graphql.test.ts

import {graphqlRequest, graphqlRequestDoc} from './graphql.js'
import * as api from '../../../private/node/api.js'
import * as debugRequest from '../../../private/node/api/graphql.js'
import {requestIdsCollection} from '../../../private/node/request-ids.js'
import * as metadata from '../metadata.js'
import * as confStore from '../../../private/node/conf-store.js'
import {inTemporaryDirectory} from '../fs.js'
import {LocalStorage} from '../local-storage.js'
import {ConfSchema, GraphQLRequestKey} from '../../../private/node/conf-store.js'
import {nonRandomUUID, sha256} from '../crypto.js'
import {CLI_KIT_VERSION} from '../../common/version.js'
import * as system from '../system.js'
import {test, vi, describe, expect, beforeEach, beforeAll, afterAll, afterEach} from 'vitest'

import {TypedDocumentNode} from '@graphql-typed-document-node/core'
import {parse} from 'graphql'
import {setupServer} from 'msw/node'
import {graphql, HttpResponse} from 'msw'

let mockedRequestId = 'request-id-123'

vi.spyOn(debugRequest, 'debugLogRequestInfo').mockResolvedValue(undefined)

vi.spyOn(system, 'sleep').mockImplementation(async () => {})

const mockedAddress = 'https://shopify.example/graphql'
const mockVariables = {some: 'variables'}
const mockToken = 'token'
const mockedAddedHeaders = {some: 'header'}

beforeEach(async () => {
  requestIdsCollection.clear()
})

const mockApi = graphql.link('https://shopify.example/graphql')

const handlers = [
  mockApi.query('QueryName', ({query}) => {
    return HttpResponse.json(
      {
        data: {
          QueryName: {example: 'hello'},
        },
        extensions: {
          cost: {
            actualQueryCost: 10,
            throttleStatus: {
              restoreRate: 10000,
            },
          },
        },
      },
      {
        headers: {
          'x-request-id': mockedRequestId,
        },
      },
    )
  }),
  mockApi.query('Fails', () => {
    return HttpResponse.json(
      {
        errors: [
          {
            message: `Cannot do the thing`,
          },
        ],
      },
      {
        headers: {
          'x-request-id': 'failed-request-id',
        },
      },
    )
  }),
  mockApi.query('FailsWithUnauthorized', () => {
    return HttpResponse.json(
      {
        errors: [
          {
            message: `not authorized`,
          },
        ],
      },
      {
        status: 401,
        headers: {
          'x-request-id': 'failed-request-id',
        },
      },
    )
  }),
  mockApi.query('FailsWithUnauthorizedAndNoBody', () => {
    // A gateway's 401 has no GraphQL body, so the typed `HttpResponse.json` doesn't fit here.
    return new HttpResponse(null, {
      status: 401,
      headers: {
        'x-request-id': 'unauthorized-request-id',
      },
    })
  }),
  mockApi.query('FailsWithBadRequest', () => {
    return HttpResponse.json(
      {
        errors: [
          {
            message: `bad request`,
          },
        ],
      },
      {
        status: 400,
        headers: {
          'x-request-id': 'failed-request-id',
        },
      },
    )
  }),
  mockApi.mutation('MutationName', ({query, variables}) => {
    return HttpResponse.json(
      {
        data: {
          MutationName: {example: variables.some},
        },
      },
      {
        headers: {
          'x-request-id': mockedRequestId,
        },
      },
    )
  }),
]

const server = setupServer(...handlers)
beforeAll(() => server.listen({onUnhandledRequest: 'error'}))
afterAll(() => server.close())
afterEach(() => {
  server.resetHandlers()
  server.events.removeAllListeners()
})

