hermes - 💡(How to fix) Fix google-workspace: add test coverage for check_auth() refresh-error branches and check_auth_live() [1 pull requests]

Context

Follow-up to #19570 / PR #19643. The shipped change added ~40 lines of branching error-handling in skills/productivity/google-workspace/scripts/setup.py with user-visible copy strings (OAUTH_CLIENT_DISABLED:, TOKEN_REVOKED:, LIVE_CHECK_OK:, LIVE_CHECK_FAILED:), but no tests accompany it. Test infrastructure for this file already exists at tests/skills/test_google_oauth_setup.py (324 lines, importlib-loads setup.py and mocks FakeFlow).

Without tests, the substring thresholds and output contract will rot silently the next time google-auth changes str(RefreshError) or anyone renames an output marker.

Scope

Add the following tests to tests/skills/test_google_oauth_setup.py. Each mocks google.oauth2.credentials.Credentials.from_authorized_user_file / .refresh to drive the control flow without network.

1. test_check_auth_refresh_disabled_client_prints_guidance Inject RefreshError("disabled_client: ...", {"error": "disabled_client"}) on refresh. Assert:

   • Function returns False
   • Output contains OAUTH_CLIENT_DISABLED:
   • Output contains accounts.google.com/signin/recovery

2. test_check_auth_refresh_invalid_grant_prints_reauth Inject RefreshError("invalid_grant: ...", {"error": "invalid_grant"}). Assert:

   • Returns False
   • Output contains TOKEN_REVOKED: and Re-run setup

3. test_check_auth_refresh_generic_error_falls_through Inject a generic Exception("something else"). Assert:

   • Returns False
   • Output contains REFRESH_FAILED: and does NOT contain OAUTH_CLIENT_DISABLED or TOKEN_REVOKED

4. test_check_auth_live_success Happy path: mock googleapiclient.discovery.build to return a fake service whose calendarList().list(...).execute() returns a dict. Assert:

   • Returns True
   • Output contains LIVE_CHECK_OK:
   • Output does NOT contain AUTHENTICATED: (quiet=True contract from 83c23e886)

5. test_check_auth_live_disabled_client Mock execute() to raise an exception whose str() contains disabled_client. Assert:

   • Returns False
   • Output contains LIVE_CHECK_FAILED: and OAuth client or account disabled

6. test_check_auth_live_partial_scope_should_not_panic (regression guard for #21861) Mock execute() to raise HttpError with 403 + insufficient-scope body. This test can be written now and marked xfail until #21861 is fixed, at which point it flips to a passing assertion that a valid-but-narrow-scope token is not misclassified as a disabled client.

Acceptance criteria

• Six tests added to tests/skills/test_google_oauth_setup.py.
• bash scripts/run_tests.sh tests/skills/test_google_oauth_setup.py passes.
• Optionally: the contract string (OAUTH_CLIENT_DISABLED:, LIVE_CHECK_OK:, LIVE_CHECK_FAILED:) extracted into module-level constants in setup.py so the tests assert on names rather than literal strings — prevents drift between what setup.py prints and what tests grep for.

References

• Existing test patterns: tests/skills/test_google_oauth_setup.py (324 lines, FakeFlow fixture)
• Original PR: #19643 (closed, salvaged as 5fa493a2c + 83c23e886)
• Issue: #19570

Related

Worth bundling with #21860 (structured RefreshError matching) and #21861 (partial-scope live-probe fix) — a single "harden google-workspace setup.py error handling" PR that ships all three plus tests is tidier than three independent PRs on the same ~60 lines.