test: cover auth-config helpers and oauth2 cache fix

I added 13 new tests across 5 files, covering the auth-config functions that lacked tests. Categories follow Normal / Boundary / Error where applicable.

`cj/toggle-auth-source-debug` flips state once and back through two toggles. `cj/oauth2-auto--plstore-read-fixed` gets three tests: cache miss reads then caches, cache hit skips `plstore-open` entirely, and the `unwind-protect` runs `plstore-close` even when `plstore-get` signals.

`cj/reset-auth-cache` covers no-prefix (skip `shell-command`), with-prefix success, and with-prefix shell failure (Emacs caches still clear). `cj/kill-gpg-agent` covers shell exit 0 and non-zero. `cj/clear-oauth2-auto-cache` covers bound-with-entries, bound-but-empty, and unbound. The unbound test restores the binding via `unwind-protect` so other tests in the same Emacs session don't void-variable.

I stubbed every boundary via `cl-letf` (`plstore-open`, `plstore-get`, `plstore-close`, `oauth2-auto--compute-id`, `auth-source-forget-all-cached`, `epa-file-clear-cache`, `shell-command`, `message`, `call-process`) and didn't stub any internal helpers.

15 auth-config tests pass together: 2 existing plus 13 new.

5 files changed, 314 insertions, 0 deletions

diff --git a/tests/test-auth-config-clear-oauth2-auto-cache.el b/tests/test-auth-config-clear-oauth2-auto-cache.el
new file mode 100644
index 00000000..52a78f53
--- /dev/null
+++ b/tests/test-auth-config-clear-oauth2-auto-cache.el
@@ -0,0 +1,64 @@
+;;; test-auth-config-clear-oauth2-auto-cache.el --- Tests for clear-oauth2-auto-cache -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; Verifies the in-memory oauth2-auto cache is cleared when bound, and the
+;; not-loaded message is shown when unbound.  The error test restores the
+;; binding in an unwind-protect so other tests in the same Emacs session
+;; do not hit a void-variable error.
+
+;;; Code:
+
+(require 'cl-lib)
+(require 'ert)
+(require 'auth-source)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+
+(defun test-auth-config-clear-oauth2--load ()
+  "Load auth-config with external process calls stubbed."
+  (cl-letf (((symbol-function 'call-process)
+             (lambda (&rest _args) 0)))
+    (load (expand-file-name "modules/auth-config.el" user-emacs-directory)
+          nil t)))
+
+(ert-deftest test-auth-config-clear-oauth2-cache-normal-bound-with-entries-clears ()
+  "Normal: bound cache with entries gets cleared, success message shown."
+  (test-auth-config-clear-oauth2--load)
+  (let ((cache (make-hash-table :test 'equal))
+        (last-message nil))
+    (puthash "k1" "v1" cache)
+    (puthash "k2" "v2" cache)
+    (setq oauth2-auto--plstore-cache cache)
+    (cl-letf (((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/clear-oauth2-auto-cache)
+      (should (zerop (hash-table-count oauth2-auto--plstore-cache)))
+      (should (string-match-p "oauth2-auto token cache cleared" last-message)))))
+
+(ert-deftest test-auth-config-clear-oauth2-cache-boundary-bound-empty-stays-empty ()
+  "Boundary: empty bound cache stays empty, success message still shown."
+  (test-auth-config-clear-oauth2--load)
+  (let ((cache (make-hash-table :test 'equal))
+        (last-message nil))
+    (setq oauth2-auto--plstore-cache cache)
+    (cl-letf (((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/clear-oauth2-auto-cache)
+      (should (zerop (hash-table-count oauth2-auto--plstore-cache)))
+      (should (string-match-p "oauth2-auto token cache cleared" last-message)))))
+
+(ert-deftest test-auth-config-clear-oauth2-cache-error-unbound-warns ()
+  "Error: unbound oauth2-auto cache var triggers warning message."
+  (test-auth-config-clear-oauth2--load)
+  (when (boundp 'oauth2-auto--plstore-cache)
+    (makunbound 'oauth2-auto--plstore-cache))
+  (unwind-protect
+      (let ((last-message nil))
+        (cl-letf (((symbol-function 'message)