describe('graphqlRequest', () => {
  test.each([false, true])('retries a throttled nullable query (typed document: %s)', async (useTypedDocument) => {
    const receivedVariables: unknown[] = []
    const data = {appsConnection: {edges: [{node: {id: 'app-123'}}]}}
    server.use(
      mockApi.query('ListApps', ({variables}) => {
        receivedVariables.push(variables)
        if (receivedVariables.length === 1) {
          return HttpResponse.json(
            {
              data: {appsConnection: null},
              errors: [{message: 'Throttled', path: ['appsConnection'], extensions: {code: 'THROTTLED'}}],
            },
            {headers: {'Retry-After': '0'}},
          )
        }
        return HttpResponse.json({data})
      }),
    )
    const query =
      'query ListApps($query: String) { appsConnection(query: $query, first: 50) { edges { node { id } } } }'
    const variables = {query: 'title:example'}
    const options = {api: 'mockApi', url: mockedAddress, variables}
    const result = useTypedDocument
      ? await graphqlRequestDoc({...options, query: parse(query)})
      : await graphqlRequest({...options, query})

    expect(result).toEqual(data)
    expect(receivedVariables).toEqual([variables, variables])
  })

  test('retries only the throttled mutation request with its original variables', async () => {
    const receivedVariables: unknown[] = []
    server.use(
      mockApi.mutation('CreateAppVersion', ({variables}) => {
        receivedVariables.push(variables)
        if (receivedVariables.length === 1) {
          return HttpResponse.json(
            {errors: [{message: 'Throttled', extensions: {code: 'THROTTLED'}}]},
            {headers: {'Retry-After': '0'}},
          )
        }
        return HttpResponse.json({data: {appVersionCreate: {version: {id: 'created-version'}}}})
      }),
    )
    const variables = {appId: 'test-app'}
    const result = await graphqlRequest({
      api: 'mockApi',
      url: mockedAddress,
      query: 'mutation CreateAppVersion($appId: ID!) { appVersionCreate(appId: $appId) { version { id } } }',
      variables,
    })

    expect(result).toEqual({appVersionCreate: {version: {id: 'created-version'}}})
    expect(receivedVariables).toEqual([variables, variables])
  })

  test('does not repeat a mutation when a throttled response contains partial data', async () => {
    let requestCount = 0
    server.use(
      mockApi.mutation('CreateAppVersion', () => {
        requestCount++
        return HttpResponse.json(
          {
            data: {appVersionCreate: {version: {id: 'created-version'}}},
            errors: [{message: 'Throttled', extensions: {code: 'THROTTLED'}}],
          },
          {headers: {'Retry-After': '0'}},
        )
      }),
    )
    await expect(
      graphqlRequest({
        api: 'mockApi',
        url: mockedAddress,
        query: 'mutation CreateAppVersion { appVersionCreate { version { id } } }',
      }),
    ).rejects.toThrow('Throttled')

    expect(requestCount).toBe(1)
  })

  test('calls debugLogRequestInfo once', async () => {
    let headers: any
    server.events.on('request:start', ({request}) => {
      headers = {}
      request.headers.forEach((value, key) => {
        headers[key] = value
      })
    })

    // When
    const res = await graphqlRequest({
      query: 'query QueryName { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
    })
    expect(debugRequest.debugLogRequestInfo).toHaveBeenCalledOnce()

    // user agents varies a lot
    const {'user-agent': userAgent, 'sec-ch-ua-platform': _platform, ...otherHeaders} = headers
    expect(otherHeaders).toMatchInlineSnapshot(`
      {
        "accept": "*/*",
        "accept-encoding": "gzip,deflate",
        "authorization": "Bearer token",
        "connection": "close",
        "content-length": "100",
        "content-type": "application/json",
        "host": "shopify.example",
        "keep-alive": "timeout=30",
        "some": "header",
        "x-shopify-access-token": "Bearer token",
      }
    `)
    expect(res).toMatchInlineSnapshot(`
      {
        "QueryName": {
          "example": "hello",
        },
      }
    `)

    expect(userAgent).toMatch(new RegExp(`Shopify CLI; v=${CLI_KIT_VERSION}`))
  })

  test('Logs the request ids to metadata and requestIdCollection', async () => {
    // Given
    const metadataSpyOn = vi.spyOn(metadata, 'addPublicMetadata').mockImplementation(async () => {})

