From 22596a5df2e70595dfe6bf03291008dfcbec864b Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 11:45:13 +0200
Subject: [PATCH 01/15] fix(auth): use a fresh mux and server per interactive
 auth attempt

---
 pkg/auth_service.go      |  54 +++++++++++++---
 pkg/auth_service_test.go | 131 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 175 insertions(+), 10 deletions(-)
 create mode 100644 pkg/auth_service_test.go

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 1726494a..1fccfd2c 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"math/rand"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -22,11 +23,15 @@ import (
 )
 
 const (
-	httpAuthPort   = 10999
-	oAuthQoveryUrl = "https://auth.qovery.com/login?code_challenge_method=S256&scope=%s&client=%s&protocol=oauth2&response_type=%s&audience=%s&redirect_uri=%s&code_challenge=%s"
+	httpAuthPort     = 10999
+	qoveryConsoleUrl = "https://console.qovery.com"
+	oAuthQoveryUrl   = "https://auth.qovery.com/login?code_challenge_method=S256&scope=%s&client=%s&protocol=oauth2&response_type=%s&audience=%s&redirect_uri=%s&code_challenge=%s"
 )
 
 var (
+	// Delay before the callback server shuts down, so the browser gets its response.
+	authShutdownDelay = time.Second
+
 	oAuthUrlParamValueClient         = "MJ2SJpu12PxIzgmc5z5Y7N8m5MnaF7Y0"
 	oAuthUrlParamValueHeadlessClient = "f9drkTNpxsEw2VU2PVDrxhyT3vVuFT0Y"
 	oAuthUrlParamValueAudience       = "https://core.qovery.com"
@@ -51,8 +56,6 @@ type DeviceFlowParameters struct {
 }
 
 func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
-	qoveryConsoleUrl := "https://console.qovery.com"
-
 	if !skipVersionCheck {
 		available, message, _ := CheckAvailableNewVersion()
 		if available {
@@ -70,15 +73,45 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 		utils.PrintlnError(errors.New("can not create authorization code challenge. Please contact the #support at 'https://discord.qovery.com'. "))
 		os.Exit(0)
 	}
+	// TODO link to web auth
+	_ = browser.OpenURL(fmt.Sprintf(oAuthQoveryUrl, url.QueryEscape(oAuthUrlParamValueScopes), oAuthUrlParamValueClient, url.QueryEscape(oAuthUrlParamValueResponseType),
+		url.QueryEscape(oAuthUrlParamValueAudience), url.QueryEscape(oAuthUrlParamValueRedirect), challenge))
+
+	// Listen before opening the browser so a busy port is reported instead of
+	// leaving the user waiting on a callback that can never arrive.
+	srv := newAuthorizationServer(verifier, storeTokens)
+	listener, err := net.Listen("tcp", srv.Addr)
+	if err != nil {
+		utils.PrintlnError(fmt.Errorf("can not listen on %s for the authentication callback, is another 'qovery auth' running? %w", srv.Addr, err))
+		os.Exit(1)
+	}
+
 	// TODO link to web auth
 	_ = browser.OpenURL(fmt.Sprintf(oAuthQoveryUrl, url.QueryEscape(oAuthUrlParamValueScopes), oAuthUrlParamValueClient, url.QueryEscape(oAuthUrlParamValueResponseType),
 		url.QueryEscape(oAuthUrlParamValueAudience), url.QueryEscape(oAuthUrlParamValueRedirect), challenge))
 
 	fmt.Println("\nOpening your browser, waiting for your authentication... ")
 
+	// Serve returns as soon as Shutdown starts, and Shutdown closes the listener
+	// first, so the fixed port is free again when this function returns.
+	_ = srv.Serve(listener)
+}
+
+func storeTokens(tokens TokensResponse) {
+	expiredAt := time.Now().Local().Add(time.Duration(tokens.ExpiresIn-60) * time.Second)
+	_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
+}
+
+// newAuthorizationServer builds a server with its own mux for one interactive
+// authentication attempt. The handlers must not be registered on
+// http.DefaultServeMux: a second attempt in the same process (re-auth after a
+// 401) would panic on the duplicate "/authorization" pattern. The PKCE verifier
+// is captured per attempt.
+func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *http.Server {
 	srv := &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}
+	mux := http.NewServeMux()
 
-	http.HandleFunc("/authorization", func(writer http.ResponseWriter, request *http.Request) {
+	mux.HandleFunc("/authorization", func(writer http.ResponseWriter, request *http.Request) {
 		js := fmt.Sprintf(`<script type="text/javascript" charset="utf-8">
 				var hash = window.location.search.split("=")[1].split("&")[0];
 				var xmlHttp = new XMLHttpRequest();
@@ -92,7 +125,7 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 		_, _ = writer.Write([]byte("Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: <a href='" + qoveryConsoleUrl + "'>" + qoveryConsoleUrl + "</a>"))
 	})
 
