccessToken()).toBe('still-valid-token');
+  });
+
   it('keeps the refreshed token when the retried protected request is still unauthorized', async () => {
     setStoredAccessToken('expired-token', { emit: false });
     fetchMock