test(host): the R3-01 falsifiability control asserts the cookie-challenge signature (a bare Exception was satisfiable by an anonymised endpoint too); docs wording

2026-08-20 10:43:49 -04:00
parent b725788954
commit c8cf5c8032
2 changed files with 9 additions and 3 deletions
@@ -252,8 +252,14 @@ public sealed class MeshGrpcAuthStackTests : IAsyncLifetime
        using var call = client.Sync(headers, cancellationToken: TestContext.Current.CancellationToken);
        await call.RequestStream.CompleteAsync();

-        await Should.ThrowAsync<Exception>(
+        // Review (R3-01): asserting a bare Exception was vacuous — an anonymised endpoint ALSO throws
+        // here (handler deps are not wired in this fixture => RpcException Unknown). Only the
+        // cookie-challenge signature discriminates: the FallbackPolicy's 302 to /login is a
+        // non-gRPC response, surfaced by grpc-dotnet as Internal + PROTOCOL_ERROR.
+        var ex = await Should.ThrowAsync<RpcException>(
            () => call.ResponseStream.MoveNext(TestContext.Current.CancellationToken));
+        ex.StatusCode.ShouldBe(StatusCode.Internal);
+        ex.Status.Detail.ShouldContain("PROTOCOL_ERROR");
    }

    // ---------------------------------------------------------------------------------------