-	http.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
+	mux.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
 		code := request.URL.Query()["code"][0]
 		res, err := http.PostForm(oAuthTokenEndpoint, url.Values{
 			"grant_type":    {"authorization_code"},
@@ -116,20 +149,21 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 				utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
 				os.Exit(0)
 			}
-			expiredAt := time.Now().Local().Add(time.Duration(tokens.ExpiresIn-60) * time.Second)
-			_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
+			onTokens(tokens)
 			utils.PrintlnInfo("Success!")
 		}
 
+		delay := authShutdownDelay
 		go func() {
-			time.Sleep(time.Second)
+			time.Sleep(delay)
 			if err := srv.Shutdown(context.TODO()); err != nil {
 				utils.PrintlnError(err)
 			}
 		}()
 	})
 
-	_ = srv.ListenAndServe()
+	srv.Handler = mux
+	return srv
 }
 
 func createCodeVerifier() string {
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
new file mode 100644
index 00000000..292ff9fb
--- /dev/null
+++ b/pkg/auth_service_test.go
@@ -0,0 +1,131 @@
+package pkg
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+)
+
+// stubTokenEndpoint records the code_verifier of every token exchange.
+func stubTokenEndpoint(t *testing.T) *[]string {
+	t.Helper()
+	var mu sync.Mutex
+	verifiers := []string{}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = r.ParseForm()
+		mu.Lock()
+		verifiers = append(verifiers, r.PostForm.Get("code_verifier")+"|"+r.PostForm.Get("code"))
+		mu.Unlock()
+		_, _ = w.Write([]byte(`{"access_token":"at","refresh_token":"rt","expires_in":3600}`))
+	}))
+	t.Cleanup(ts.Close)
+
+	prevEndpoint, prevDelay := oAuthTokenEndpoint, authShutdownDelay
+	oAuthTokenEndpoint = ts.URL
+	authShutdownDelay = 0
+	t.Cleanup(func() { oAuthTokenEndpoint, authShutdownDelay = prevEndpoint, prevDelay })
+	return &verifiers
+}
+
+func get(t *testing.T, url string) string {
+	t.Helper()
+	res, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("GET %s: %v", url, err)
+	}
+	defer func() { _ = res.Body.Close() }()
+	body, _ := io.ReadAll(res.Body)
+	return string(body)
+}
+
+func TestAuthorizationServerRepeatedAttemptsUseTheirOwnVerifier(t *testing.T) {
+	verifiers := stubTokenEndpoint(t)
+
+	// Reuse the same address for every attempt, like the fixed callback port.
+	first, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addr := first.Addr().String()
+	listener := first
+
+	var stored []TokensResponse
+	for i, verifier := range []string{"verifier-1", "verifier-2", "verifier-3"} {
+		srv := newAuthorizationServer(verifier, func(tokens TokensResponse) { stored = append(stored, tokens) })
+
+		done := make(chan error, 1)
+		// A second attempt used to panic here on the duplicate "/authorization" pattern.
+		go func() { done <- srv.Serve(listener) }()
+
+		code := "code-" + verifier
+		if body := get(t, "http://"+addr+"/authorization?code="+code); body == "" {
+			t.Fatalf("attempt %d: empty /authorization body", i)
+		}
+		get(t, "http://"+addr+"/authorization/valid?code="+code)
+
+		select {
+		case err := <-done:
+			if err != http.ErrServerClosed {
+				t.Fatalf("attempt %d: Serve returned %v, want ErrServerClosed", i, err)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatalf("attempt %d: server did not shut down after the callback", i)
+		}
+
+		// The port must be free for the next attempt.
+		listener, err = net.Listen("tcp", addr)
+		if err != nil {
+			t.Fatalf("attempt %d: port not released after shutdown: %v", i, err)
+		}
+	}
+	_ = listener.Close()
+
+	want := []string{"verifier-1|code-verifier-1", "verifier-2|code-verifier-2", "verifier-3|code-verifier-3"}
+	if len(*verifiers) != len(want) {
+		t.Fatalf("token exchanges = %v, want %v", *verifiers, want)
+	}
+	for i := range want {
+		if (*verifiers)[i] != want[i] {
+			t.Errorf("exchange %d = %q, want %q", i, (*verifiers)[i], want[i])
+		}
+	}
+	if len(stored) != 3 || stored[0].AccessToken != "at" || stored[0].RefreshToken != "rt" {
+		t.Errorf("stored tokens = %+v", stored)
+	}
+}
+
+func TestAuthorizationServersDoNotShareHandlers(t *testing.T) {
+	verifiers := stubTokenEndpoint(t)
+
+	a := httptest.NewServer(newAuthorizationServer("verifier-a", func(TokensResponse) {}).Handler)
+	defer a.Close()
+	b := httptest.NewServer(newAuthorizationServer("verifier-b", func(TokensResponse) {}).Handler)
+	defer b.Close()
+
+	get(t, b.URL+"/authorization/valid?code=c")
+	get(t, a.URL+"/authorization/valid?code=c")
+
+	want := []string{"verifier-b|c", "verifier-a|c"}
+	for i := range want {
+		if (*verifiers)[i] != want[i] {
+			t.Errorf("exchange %d = %q, want %q", i, (*verifiers)[i], want[i])
+		}
+	}
+	if len(*verifiers) != 2 {
+		t.Errorf("token exchanges = %v, want %v", *verifiers, want)
+	}
+}
+
+func TestAuthorizationServerDoesNotUseDefaultServeMux(t *testing.T) {
+	stubTokenEndpoint(t)
+	_ = newAuthorizationServer("v", func(TokensResponse) {})
+	_ = newAuthorizationServer("v", func(TokensResponse) {})
+
+	if _, pattern := http.DefaultServeMux.Handler(httptest.NewRequest(http.MethodGet, "/authorization", nil)); pattern != "" {
+		t.Errorf("/authorization registered on http.DefaultServeMux (pattern %q)", pattern)
+	}
+}

