test: classifier branches, docker provider, pypi index serving, bearer/checkUpstream variants

internal/proxy/engine_test.go

@@ -108,6 +108,10 @@ func mockUpstream(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte("protected payload 2"))
 	case "/token":
 		w.Write([]byte(`{"token":"minted-token","expires_in":300}`))
+	case "/token-at":
+		w.Write([]byte(`{"access_token":"at-token"}`))
+	case "/token-500":
+		w.WriteHeader(http.StatusInternalServerError)
 	case "/err500":
 		w.WriteHeader(http.StatusInternalServerError)
 	case "/noauth": // 401 with an unusable challenge (no realm)
@@ -451,6 +455,35 @@ func TestHeadCachedIndex(t *testing.T) {
 	}
 }
 
+func TestFetchBearerTokenVariants(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+
+	// access_token field + service/scope params + basic auth on the token req.
+	tok, _, err := fetchBearerToken(ctx, `Bearer realm="`+upstream.URL+`/token-at",service="reg",scope="repo:pull"`, models.Remote{Username: "u", Password: "p"})
+	if err != nil || tok != "at-token" {
+		t.Errorf("access_token variant: tok=%q err=%v", tok, err)
+	}
+	// Token endpoint error status.
+	if _, _, err := fetchBearerToken(ctx, `Bearer realm="`+upstream.URL+`/token-500"`, models.Remote{}); err == nil {
+		t.Error("expected error for 500 token endpoint")
+	}
+}
+
+func TestCheckUpstreamChanged(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := genericRemote("eng-check")
+	// A non-matching ETag yields a normal 200 (not 304): not modified is false.
+	notModified, err := testEngine.checkUpstream(ctx, r, "pkg", `"stale-etag"`, prov(t, models.PackageNPM))
+	if err != nil {
+		t.Fatalf("checkUpstream: %v", err)
+	}
+	if notModified {
+		t.Error("mismatched etag should report modified (notModified=false)")
+	}
+}
+
 func TestUpstreamErrorUnwrap(t *testing.T) {
 	base := context.DeadlineExceeded
 	ue := &UpstreamError{Err: base}