+                   (lambda (fmt &rest _) (setq last-message fmt))))
+          (cj/clear-oauth2-auto-cache)
+          (should (string-match-p "oauth2-auto not loaded yet" last-message))))
+    (setq oauth2-auto--plstore-cache (make-hash-table :test 'equal))))
+
+(provide 'test-auth-config-clear-oauth2-auto-cache)
+;;; test-auth-config-clear-oauth2-auto-cache.el ends here
diff --git a/tests/test-auth-config-kill-gpg-agent.el b/tests/test-auth-config-kill-gpg-agent.el
new file mode 100644
index 00000000..8933bee7
--- /dev/null
+++ b/tests/test-auth-config-kill-gpg-agent.el
@@ -0,0 +1,42 @@
+;;; test-auth-config-kill-gpg-agent.el --- Tests for cj/kill-gpg-agent -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; Verifies cj/kill-gpg-agent reports success or warning based on shell exit code.
+
+;;; Code:
+
+(require 'cl-lib)
+(require 'ert)
+(require 'auth-source)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+
+(defun test-auth-config-kill--load ()
+  "Load auth-config with external process calls stubbed."
+  (cl-letf (((symbol-function 'call-process)
+             (lambda (&rest _args) 0)))
+    (load (expand-file-name "modules/auth-config.el" user-emacs-directory)
+          nil t)))
+
+(ert-deftest test-auth-config-kill-gpg-agent-normal-shell-success ()
+  "Normal: shell-command exit 0 yields success message."
+  (test-auth-config-kill--load)
+  (let ((last-message nil))
+    (cl-letf (((symbol-function 'shell-command) (lambda (&rest _) 0))
+              ((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/kill-gpg-agent)
+      (should (string-match-p "gpg-agent killed" last-message)))))
+
+(ert-deftest test-auth-config-kill-gpg-agent-error-shell-fails ()
+  "Error: shell-command non-zero yields warning message."
+  (test-auth-config-kill--load)
+  (let ((last-message nil))
+    (cl-letf (((symbol-function 'shell-command) (lambda (&rest _) 1))
+              ((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/kill-gpg-agent)
+      (should (string-match-p "Failed to kill gpg-agent" last-message)))))
+
+(provide 'test-auth-config-kill-gpg-agent)
+;;; test-auth-config-kill-gpg-agent.el ends here
diff --git a/tests/test-auth-config-oauth2-auto-plstore-read-fixed.el b/tests/test-auth-config-oauth2-auto-plstore-read-fixed.el
new file mode 100644
index 00000000..25446dec
--- /dev/null
+++ b/tests/test-auth-config-oauth2-auto-plstore-read-fixed.el
@@ -0,0 +1,86 @@
+;;; test-auth-config-oauth2-auto-plstore-read-fixed.el --- Tests for oauth2 cache fix -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; Confirms the oauth2-auto plstore-read advice caches reads on miss,
+;; skips plstore-open on hit, and runs plstore-close even when
+;; plstore-get signals.
+
+;;; Code:
+
+(require 'cl-lib)
+(require 'ert)
+(require 'auth-source)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+
+(defvar oauth2-auto--plstore-cache nil
+  "Stub for oauth2-auto's in-memory token cache.")
+
+(defvar oauth2-auto-plstore "/tmp/test-oauth2-stub.plist"
+  "Stub for oauth2-auto plstore path.")
+
+(defun test-auth-config-oauth2--load ()
+  "Load auth-config with external process calls stubbed."
+  (cl-letf (((symbol-function 'call-process)
+             (lambda (&rest _args) 0)))
+    (load (expand-file-name "modules/auth-config.el" user-emacs-directory)
+          nil t))
+  (setq oauth2-auto--plstore-cache (make-hash-table :test 'equal)))
+
+(ert-deftest test-auth-config-oauth2-plstore-read-normal-cache-miss-reads-and-caches ()
+  "Normal: cache miss opens plstore, reads value, caches, returns value."
+  (test-auth-config-oauth2--load)
+  (let ((opens 0)
+        (closes 0))
+    (cl-letf (((symbol-function 'require) (lambda (&rest _) t))
+              ((symbol-function 'oauth2-auto--compute-id)
+               (lambda (_u _p) "stable-id"))
+              ((symbol-function 'plstore-open)