From 193dd268a72252a52eb71b5b32e6d0f64e88c6b2 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 11:48:48 +0200
Subject: [PATCH 02/15] fix(auth): open the browser once, after the listener is
 bound

---
 pkg/auth_service.go | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 1fccfd2c..fd6308c4 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -73,10 +73,6 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 		utils.PrintlnError(errors.New("can not create authorization code challenge. Please contact the #support at 'https://discord.qovery.com'. "))
 		os.Exit(0)
 	}
-	// TODO link to web auth
-	_ = browser.OpenURL(fmt.Sprintf(oAuthQoveryUrl, url.QueryEscape(oAuthUrlParamValueScopes), oAuthUrlParamValueClient, url.QueryEscape(oAuthUrlParamValueResponseType),
-		url.QueryEscape(oAuthUrlParamValueAudience), url.QueryEscape(oAuthUrlParamValueRedirect), challenge))
-
 	// Listen before opening the browser so a busy port is reported instead of
 	// leaving the user waiting on a callback that can never arrive.
 	srv := newAuthorizationServer(verifier, storeTokens)

From 9e28afd11d047407bd3f37df5ff9b0a4fd06c512 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:08:08 +0200
Subject: [PATCH 03/15] fix(auth): reject failed token exchange and share token
 persistence

---
 pkg/auth_service.go      |  71 +++++++++++++++---------
 pkg/auth_service_test.go | 117 +++++++++++++++++++++++++++++++++------
 2 files changed, 144 insertions(+), 44 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index fd6308c4..870e49fe 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"math/rand"
 	"net"
 	"net/http"
@@ -39,6 +38,9 @@ var (
 	oAuthUrlParamValueScopes         = "offline_access openid profile email"
 	oAuthUrlParamValueRedirect       = "http://localhost:" + strconv.Itoa(httpAuthPort) + "/authorization"
 	oAuthTokenEndpoint               = "https://auth.qovery.com/oauth/token"
+
+	// exitProcess is replaceable so tests can observe an authentication failure.
+	exitProcess = os.Exit
 )
 
 type TokensResponse struct {
@@ -122,32 +124,21 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 	})
 
 	mux.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
-		code := request.URL.Query()["code"][0]
-		res, err := http.PostForm(oAuthTokenEndpoint, url.Values{
-			"grant_type":    {"authorization_code"},
-			"client_id":     {oAuthUrlParamValueClient},
-			"code":          {code},
-			"redirect_uri":  {oAuthUrlParamValueRedirect},
-			"code_verifier": {verifier},
-		})
-
+		codes := request.URL.Query()["code"]
+		if len(codes) == 0 {
+			http.Error(writer, "missing authorization code", http.StatusBadRequest)
+			return
+		}
+		tokens, err := exchangeAuthorizationCode(verifier, codes[0])
 		if err != nil {
+			// A rejected or stale code must not be stored nor reported as a success.
+			http.Error(writer, "authentication unsuccessful", http.StatusUnauthorized)
 			utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-			os.Exit(0)
-		} else {
-			defer func(Body io.ReadCloser) {
-				_ = Body.Close()
-			}(res.Body)
-
-			tokens := TokensResponse{}
-			err := json.NewDecoder(res.Body).Decode(&tokens)
-			if err != nil {
-				utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-				os.Exit(0)
-			}
-			onTokens(tokens)
-			utils.PrintlnInfo("Success!")
+			exitProcess(0)
+			return
 		}
+		onTokens(tokens)
+		utils.PrintlnInfo("Success!")
 
