From 546bcf9bbe651eaaa0129346536c9e7e98748555 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Mon, 15 Jun 2026 23:57:14 -0500
Subject: fix(api): clear auth-source's negative cache on pearl-clear-cache

A key added to authinfo read as missing for up to 2h because auth-source caches the negative lookup and `pearl-clear-cache` only cleared pearl's own caches. It now also calls `auth-source-forget-all-cached`, and the auth-source miss tells the user to run `M-x pearl-clear-cache`. This is the 2026-06-01 live incident, where a freshly-synced Linear key kept erroring as unset.
---
 tests/test-pearl-accounts.el | 9 +++++++++
 tests/test-pearl-resolve.el  | 9 +++++++++
 2 files changed, 18 insertions(+)

(limited to 'tests')

diff --git a/tests/test-pearl-accounts.el b/tests/test-pearl-accounts.el
index 4de9c2f..82f5e56 100644
--- a/tests/test-pearl-accounts.el
+++ b/tests/test-pearl-accounts.el
@@ -85,6 +85,15 @@
                    '(:auth-source :host "api.linear.app" :user "work") "work")
                   :type 'user-error)))
 
+(ert-deftest test-pearl-resolve-api-key-source-auth-miss-hints-at-cache ()
+  "An auth-source miss hints at the negative cache, so a freshly added key is
+recoverable via clear-cache rather than reading as permanently missing."
+  (cl-letf (((symbol-function 'auth-source-search) (lambda (&rest _) nil)))
+    (let ((err (should-error (pearl--resolve-api-key-source
+                              '(:auth-source :host "api.linear.app" :user "work") "work")
+                             :type 'user-error)))
+      (should (string-match-p "clear-cache" (error-message-string err))))))
+
 ;;; pearl--resolve-account
 
 (ert-deftest test-pearl-resolve-account-returns-full-context ()
diff --git a/tests/test-pearl-resolve.el b/tests/test-pearl-resolve.el
index aefe27a..df75b6f 100644
--- a/tests/test-pearl-resolve.el
+++ b/tests/test-pearl-resolve.el
@@ -136,6 +136,15 @@
     (should-not pearl--cache-states)
     (should-not pearl--cache-teams)))
 
+(ert-deftest test-pearl-clear-cache-forgets-auth-source ()
+  "Clearing the cache also drops auth-source's own cache, so a key just added
+to authinfo is findable without waiting out the 2h auth-source TTL."
+  (let ((called nil))
+    (cl-letf (((symbol-function 'auth-source-forget-all-cached)
+               (lambda (&rest _) (setq called t))))
+      (pearl-clear-cache)
+      (should called))))
+
 ;;; failure / malformed cases
 
 (ert-deftest test-pearl-team-collection-malformed-returns-nil-no-cache ()
-- 
cgit v1.2.3