fix(ci): make main deployable again — coverage, CVEs, and the image job (#22)

src/lib/service-token.test.ts

@@ -107,10 +107,10 @@ describe("serviceToken", () => {
 
   test("surfaces a rejected token request instead of calling unauthenticated", async () => {
     configure();
+    // no json() on the mock: fetchToken throws on !ok before reading the body
     vi.spyOn(globalThis, "fetch").mockResolvedValue({
       ok: false,
       status: 401,
-      json: async () => ({}),
     } as Response);
 
     await expect(serviceToken()).rejects.toThrow("service token request failed: 401");
@@ -130,13 +130,36 @@ describe("serviceToken", () => {
   test("a failed fetch does not poison the cache", async () => {
     configure();
     vi.spyOn(globalThis, "fetch")
-      .mockResolvedValueOnce({ ok: false, status: 503, json: async () => ({}) } as Response)
+      .mockResolvedValueOnce({ ok: false, status: 503 } as Response)
       .mockResolvedValueOnce(tokenResponse("tok-ok"));
 
     await expect(serviceToken()).rejects.toThrow();
     expect(await serviceToken()).toBe("tok-ok");
   });
 
+  test("a response without expires_in gets the 300s default lifetime", async () => {
+    configure();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-08-30T10:00:00Z"));
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => ({ access_token: "tok-default" }),
+      } as Response)
+      .mockResolvedValueOnce(tokenResponse("tok-next"));
+
+    expect(await serviceToken()).toBe("tok-default");
+    // 4 minutes in: still inside the defaulted 300s window
+    vi.setSystemTime(new Date("2026-08-30T10:04:00Z"));
+    expect(await serviceToken()).toBe("tok-default");
+    // past the default expiry
+    vi.setSystemTime(new Date("2026-08-30T10:05:01Z"));
+    expect(await serviceToken()).toBe("tok-next");
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+
   test("serviceAuthHeader carries the bearer token when configured", async () => {
     configure();
     vi.spyOn(globalThis, "fetch").mockResolvedValue(tokenResponse("tok-1"));