 		delay := authShutdownDelay
 		go func() {
@@ -162,6 +153,35 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 	return srv
 }
 
+// exchangeAuthorizationCode trades the authorization code for tokens. It fails
+// on a non-200 answer or an empty access token, which is how the token endpoint
+// reports a rejected or already used code.
+func exchangeAuthorizationCode(verifier string, code string) (TokensResponse, error) {
+	res, err := http.PostForm(oAuthTokenEndpoint, url.Values{
+		"grant_type":    {"authorization_code"},
+		"client_id":     {oAuthUrlParamValueClient},
+		"code":          {code},
+		"redirect_uri":  {oAuthUrlParamValueRedirect},
+		"code_verifier": {verifier},
+	})
+	if err != nil {
+		return TokensResponse{}, err
+	}
+	defer func() { _ = res.Body.Close() }()
+
+	if res.StatusCode != http.StatusOK {
+		return TokensResponse{}, fmt.Errorf("token endpoint answered %d", res.StatusCode)
+	}
+	tokens := TokensResponse{}
+	if err := json.NewDecoder(res.Body).Decode(&tokens); err != nil {
+		return TokensResponse{}, err
+	}
+	if tokens.AccessToken == "" {
+		return TokensResponse{}, errors.New("token endpoint returned an empty access token")
+	}
+	return tokens, nil
+}
+
 func createCodeVerifier() string {
 	length := 64
 	r := rand.New(rand.NewSource(time.Now().UnixNano()))
@@ -201,8 +221,7 @@ func runHeadlessFlow() {
 		tokens, err := getTokensWith(parameters)
 
 		if err == nil {
-			expiredAt := time.Now().Local().Add(time.Duration(tokens.ExpiresIn-60) * time.Second)
-			_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
+			storeTokens(tokens)
 			utils.PrintlnInfo("Success!")
 			return
 		}
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 292ff9fb..1b534c1c 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -10,17 +10,39 @@ import (
 	"time"
 )
 
-// stubTokenEndpoint records the code_verifier of every token exchange.
-func stubTokenEndpoint(t *testing.T) *[]string {
+// exchangeRecorder records the code_verifier of every token exchange. The
+// handler runs on server goroutines, so reads go through snapshot.
+type exchangeRecorder struct {
+	mu        sync.Mutex
+	exchanges []string
+}
+
+func (r *exchangeRecorder) record(entry string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.exchanges = append(r.exchanges, entry)
+}
+
+func (r *exchangeRecorder) snapshot() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return append([]string(nil), r.exchanges...)
+}
+
+// stubTokenEndpoint answers every token exchange with a success.
+func stubTokenEndpoint(t *testing.T) *exchangeRecorder {
+	t.Helper()
+	return stubTokenEndpointWith(t, http.StatusOK, `{"access_token":"at","refresh_token":"rt","expires_in":3600}`)
+}
+
+func stubTokenEndpointWith(t *testing.T, status int, body string) *exchangeRecorder {
 	t.Helper()
-	var mu sync.Mutex
-	verifiers := []string{}
+	recorder := &exchangeRecorder{}
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		_ = r.ParseForm()
-		mu.Lock()
-		verifiers = append(verifiers, r.PostForm.Get("code_verifier")+"|"+r.PostForm.Get("code"))
-		mu.Unlock()
-		_, _ = w.Write([]byte(`{"access_token":"at","refresh_token":"rt","expires_in":3600}`))
+		recorder.record(r.PostForm.Get("code_verifier") + "|" + r.PostForm.Get("code"))
+		w.WriteHeader(status)
+		_, _ = w.Write([]byte(body))
 	}))
 	t.Cleanup(ts.Close)
 
