test(login): cover guest valid-key claim and stale-key guest credentials

Add unit test for guest profile with valid key reaching signup claim flow.
Update guest acceptance test to assert guest_user_id/guest_api_key on POST
after validate 401 without auth_intent.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

pkg/login/client_login_test.go

@@ -119,3 +119,95 @@ api_key = "hk_test_oldkey_abcdefghij"
 	require.Equal(t, 1, pollHits, "poll should run once with immediate claimed=true")
 	require.Equal(t, "hk_test_newkey_abcdefghij", cfg.Profile.APIKey)
 }
+
+// TestLogin_guestProfileWithValidKeyStartsClaimFlow verifies that a guest Console
+// profile with a still-valid API key skips the early-return path and POSTs guest
+// credentials to /cli-auth for browser signup claim.
+func TestLogin_guestProfileWithValidKeyStartsClaimFlow(t *testing.T) {
+	configpkg.ResetAPIClientForTesting()
+	t.Cleanup(configpkg.ResetAPIClientForTesting)
+
+	oldCan := canOpenBrowser
+	oldOpen := openBrowser
+	canOpenBrowser = func() bool { return false }
+	openBrowser = func(string) error { return nil }
+	t.Cleanup(func() {
+		canOpenBrowser = oldCan
+		openBrowser = oldOpen
+	})
+
+	var cli_auth_body map[string]string
+	pollHits := 0
+	var serverURL string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/cli-auth/validate"):
+			body, err := json.Marshal(map[string]string{
+				"user_id":           "usr_guest",
+				"user_name":         "Guest",
+				"user_email":        "guest@example.com",
+				"organization_name": "Org",
+				"organization_id":   "org_1",
+				"team_id":           "tm_console",
+				"team_name_no_org":  "Sandbox",
+				"team_mode":         "console",
+				"client_id":         "cl_guest",
+			})
+			require.NoError(t, err)
+			_, _ = w.Write(body)
+		case r.Method == http.MethodPost && strings.HasSuffix(r.URL.Path, "/cli-auth"):
+			require.NoError(t, json.NewDecoder(r.Body).Decode(&cli_auth_body))
+			pollURL := serverURL + hookdeck.APIPathPrefix + "/cli-auth/poll?key=pollkey"
+			body, err := json.Marshal(map[string]string{
+				"browser_url": "https://example.test/signup?redirect=%2Fcli-auth%2Fkey",
+				"poll_url":    pollURL,
+			})
+			require.NoError(t, err)
+			_, _ = w.Write(body)
+		case r.Method == http.MethodGet && strings.Contains(r.URL.Path, "/cli-auth/poll"):
+			pollHits++
+			resp := map[string]interface{}{
+				"claimed":           true,
+				"key":               "hk_test_claimed_abcdefghij",
+				"team_id":           "tm_console",
+				"team_mode":         "console",
+				"team_name":         "Sandbox",
+				"user_name":         "Guest",
+				"user_email":        "claimed@example.com",
+				"organization_name": "Org",
+				"organization_id":   "org_1",
+				"client_id":         "cl_claimed",
+			}
+			enc, err := json.Marshal(resp)
+			require.NoError(t, err)
+			_, _ = w.Write(enc)
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	serverURL = ts.URL
+	t.Cleanup(ts.Close)
+
+	configPath := filepath.Join(t.TempDir(), "config.toml")
+	require.NoError(t, os.WriteFile(configPath, []byte(`profile = "default"
+
+[default]
+api_key = "hk_test_guestkey_abcdefghij"
+guest_url = "https://console.test/signin/guest?token=abc"
+guest_user_id = "usr_guest"
+`), 0o600))
+
+	cfg, err := configpkg.LoadConfigFromFile(configPath)
+	require.NoError(t, err)
+	cfg.APIBaseURL = ts.URL
+	cfg.DeviceName = "test-device"
+	cfg.LogLevel = "error"
+	cfg.TelemetryDisabled = true
+
+	err = Login(cfg, strings.NewReader("\n"))
+	require.NoError(t, err)
+	require.Equal(t, "usr_guest", cli_auth_body["guest_user_id"])
+	require.Equal(t, "hk_test_guestkey_abcdefghij", cli_auth_body["guest_api_key"])
+	require.Equal(t, 1, pollHits)
+	require.Equal(t, "hk_test_claimed_abcdefghij", cfg.Profile.APIKey)
+}

pkg/login/login_intent_test.go

@@ -4,46 +4,31 @@ import (
 	"testing"
 
 	configpkg "github.com/hookdeck/hookdeck-cli/pkg/config"
-	"github.com/hookdeck/hookdeck-cli/pkg/hookdeck"
 	"github.com/stretchr/testify/require"
 )
 
-func TestResolveLoginIntent_guestProfileDefaultsClaimGuest(t *testing.T) {
+func TestBuildStartLoginInput_guestProfileIncludesCredentials(t *testing.T) {
 	cfg := &configpkg.Config{
+		DeviceName: "dev",
 		Profile: configpkg.Profile{
 			GuestURL:    "https://console.test/signin/guest?token=abc",
 			GuestUserID: "usr_guest",
 			APIKey:      "hk_guest_key",
 		},
 	}
 