    // When
    await graphqlRequest({
      query: 'query QueryName { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
    })

    mockedRequestId = 'request-id-456'

    await graphqlRequest({
      query: 'query QueryName { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
    })

    // Then
    expect(requestIdsCollection.getRequestIds()).toEqual(['request-id-123', 'request-id-456'])
    expect(metadataSpyOn).toHaveBeenCalledTimes(2)
    expect(metadataSpyOn.mock.calls[0]![0]()).toEqual({cmd_all_last_graphql_request_id: 'request-id-123'})
    expect(metadataSpyOn.mock.calls[1]![0]()).toEqual({cmd_all_last_graphql_request_id: 'request-id-456'})
  })

  test('calls onResponseHandler', async () => {
    // When
    let data
    const onResponseHandler = vi.fn().mockImplementation((res) => {
      data = res.data
    })
    await graphqlRequest({
      query: 'query QueryName { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
      responseOptions: {
        onResponse: onResponseHandler,
      },
    })
    expect(data).toMatchInlineSnapshot(`
      {
        "QueryName": {
          "example": "hello",
        },
      }
    `)
  })

  test('logs the last request id from a failed request', async () => {
    const metadataSpyOn = vi.spyOn(metadata, 'addPublicMetadata').mockImplementation(async () => {})
    const res = graphqlRequest({
      query: 'query Fails { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
    })

    await expect(res).rejects.toThrow('Cannot do the thing')

    expect(metadataSpyOn).toHaveBeenCalledTimes(1)
    expect(metadataSpyOn.mock.calls[0]![0]()).toMatchInlineSnapshot(`
      {
        "cmd_all_last_graphql_request_id": "failed-request-id",
      }
    `)
  })

  test('Fails without retry when unauthorized and no token refresh function is provided', async () => {
    const res = graphqlRequest({
      query: 'query FailsWithUnauthorized { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
    })

    let requestCount = 0
    server.events.on('request:start', () => {
      requestCount++
    })

    await expect(res).rejects.toThrow('not authorized')
    expect(requestCount).toBe(1)
  })

  test('Fails without retry when unauthorized and a token refresh function cannot refresh the token', async () => {
    const res = graphqlRequest({
      query: 'query FailsWithUnauthorized { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: undefined})},
    })

    let requestCount = 0
    server.events.on('request:start', () => {
      requestCount++
    })

    await expect(res).rejects.toThrow('not authorized')
    expect(requestCount).toBe(1)
  })

  test('Retries once with refreshed token when unauthorized and refresh succeeds', async () => {
    const res = graphqlRequest({
      query: 'query FailsWithUnauthorized { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: 'refreshed-token'})},
    })

    let requestCount = 0
    server.events.on('request:start', () => {
      requestCount++
    })

    await expect(res).rejects.toThrow('not authorized')
    expect(requestCount).toBe(2)
  })

  describe('a 401 that survives the token refresh', () => {
    const query = 'query FailsWithUnauthorizedAndNoBody { example(secret: $secret) }'
    const variables = {secret: 'do-not-print-me'}

    test('reports the status without the request when no token refresh function is provided', async () => {
      const res = graphqlRequest({query, api: 'mockApi', url: mockedAddress, token: mockToken, variables})

      await expect(res).rejects.toMatchObject({
        statusCode: 401,
        message:
          'The mockApi GraphQL API responded unsuccessfully with the HTTP status 401.\n\nRequest ID: unauthorized-request-id',
      })
      await expect(res).rejects.not.toThrow(/do-not-print-me|example\(secret/)
    })

    test('reports the status without the request when the token cannot be refreshed', async () => {
      const res = graphqlRequest({
        query,
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables,
        unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: undefined})},
      })

      await expect(res).rejects.toMatchObject({statusCode: 401})
      await expect(res).rejects.not.toThrow(/do-not-print-me|example\(secret/)
    })

    test('reports the status without the request when the refreshed token is rejected too', async () => {
      const res = graphqlRequest({
        query,
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables,
        unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: 'refreshed-token'})},
      })