+               (lambda (_) (cl-incf opens) 'fake-plstore))
+              ((symbol-function 'plstore-get)
+               (lambda (_p id) (cons id "secret-value")))
+              ((symbol-function 'plstore-close)
+               (lambda (_) (cl-incf closes))))
+      (let ((result (cj/oauth2-auto--plstore-read-fixed "u" "p")))
+        (should (equal result "secret-value"))
+        (should (= opens 1))
+        (should (= closes 1))
+        (should (equal (gethash "stable-id" oauth2-auto--plstore-cache)
+                       "secret-value"))))))
+
+(ert-deftest test-auth-config-oauth2-plstore-read-boundary-cache-hit-skips-plstore ()
+  "Boundary: cache hit returns cached value without opening plstore."
+  (test-auth-config-oauth2--load)
+  (puthash "stable-id" "cached-value" oauth2-auto--plstore-cache)
+  (let ((opens 0))
+    (cl-letf (((symbol-function 'require) (lambda (&rest _) t))
+              ((symbol-function 'oauth2-auto--compute-id)
+               (lambda (_u _p) "stable-id"))
+              ((symbol-function 'plstore-open)
+               (lambda (_) (cl-incf opens) 'fake-plstore))
+              ((symbol-function 'plstore-get)
+               (lambda (_p _id) (error "plstore-get should not be called")))
+              ((symbol-function 'plstore-close)
+               (lambda (_) nil)))
+      (let ((result (cj/oauth2-auto--plstore-read-fixed "u" "p")))
+        (should (equal result "cached-value"))
+        (should (zerop opens))))))
+
+(ert-deftest test-auth-config-oauth2-plstore-read-error-plstore-close-runs-after-get-fails ()
+  "Error: plstore-close runs even when plstore-get signals an error."
+  (test-auth-config-oauth2--load)
+  (let ((closes 0))
+    (cl-letf (((symbol-function 'require) (lambda (&rest _) t))
+              ((symbol-function 'oauth2-auto--compute-id)
+               (lambda (_u _p) "stable-id"))
+              ((symbol-function 'plstore-open)
+               (lambda (_) 'fake-plstore))
+              ((symbol-function 'plstore-get)
+               (lambda (_p _id) (error "boom")))
+              ((symbol-function 'plstore-close)
+               (lambda (_) (cl-incf closes))))
+      (should-error (cj/oauth2-auto--plstore-read-fixed "u" "p"))
+      (should (= closes 1)))))
+
+(provide 'test-auth-config-oauth2-auto-plstore-read-fixed)
+;;; test-auth-config-oauth2-auto-plstore-read-fixed.el ends here
diff --git a/tests/test-auth-config-reset-auth-cache.el b/tests/test-auth-config-reset-auth-cache.el
new file mode 100644
index 00000000..689ce483
--- /dev/null
+++ b/tests/test-auth-config-reset-auth-cache.el
@@ -0,0 +1,81 @@
+;;; test-auth-config-reset-auth-cache.el --- Tests for cj/reset-auth-cache -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; Verifies cache-reset orchestrates auth-source, EPA, and gpg-agent
+;; clears according to the prefix-arg flag.
+
+;;; Code:
+
+(require 'cl-lib)
+(require 'ert)
+(require 'auth-source)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+
+(defun test-auth-config-reset--load ()
+  "Load auth-config with external process calls stubbed."
+  (cl-letf (((symbol-function 'call-process)
+             (lambda (&rest _args) 0)))
+    (load (expand-file-name "modules/auth-config.el" user-emacs-directory)
+          nil t)))
+
+(ert-deftest test-auth-config-reset-auth-cache-normal-no-prefix-skips-shell ()
+  "Normal: no prefix arg clears Emacs caches but does not invoke shell-command."
+  (test-auth-config-reset--load)
+  (let ((auth-clears 0)
+        (epa-clears 0)
+        (shell-calls 0))
+    (cl-letf (((symbol-function 'auth-source-forget-all-cached)
+               (lambda () (cl-incf auth-clears)))
+              ((symbol-function 'epa-file-clear-cache)
+               (lambda () (cl-incf epa-clears)))
+              ((symbol-function 'shell-command)
+               (lambda (&rest _) (cl-incf shell-calls) 0))
+              ((symbol-function 'message) (lambda (&rest _) nil)))
