[quality] test: pin contributor token-reissue rotation semantics (src/pkg/dashboard/api_contribute.go handleContributeReissueToken)

[kubestellar-hive]

Test Improvement

Adds src/pkg/dashboard/contribute_reissue_token_test.go pinning the untested branches of handleContributeReissueToken and reissueContributorToken in src/pkg/dashboard/api_contribute.go — the authenticated credential-rotation endpoint (POST /api/contribute/reissue-token).

Existing tests covered only the two 401 refusals. Newly pinned:

• Success path rotates for real: new plaintext token returned, profile stores only its sha256 (never plaintext), TokenPlain cleared, old token hash invalidated.
• Legacy token <t> Authorization scheme accepted alongside Bearer.
• 404 for authenticated-but-unregistered identities — and no profile file is conjured into existence.
• 403 for revoked contributors — and the stored credential is NOT rotated, so revocation can't be laundered into a fresh token.
• 401 for unknown Authorization schemes (e.g. Basic), with the stored token untouched.

Coverage: handleContributeReissueToken 51.9% → 100%; reissueContributorToken → 100%. Tests are hermetic (temp HIVE_CONTRIBUTORS_DIR, mock GitHub /user via the existing v1Server/userMock helpers; unique tokens per test to sidestep the process-wide ghTokenCache).

Overlap preflight

Disjoint from all open hold-gated PRs: #6343 (terminal_handoff), #6342 (github IssueClosedAt), #6330 (agent thrash poller), #6292 (contribute local-mode warning / relay), #6327 (pkg/hub).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback