function installGeminiOAuthFetchMock(

handleRequest: (request: RecordedFetchRequest) => Response | undefined,

options: { tokenResponse?: () => Response } = {},

) {

const requests: RecordedFetchRequest[] = [];

const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {

const request = { url: getRequestUrl(input), init };

requests.push(request);

if (request.url === TOKEN_URL) {

return tokenResponse();

return (options.tokenResponse ?? tokenResponse)();

}

if (request.url === USERINFO_URL) {

return userInfoResponse();

});

expect(requests.map(({ url }) => url)).toEqual([TOKEN_URL, USERINFO_URL]);

});

it("keeps malformed token expiry values out of refreshed Gemini CLI credentials", async () => {

mockSettingsExistsSync.mockReturnValue(true);

mockSettingsReadFileSync.mockReturnValue(

JSON.stringify({

security: {

auth: {

selectedType: "oauth-personal",

},

},

}),

);

const beforeRefresh = Date.now();

installGeminiOAuthFetchMock(() => undefined, {

tokenResponse: () =>

responseJson({

access_token: "access-token",

expires_in: Number.NaN,

}),

});

const { refreshTokensForGeminiCli } = await import("./oauth.token.js");

const result = await refreshTokensForGeminiCli({

refresh: "refresh-token",

email: "lobster@openclaw.ai",

});

expect(Number.isFinite(result.expires)).toBe(true);

expect(result.expires).toBeLessThanOrEqual(beforeRefresh);

});

});

async function requestTokenGrant(body: URLSearchParams): Promise<{

access_token?: string;

refresh_token?: string;

expires_in?: number;

expires_in?: unknown;

}> {

const response = await fetchWithTimeout(TOKEN_URL, {

method: "POST",

return (await response.json()) as {

access_token?: string;

refresh_token?: string;

expires_in?: number;

expires_in?: unknown;

};

}

function resolveExpiresInMs(value: unknown): number {

if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {

return 0;

}

return Math.trunc(value * 1000);

}

async function buildGeminiCliCredentials(params: {

tokenResponse: {

access_token?: string;

refresh_token?: string;

expires_in?: number;

expires_in?: unknown;

};

refreshTokenFallback?: string;

existing?: Pick<GeminiCliOAuthCredentials, "email" | "projectId">;

// already-stored identity binding instead of failing token renewal.

}

const expiresInMs =

typeof params.tokenResponse.expires_in === "number"

? params.tokenResponse.expires_in * 1000

: 0;

const expiresInMs = resolveExpiresInMs(params.tokenResponse.expires_in);

const expiresAt = Date.now() + expiresInMs - 5 * 60 * 1000;

return {