+      (cj/reset-auth-cache nil)
+      (should (= auth-clears 1))
+      (should (= epa-clears 1))
+      (should (zerop shell-calls)))))
+
+(ert-deftest test-auth-config-reset-auth-cache-boundary-with-prefix-shell-success ()
+  "Boundary: with prefix and shell-command returning 0, all three caches clear."
+  (test-auth-config-reset--load)
+  (let ((auth-clears 0)
+        (epa-clears 0)
+        (shell-calls 0)
+        (last-message nil))
+    (cl-letf (((symbol-function 'auth-source-forget-all-cached)
+               (lambda () (cl-incf auth-clears)))
+              ((symbol-function 'epa-file-clear-cache)
+               (lambda () (cl-incf epa-clears)))
+              ((symbol-function 'shell-command)
+               (lambda (&rest _) (cl-incf shell-calls) 0))
+              ((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/reset-auth-cache t)
+      (should (= auth-clears 1))
+      (should (= epa-clears 1))
+      (should (= shell-calls 1))
+      (should (string-match-p "Emacs and gpg-agent caches cleared" last-message)))))
+
+(ert-deftest test-auth-config-reset-auth-cache-error-with-prefix-shell-fails ()
+  "Error: with prefix and shell-command non-zero, warning is shown, Emacs caches still cleared."
+  (test-auth-config-reset--load)
+  (let ((auth-clears 0)
+        (epa-clears 0)
+        (last-message nil))
+    (cl-letf (((symbol-function 'auth-source-forget-all-cached)
+               (lambda () (cl-incf auth-clears)))
+              ((symbol-function 'epa-file-clear-cache)
+               (lambda () (cl-incf epa-clears)))
+              ((symbol-function 'shell-command)
+               (lambda (&rest _) 1))
+              ((symbol-function 'message)
+               (lambda (fmt &rest _) (setq last-message fmt))))
+      (cj/reset-auth-cache t)
+      (should (= auth-clears 1))
+      (should (= epa-clears 1))
+      (should (string-match-p "Failed to clear gpg-agent cache" last-message)))))
+
+(provide 'test-auth-config-reset-auth-cache)
+;;; test-auth-config-reset-auth-cache.el ends here
diff --git a/tests/test-auth-config-toggle-auth-source-debug.el b/tests/test-auth-config-toggle-auth-source-debug.el
new file mode 100644
index 00000000..489ef826
--- /dev/null
+++ b/tests/test-auth-config-toggle-auth-source-debug.el
@@ -0,0 +1,41 @@
+;;; test-auth-config-toggle-auth-source-debug.el --- Tests for debug toggle -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; Verifies the debug toggle helper flips both module and auth-source state.
+
+;;; Code:
+
+(require 'cl-lib)
+(require 'ert)
+(require 'auth-source)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+
+(defun test-auth-config-toggle--load ()
+  "Load auth-config with external process calls stubbed."
+  (setq cj/auth-source-debug-enabled nil)
+  (setq auth-source-debug nil)
+  (cl-letf (((symbol-function 'call-process)
+             (lambda (&rest _args) 0)))
+    (load (expand-file-name "modules/auth-config.el" user-emacs-directory)
+          nil t)))
+
+(ert-deftest test-auth-config-toggle-normal-flips-disabled-to-enabled ()
+  "Normal: toggle from disabled flips both vars to enabled."
+  (test-auth-config-toggle--load)
+  (cl-letf (((symbol-function 'message) (lambda (&rest _) nil)))
+    (cj/toggle-auth-source-debug)
+    (should cj/auth-source-debug-enabled)
+    (should auth-source-debug)))
+
+(ert-deftest test-auth-config-toggle-boundary-two-toggles-return-to-disabled ()
+  "Boundary: two toggles in a row leave both vars disabled."
+  (test-auth-config-toggle--load)
+  (cl-letf (((symbol-function 'message) (lambda (&rest _) nil)))
+    (cj/toggle-auth-source-debug)
+    (cj/toggle-auth-source-debug)
+    (should-not cj/auth-source-debug-enabled)
+    (should-not auth-source-debug)))
+
+(provide 'test-auth-config-toggle-auth-source-debug)
+;;; test-auth-config-toggle-auth-source-debug.el ends here