      let requestCount = 0
      server.events.on('request:start', () => {
        requestCount++
      })

      await expect(res).rejects.toMatchObject({statusCode: 401})
      await expect(res).rejects.not.toThrow(/do-not-print-me|example\(secret/)
      expect(requestCount).toBe(2)
    })

    test('keeps the raw error when the caller handles errors itself', async () => {
      const res = graphqlRequest({
        query,
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables,
        responseOptions: {handleErrors: false},
        unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: 'refreshed-token'})},
      })

      await expect(res).rejects.toMatchObject({response: {status: 401}})
    })
  })

  test('Fails without retry when bad request when unauthorized handler is provided', async () => {
    const res = graphqlRequest({
      query: 'query FailsWithBadRequest { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      responseOptions: {handleErrors: false},
      unauthorizedHandler: {type: 'token_refresh', handler: async () => ({token: 'refreshed-token'})},
    })
    let requestCount = 0
    server.events.on('request:start', () => {
      requestCount++
    })

    await expect(res).rejects.toThrow('bad request')
    expect(requestCount).toBe(1)
  })
})

describe('graphqlRequestDoc', () => {
  test('converts document before querying', async () => {
    // Given
    const document = {
      kind: 'Document',
      definitions: [
        {
          kind: 'OperationDefinition',
          operation: 'query',
          name: {kind: 'Name', value: 'QueryName'},
          selectionSet: {
            kind: 'SelectionSet',
            selections: [
              {
                kind: 'Field',
                name: {kind: 'Name', value: 'example'},
              },
            ],
          },
        },
      ],
    } as unknown as TypedDocumentNode<unknown, unknown>

    // When
    const res = await graphqlRequestDoc({
      query: document,
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
    })
    expect(res).toMatchInlineSnapshot(`
      {
        "QueryName": {
          "example": "hello",
        },
      }
    `)

    expect(debugRequest.debugLogRequestInfo).toHaveBeenCalledWith(
      'mockApi',
      `query QueryName {
  example
}`,
      'https://shopify.example/graphql',
      mockVariables,
      expect.anything(),
    )
  })

  test('applies rate limit restoration', async () => {
    const document = {
      kind: 'Document',
      definitions: [
        {
          kind: 'OperationDefinition',
          operation: 'query',
          name: {kind: 'Name', value: 'QueryName'},
          selectionSet: {
            kind: 'SelectionSet',
            selections: [
              {
                kind: 'Field',
                name: {kind: 'Name', value: 'example'},
              },
            ],
          },
        },
      ],
    } as unknown as TypedDocumentNode<unknown, unknown>

    // When
    const res = await graphqlRequestDoc({
      query: document,
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      addedHeaders: mockedAddedHeaders,
      variables: mockVariables,
      autoRateLimitRestore: true,
    })
    expect(res).toMatchInlineSnapshot(`
      {
        "QueryName": {
          "example": "hello",
        },
      }
    `)
    expect(system.sleep).toHaveBeenCalledWith(0.001)
  })
})

describe('sanitizeVariables', () => {
  test('masks sensitive data at the top level', () => {
    const variables = {
      apiKey: 'secret-key',
      normalField: 'normal-value',
      serialized_script: 'sensitive-script',
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.apiKey).toBe('*****')
    expect(parsed.normalField).toBe('normal-value')
    expect(parsed.serialized_script).toBe('*****')
  })

  test('masks sensitive data in deeply nested objects', () => {
    const variables = {
      level1: {
        apiKey: 'secret-key',
        level2: {
          serialized_script: 'sensitive-script',
          normal: 'normal-value',
        },
      },
      topLevel: 'normal',
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.level1.apiKey).toBe('*****')
    expect(parsed.level1.level2.serialized_script).toBe('*****')
    expect(parsed.level1.level2.normal).toBe('normal-value')
    expect(parsed.topLevel).toBe('normal')
  })

