From 077419b220e5c8b22a158c126f5fd1c5b709d5b7 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Sat, 6 Jun 2026 08:50:15 -0700
Subject: [PATCH] test(desktop): regression-guard fetchJsonViaOauthSession
 headers (#40069)

Closes #40069.

Salvaged from #40242; re-verified on main, tightened, tested.

Co-authored-by: maxpetrusenkoagent <maxpetrusenkoagent@users.noreply.github.com>
---
 .../electron/oauth-session-request.test.cjs   | 30 +++++++++++++++++++
 apps/desktop/package.json                     |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 apps/desktop/electron/oauth-session-request.test.cjs

diff --git a/apps/desktop/electron/oauth-session-request.test.cjs b/apps/desktop/electron/oauth-session-request.test.cjs
new file mode 100644
index 00000000000..3254318456b
--- /dev/null
+++ b/apps/desktop/electron/oauth-session-request.test.cjs
@@ -0,0 +1,30 @@
+/**
+ * Regression coverage for the OAuth-session Electron net.request path.
+ *
+ * Electron net rejects manual Content-Length/Host headers with
+ * net::ERR_INVALID_ARGUMENT. Node HTTP helpers may still set Content-Length;
+ * this guard is scoped to fetchJsonViaOauthSession only.
+ */
+
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const source = fs.readFileSync(path.join(__dirname, 'main.cjs'), 'utf8')
+
+function extractFetchJsonViaOauthSession() {
+  const start = source.indexOf('function fetchJsonViaOauthSession')
+  const end = source.indexOf('// Mint a single-use WS ticket', start)
+  assert.notEqual(start, -1, 'fetchJsonViaOauthSession should exist')
+  assert.notEqual(end, -1, 'fetchJsonViaOauthSession boundary should exist')
+  return source.slice(start, end)
+}
+
+test('OAuth Electron net request does not set forbidden Content-Length header', () => {
+  const fn = extractFetchJsonViaOauthSession()
+
+  assert.match(fn, /electronNet\.request/)
+  assert.doesNotMatch(fn, /setHeader\(['"]Content-Length['"]/)
+  assert.match(fn, /request\.write\(body\)/)
+})
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 6fd35c0fbc4..f5aac36ba42 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -37,7 +37,7 @@
     "test:desktop:nsis": "node scripts/test-desktop.mjs nsis",
     "test:desktop:existing": "node scripts/test-desktop.mjs existing",
     "test:desktop:fresh": "node scripts/test-desktop.mjs fresh",
-    "test:desktop:platforms": "node --test electron/bootstrap-platform.test.cjs electron/hardening.test.cjs electron/backend-env.test.cjs electron/backend-probes.test.cjs electron/backend-ready.test.cjs electron/bootstrap-runner.test.cjs electron/connection-config.test.cjs electron/dashboard-token.test.cjs electron/gateway-ws-probe.test.cjs electron/oauth-net-request.test.cjs electron/desktop-uninstall.test.cjs electron/session-windows.test.cjs electron/link-title-window.test.cjs electron/workspace-cwd.test.cjs electron/fs-read-dir.test.cjs electron/git-root.test.cjs electron/git-worktree-ops.test.cjs electron/windows-child-process.test.cjs electron/update-remote.test.cjs electron/update-count.test.cjs electron/update-rebuild.test.cjs electron/update-marker.test.cjs electron/update-relaunch.test.cjs electron/windows-user-env.test.cjs electron/wsl-clipboard-image.test.cjs electron/titlebar-overlay-width.test.cjs electron/window-state.test.cjs electron/windows-hermes-resolution.test.cjs",
+    "test:desktop:platforms": "node --test electron/bootstrap-platform.test.cjs electron/hardening.test.cjs electron/backend-env.test.cjs electron/backend-probes.test.cjs electron/backend-ready.test.cjs electron/bootstrap-runner.test.cjs electron/connection-config.test.cjs electron/dashboard-token.test.cjs electron/gateway-ws-probe.test.cjs electron/oauth-net-request.test.cjs electron/desktop-uninstall.test.cjs electron/session-windows.test.cjs electron/link-title-window.test.cjs electron/workspace-cwd.test.cjs electron/fs-read-dir.test.cjs electron/git-root.test.cjs electron/git-worktree-ops.test.cjs electron/windows-child-process.test.cjs electron/update-remote.test.cjs electron/update-count.test.cjs electron/update-rebuild.test.cjs electron/update-marker.test.cjs electron/update-relaunch.test.cjs electron/windows-user-env.test.cjs electron/wsl-clipboard-image.test.cjs electron/titlebar-overlay-width.test.cjs electron/window-state.test.cjs electron/windows-hermes-resolution.test.cjs electron/oauth-session-request.test.cjs",
     "typecheck": "tsc -p . --noEmit",
     "lint": "eslint src/ electron/",
     "lint:fix": "eslint src/ electron/ --fix",