🧪 [Test] Add clear test to KeystoreAccessTokenStore - #38
Conversation
Adds a test to `KeystoreAccessTokenStoreTest` to verify that `clear()` correctly removes the access token key from `SharedPreferences`. Co-authored-by: SayanthRock <202829406+SayanthRock@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🤖 CodeAnt AI — Review Status
|
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![ai-coding-guardrails[bot]](https://avatars.githubusercontent.com/in/1202546?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nice work! 😎
I didn't find anything of concern
Risk: 🟢 Low
Risk analysis
This PR adds a new test case for the clear method in KeystoreAccessTokenStoreTest, which validates correct interaction with SharedPreferences. Since this change only introduces test code and does not modify production logic, all risk dimensions are scored as 0.
Reviewed with 🤟 by Zenable
codeant-ai
Bot
added
the
size:S
ai-coding-guardrails
Bot
added
the
zenable/risk:low
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| fun `clear calls remove on sharedPreferences`() { | ||
| // Act | ||
| store.clear() | ||
|
|
||
| // Assert | ||
| verify { editor.remove("github_access_token") } | ||
| verify { editor.apply() } |
There was a problem hiding this comment.
Suggestion: This test only verifies interactions with a relaxed mock editor; it never models or checks the stored preference value after clear(). As a result, the test would still pass if remove() or apply() failed to affect SharedPreferences, so it does not verify the postcondition required for sign-out. Use a stateful preference implementation or explicitly verify that a subsequent getAccessToken() returns no token. [incomplete implementation]
Severity Level: Critical 🚨
- ❌ Logout token-removal regressions can pass the test suite.
- ❌ AuthViewModel logout may leave persisted credentials.
- ⚠️ Current test validates calls, not SharedPreferences state.Steps of Reproduction ✅
1. Run `KeystoreAccessTokenStoreTest` in
`core-network/src/test/java/com/sayanthrock/rockreleasehub/core/network/auth/KeystoreAccessTokenStoreTest.kt`;
`setup()` at lines 27-35 constructs relaxed MockK mocks for `SharedPreferences` and its
editor, with `sharedPreferences.edit()` returning the mock editor.
2. Execute `store.clear()` from the new test at line 94; production code at
`core-network/src/main/java/com/sayanthrock/rockreleasehub/core/network/auth/AccessTokenStore.kt:71-72`
calls `preferences.edit().remove("github_access_token").apply()`.
3. The assertions at lines 97-98 only confirm that the mocked `remove()` and `apply()`
methods were invoked. No stateful preference value is configured or inspected, so the test
also passes if those mocked methods do not change the stored value or if production stops
applying the removal while the interaction calls remain.
4. This behavior affects the real logout path:
`feature-auth/src/main/java/com/sayanthrock/rockreleasehub/feature/auth/AuthViewModel.kt:76-78`
calls `accessTokenStore.clear()`. Replace the relaxed mocks with a stateful
`SharedPreferences` implementation, or configure the mock to update storage and assert
that a subsequent `getAccessToken()` returns null.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** core-network/src/test/java/com/sayanthrock/rockreleasehub/core/network/auth/KeystoreAccessTokenStoreTest.kt
**Line:** 92:98
**Comment:**
*Incomplete Implementation: This test only verifies interactions with a relaxed mock editor; it never models or checks the stored preference value after `clear()`. As a result, the test would still pass if `remove()` or `apply()` failed to affect `SharedPreferences`, so it does not verify the postcondition required for sign-out. Use a stateful preference implementation or explicitly verify that a subsequent `getAccessToken()` returns no token.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix1 participant
User description
🎯 What: Adds test coverage for the
clearfunction inKeystoreAccessTokenStore.📊 Coverage: Validates that calling
clear()triggers the removal of the specific key fromSharedPreferencesand applies the changes.✨ Result: Enhanced test coverage and reliability for access token management.
PR created automatically by Jules for task 4307192320282208516 started by @SayanthRock
CodeAnt-AI Description
Verify that clearing stored access tokens removes the saved credential
What Changed
Impact
✅ Reliable access-token removal✅ Fewer stale credentials after sign-out💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.