  test('handles arrays correctly', () => {
    const variables = {
      items: [{apiKey: 'secret1'}, {apiKey: 'secret2'}, {normal: 'value'}],
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.items[0].apiKey).toBe('*****')
    expect(parsed.items[1].apiKey).toBe('*****')
    expect(parsed.items[2].normal).toBe('value')
  })

  test('does not change primitive values', () => {
    const variables = {
      number: 123,
      string: 'normal',
      boolean: true,
      null: null,
      undefined,
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.number).toBe(123)
    expect(parsed.string).toBe('normal')
    expect(parsed.boolean).toBe(true)
    expect(parsed.null).toBe(null)
    expect(parsed.undefined).toBe(undefined)
  })

  test('hides values in json string', () => {
    const variables = {
      json: '{"api_version": 1, "serialized_script": "ddddddddd"}',
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.json).toBe('{"api_version":1,"serialized_script":"*****"}')
  })

  test('handling invalid json', () => {
    const variables = {
      json: '{"api_version": 1',
    }

    const result = debugRequest.sanitizeVariables(variables)
    const parsed = JSON.parse(result)

    expect(parsed.json).toBe('{"api_version": 1')
  })
})

describe('graphqlRequest with caching', () => {
  test('uses cache when TTL is provided', async () => {
    vi.useFakeTimers()
    await inTemporaryDirectory(async (dir) => {
      let requestCount = 0
      server.events.on('request:start', () => {
        requestCount++
      })

      const cacheStore = new LocalStorage<ConfSchema>({projectName: 'test', cwd: dir})
      const mutationHash = nonRandomUUID('mutation MutationName($some: String!) { example }')
      const firstVariablesHash = nonRandomUUID(JSON.stringify(mockVariables))
      const otherVariablesHash = nonRandomUUID(JSON.stringify({...mockVariables, some: 'new-value'}))

      // make first request
      const firstRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: mockVariables,
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheExtraKey: 'extra',
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(firstRes).resolves.toEqual({MutationName: {example: 'variables'}})
      expect(requestCount).toBe(1)

      // repeated request uses cache
      const secondRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: mockVariables,
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheExtraKey: 'extra',
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(secondRes).resolves.toEqual({MutationName: {example: 'variables'}})
      expect(requestCount).toBe(1)

      // variable changes break the cache
      const thirdRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: {...mockVariables, some: 'new-value'},
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheExtraKey: 'extra',
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(thirdRes).resolves.toEqual({MutationName: {example: 'new-value'}})
      expect(requestCount).toBe(2)

      // extra key breaks the cache
      const fourthRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: {...mockVariables, some: 'new-value'},
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheExtraKey: 'other-extra',
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(fourthRes).resolves.toEqual({MutationName: {example: 'new-value'}})
      expect(requestCount).toBe(3)

      // fast-forward by an hour
      await vi.advanceTimersByTimeAsync(1000 * 60 * 60)
      const fifthRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: {...mockVariables, some: 'new-value'},
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheExtraKey: 'other-extra',
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(fifthRes).resolves.toEqual({MutationName: {example: 'new-value'}})
      expect(requestCount).toBe(4)

      // no extra breaks the cache
      const sixthRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: {...mockVariables, some: 'new-value'},
        cacheOptions: {
          cacheTTL: {hours: 1},
          cacheStore,
        },
      })
      await vi.runAllTimersAsync()
      await expect(sixthRes).resolves.toEqual({MutationName: {example: 'new-value'}})
      expect(requestCount).toBe(5)

