Fix #266: Clear profile-slot token on 401 error (#326)

This commit modifies the connect flow in `ConnectViewModel.kt` to clear the profile-specific token alongside the global token when an HTTP 401 (Unauthorized) error is encountered. Previously, the global token was cleared, but the bad token persisted in the selected profile's slot, causing potential security and authentication handling issues. Tests have been added to `ConnectViewModelTest.kt` to verify that both the global and profile tokens are correctly nullified under a 401 scenario.
2026-06-23 12:10:00 +03:00
parent ecbea6d2b9
commit 64f40686b6
2 changed files with 32 additions and 0 deletions
@@ -219,6 +219,35 @@ class ConnectViewModelTest {
            viewModel.connect()
            advanceUntilIdle()

+            verify { AuthManager.setToken(null) }
+
+            val state = viewModel.uiState.value
+            assertFalse(state.isConnecting)
+            assertFalse(state.connectionSuccess)
+            assertEquals("Invalid token (401 Unauthorized)", state.errorMessage)
+        }
+
+    @Test
+    fun testConnect_failure_unauthorized_clearsProfileToken() =
+        runTest {
+            every { AuthManager.getSelectedProfileId() } returns "prof-1"
+
+            val viewModel = ConnectViewModel(mockApp)
+            viewModel.onTokenChange("invalid-token")
+            viewModel.onHostChange("127.0.0.1")
+            viewModel.onPortChange("9119")
+
+            val mockResponse = mockk<Response<StatusResponse>>()
+            every { mockResponse.isSuccessful } returns false
+            every { mockResponse.code() } returns 401
+            coEvery { mockApiService.getStatus() } returns mockResponse
+
+            viewModel.connect()
+            advanceUntilIdle()
+
+            verify { AuthManager.setToken(null) }
+            verify { AuthManager.setProfileToken("prof-1", null) }
+
            val state = viewModel.uiState.value
            assertFalse(state.isConnecting)
            assertFalse(state.connectionSuccess)