test: server Run, upstream 500/401 branches, virtual dead members, local DB accessor

internal/proxy/engine_test.go

@@ -108,6 +108,11 @@ func mockUpstream(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte("protected payload 2"))
 	case "/token":
 		w.Write([]byte(`{"token":"minted-token","expires_in":300}`))
+	case "/err500":
+		w.WriteHeader(http.StatusInternalServerError)
+	case "/noauth": // 401 with an unusable challenge (no realm)
+		w.Header().Set("Www-Authenticate", `Bearer service="reg"`)
+		w.WriteHeader(http.StatusUnauthorized)
 	default:
 		http.NotFound(w, r)
 	}
@@ -324,6 +329,25 @@ func TestFetchUpstreamError(t *testing.T) {
 	}
 }
 
+func TestFetchUpstreamStatusErrors(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	p := prov(t, models.PackageGeneric)
+
+	r := seed(t, genericRemote("eng-500"))
+	_, err := testEngine.Fetch(ctx, r, "err500", p)
+	var pe *ProxyError
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusInternalServerError {
+		t.Errorf("expected 500 ProxyError, got %v", err)
+	}
+
+	r = seed(t, genericRemote("eng-noauth"))
+	_, err = testEngine.Fetch(ctx, r, "noauth", p)
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusUnauthorized {
+		t.Errorf("expected 401 ProxyError, got %v", err)
+	}
+}
+
 func TestBearerTokenParsing(t *testing.T) {
 	// Non-Bearer challenges and missing realms are rejected.
 	if _, _, err := fetchBearerToken(context.Background(), "Basic realm=x", models.Remote{}); err == nil {