      // finally, no cache options means no cache
      const seventhRes = graphqlRequest({
        query: 'mutation MutationName($some: String!) { example }',
        api: 'mockApi',
        url: mockedAddress,
        token: mockToken,
        variables: {...mockVariables, some: 'new-value'},
      })
      await vi.runAllTimersAsync()
      await expect(seventhRes).resolves.toEqual({MutationName: {example: 'new-value'}})
      expect(requestCount).toBe(6)

      const principalHash = sha256(JSON.stringify([mockedAddress, mockToken])).toString('hex')
      const firstKey: GraphQLRequestKey = `q-${mutationHash}-${firstVariablesHash}-${CLI_KIT_VERSION}-${principalHash}-extra`
      const withOtherVariablesKey: GraphQLRequestKey = `q-${mutationHash}-${otherVariablesHash}-${CLI_KIT_VERSION}-${principalHash}-extra`
      const withOtherExtraKey: GraphQLRequestKey = `q-${mutationHash}-${otherVariablesHash}-${CLI_KIT_VERSION}-${principalHash}-other-extra`
      const noExtraKey: GraphQLRequestKey = `q-${mutationHash}-${otherVariablesHash}-${CLI_KIT_VERSION}-${principalHash}-`

      expect(cacheStore.get('cache')![firstKey]).toEqual({
        value: '{"MutationName":{"example":"variables"}}',
        timestamp: expect.any(Number),
      })
      expect(cacheStore.get('cache')![withOtherVariablesKey]).toEqual({
        value: '{"MutationName":{"example":"new-value"}}',
        timestamp: expect.any(Number),
      })
      expect(cacheStore.get('cache')![withOtherExtraKey]).toEqual({
        value: '{"MutationName":{"example":"new-value"}}',
        timestamp: expect.any(Number),
      })
      expect(cacheStore.get('cache')![noExtraKey]).toEqual({
        value: '{"MutationName":{"example":"new-value"}}',
        timestamp: expect.any(Number),
      })

      expect(Object.keys(cacheStore.get('cache')!).length).toBe(4)
    })
    vi.useRealTimers()
  })

  test('does not share a cached response across tokens or endpoints', async () => {
    vi.useFakeTimers()
    await inTemporaryDirectory(async (dir) => {
      let requestCount = 0
      server.events.on('request:start', () => {
        requestCount++
      })
      const cacheStore = new LocalStorage<ConfSchema>({projectName: 'test', cwd: dir})
      const cachedRequest = async (options: {url: string; token: string}) => {
        const response = graphqlRequest({
          query: 'mutation MutationName($some: String!) { example }',
          api: 'mockApi',
          url: options.url,
          token: options.token,
          variables: mockVariables,
          cacheOptions: {cacheTTL: {hours: 1}, cacheStore},
        })
        await vi.runAllTimersAsync()
        return response
      }

      // Given a cached response for one token and endpoint
      await expect(cachedRequest({url: mockedAddress, token: mockToken})).resolves.toEqual({
        MutationName: {example: 'variables'},
      })
      expect(requestCount).toBe(1)

      // When the same query and variables are sent with another token, or to another endpoint
      await cachedRequest({url: mockedAddress, token: 'other-token'})
      await cachedRequest({url: `${mockedAddress}?other-endpoint=1`, token: mockToken})

      // Then each one is sent to the API instead of reading the first response
      expect(requestCount).toBe(3)

      // And a repeated request with the original token and endpoint still uses its own cache entry
      await cachedRequest({url: mockedAddress, token: mockToken})
      expect(requestCount).toBe(3)

      // And the raw tokens are not part of any cache key
      const keys = Object.keys(cacheStore.get('cache')!)
      expect(keys.length).toBe(3)
      for (const key of keys) {
        expect(key).not.toContain(mockToken)
        expect(key).not.toContain('other-token')
      }
    })
    vi.useRealTimers()
  })

  test('skips cache when no TTL is provided', async () => {
    const retryAwareSpy = vi
      .spyOn(api, 'retryAwareRequest')
      .mockImplementation(async () => ({status: 200, headers: new Headers()}))

    const cacheRetrieveSpy = vi.spyOn(confStore, 'cacheRetrieveOrRepopulate')

    // When
    await graphqlRequest({
      query: 'query QueryName { example }',
      api: 'mockApi',
      url: mockedAddress,
      token: mockToken,
      variables: mockVariables,
    })

    // Then
    expect(cacheRetrieveSpy).not.toHaveBeenCalled()
    expect(retryAwareSpy).toHaveBeenCalled()
  })
})