-	require.Equal(t, hookdeck.CLIAuthIntentClaimGuest, resolveLoginIntent(cfg))
-}
-
-func TestResolveLoginIntent_noGuestProfileDefaultsLogin(t *testing.T) {
-	cfg := &configpkg.Config{
-		Profile: configpkg.Profile{},
-	}
-
-	require.Equal(t, hookdeck.CLIAuthIntentLogin, resolveLoginIntent(cfg))
+	input := buildStartLoginInput(cfg, "")
+	require.Equal(t, "usr_guest", input.GuestUserID)
+	require.Equal(t, "hk_guest_key", input.GuestAPIKey)
 }
 
-func TestBuildStartLoginInput_guestCredentialsOnlyForClaim(t *testing.T) {
+func TestBuildStartLoginInput_noGuestProfileOmitsCredentials(t *testing.T) {
 	cfg := &configpkg.Config{
 		DeviceName: "dev",
-		Profile: configpkg.Profile{
-			GuestURL:    "https://console.test/signin/guest?token=abc",
-			GuestUserID: "usr_guest",
-			APIKey:      "hk_guest_key",
-		},
+		Profile:    configpkg.Profile{},
 	}
 
-	login_input := buildStartLoginInput(cfg, hookdeck.CLIAuthIntentLogin, "")
-	require.Equal(t, hookdeck.CLIAuthIntentLogin, login_input.AuthIntent)
-	require.Empty(t, login_input.GuestUserID)
-	require.Empty(t, login_input.GuestAPIKey)
-
-	claim_input := buildStartLoginInput(cfg, hookdeck.CLIAuthIntentClaimGuest, "")
-	require.Equal(t, "usr_guest", claim_input.GuestUserID)
-	require.Equal(t, "hk_guest_key", claim_input.GuestAPIKey)
+	input := buildStartLoginInput(cfg, "")
+	require.Empty(t, input.GuestUserID)
+	require.Empty(t, input.GuestAPIKey)
 }

test/acceptance/README.md

@@ -13,7 +13,7 @@ These tests run automatically in CI using API keys from `hookdeck ci`. They don'
 
 **Login recovery (mock API, `basic` tag):** `login_auth_acceptance_test.go` runs the real CLI with `--api-base` pointing at a local server that returns **401** on `GET .../cli-auth/validate`, then completes a fake device-auth poll — this asserts `hookdeck login` continues into browser/device flow after a stale key (no human, no real Hookdeck key). The same file includes **`TestCIFailsFastWithInvalidAPIKeyAcceptance`**, which runs `hookdeck ci --api-key` with a bogus key against the real API and expects a quick failure with the friendly **Authentication failed** message, and asserts output does **not** contain browser/device-login phrases (`Press Enter to open the browser`, `To authenticate with Hookdeck`, etc.) so CI never enters the interactive `hookdeck login` flow.
 
-**Guest login intents (mock API, `guest` tag):** `guest_login_acceptance_test.go` asserts `POST /cli-auth` receives `claim_guest` with guest credentials when a guest profile is present, and `login` without guest credentials after logout (empty profile).
+**Guest login (mock API, `guest` tag):** `guest_login_acceptance_test.go` asserts `POST /cli-auth` receives guest credentials when a guest profile is present, and omits them after logout (empty profile).
 
 ### 2. Manual Tests (Require Human Interaction)
 These tests require browser-based authentication via `hookdeck login` and must be run manually by developers.

test/acceptance/guest_login_acceptance_test.go

@@ -130,16 +130,16 @@ func TestGuestLoginDefaultClaimGuestAcceptance(t *testing.T) {
 	require.NoError(t, os.WriteFile(configPath, []byte(guestProfileConfig()), 0o600))
 
 	ts, serverURL := newGuestLoginMock(t, func(body map[string]interface{}) {
-		require.Equal(t, "claim_guest", body["auth_intent"])
 		require.Equal(t, "usr_guest_accept", body["guest_user_id"])
 		require.Equal(t, "hk_test_stale_guest01", body["guest_api_key"])
+		require.NotContains(t, body, "auth_intent")
 	}, "https://example.test/signup?redirect=%2Fcli-auth%2Fkey")
 
 	runGuestLoginCLI(t, projectRoot, configPath, serverURL)
 	_ = ts
 }
 
-func TestGuestLoginAfterLogoutUsesLoginIntentAcceptance(t *testing.T) {
+func TestGuestLoginAfterLogoutOmitsGuestCredentialsAcceptance(t *testing.T) {
 	if testing.Short() {
 		t.Skip("Skipping acceptance test in short mode")
 	}
@@ -151,7 +151,7 @@ func TestGuestLoginAfterLogoutUsesLoginIntentAcceptance(t *testing.T) {
 	require.NoError(t, os.WriteFile(configPath, []byte(loggedOutProfileConfig()), 0o600))
 
 	ts, serverURL := newGuestLoginMock(t, func(body map[string]interface{}) {
-		require.Equal(t, "login", body["auth_intent"])
+		require.NotContains(t, body, "auth_intent")
 		require.NotContains(t, body, "guest_user_id")
 		require.NotContains(t, body, "guest_api_key")
 	}, "https://example.test/signin?redirect=%2Fcli-auth%2Fkey")