@@ -28,7 +50,7 @@ func stubTokenEndpoint(t *testing.T) *[]string {
 	oAuthTokenEndpoint = ts.URL
 	authShutdownDelay = 0
 	t.Cleanup(func() { oAuthTokenEndpoint, authShutdownDelay = prevEndpoint, prevDelay })
-	return &verifiers
+	return recorder
 }
 
 func get(t *testing.T, url string) string {
@@ -85,12 +107,13 @@ func TestAuthorizationServerRepeatedAttemptsUseTheirOwnVerifier(t *testing.T) {
 	_ = listener.Close()
 
 	want := []string{"verifier-1|code-verifier-1", "verifier-2|code-verifier-2", "verifier-3|code-verifier-3"}
-	if len(*verifiers) != len(want) {
-		t.Fatalf("token exchanges = %v, want %v", *verifiers, want)
+	got := verifiers.snapshot()
+	if len(got) != len(want) {
+		t.Fatalf("token exchanges = %v, want %v", got, want)
 	}
 	for i := range want {
-		if (*verifiers)[i] != want[i] {
-			t.Errorf("exchange %d = %q, want %q", i, (*verifiers)[i], want[i])
+		if got[i] != want[i] {
+			t.Errorf("exchange %d = %q, want %q", i, got[i], want[i])
 		}
 	}
 	if len(stored) != 3 || stored[0].AccessToken != "at" || stored[0].RefreshToken != "rt" {
@@ -110,14 +133,15 @@ func TestAuthorizationServersDoNotShareHandlers(t *testing.T) {
 	get(t, a.URL+"/authorization/valid?code=c")
 
 	want := []string{"verifier-b|c", "verifier-a|c"}
+	got := verifiers.snapshot()
+	if len(got) != len(want) {
+		t.Fatalf("token exchanges = %v, want %v", got, want)
+	}
 	for i := range want {
-		if (*verifiers)[i] != want[i] {
-			t.Errorf("exchange %d = %q, want %q", i, (*verifiers)[i], want[i])
+		if got[i] != want[i] {
+			t.Errorf("exchange %d = %q, want %q", i, got[i], want[i])
 		}
 	}
-	if len(*verifiers) != 2 {
-		t.Errorf("token exchanges = %v, want %v", *verifiers, want)
-	}
 }
 
 func TestAuthorizationServerDoesNotUseDefaultServeMux(t *testing.T) {
@@ -129,3 +153,60 @@ func TestAuthorizationServerDoesNotUseDefaultServeMux(t *testing.T) {
 		t.Errorf("/authorization registered on http.DefaultServeMux (pattern %q)", pattern)
 	}
 }
+
+func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
+	cases := map[string]struct {
+		status int
+		body   string
+	}{
+		"non-200 answer":     {http.StatusForbidden, `{"error":"invalid_grant"}`},
+		"200, empty tokens":  {http.StatusOK, `{}`},
+		"200, invalid JSON":  {http.StatusOK, `not json`},
+		"200, error payload": {http.StatusOK, `{"error":"invalid_grant"}`},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			stubTokenEndpointWith(t, tc.status, tc.body)
+
+			var exits []int
+			prevExit := exitProcess
+			exitProcess = func(code int) { exits = append(exits, code) }
+			t.Cleanup(func() { exitProcess = prevExit })
+
+			stored := 0
+			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored++ }).Handler)
+			defer ts.Close()
+
+			res, err := http.Get(ts.URL + "/authorization/valid?code=stale")
+			if err != nil {
+				t.Fatal(err)
+			}
+			_ = res.Body.Close()
+
+			if stored != 0 {
+				t.Errorf("tokens stored %d time(s) after a rejected exchange", stored)
+			}
+			if len(exits) != 1 {
+				t.Errorf("exit calls = %v, want exactly one", exits)
+			}
+			if res.StatusCode != http.StatusUnauthorized {
+				t.Errorf("status = %d, want %d", res.StatusCode, http.StatusUnauthorized)
+			}
+		})
+	}
+}
+
+func TestAuthorizationServerMissingCodeIsABadRequest(t *testing.T) {
+	stubTokenEndpoint(t)
+	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { t.Error("tokens stored") }).Handler)
+	defer ts.Close()
+
+	res, err := http.Get(ts.URL + "/authorization/valid")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = res.Body.Close()
+	if res.StatusCode != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", res.StatusCode, http.StatusBadRequest)
+	}
+}

From d1cd2217b2b5ffc742a6f3e140e188f9c638abe9 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:11:25 +0200
Subject: [PATCH 04/15] fix(auth): show success in the browser only after a
 successful token exchange

---
 pkg/auth_service.go      | 51 +++++++++++++++++++--------
 pkg/auth_service_test.go | 75 +++++++++++++++++++++++++++++++++++-----
 2 files changed, 102 insertions(+), 24 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 870e49fe..d90537c6 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -39,6 +39,8 @@ var (
 	oAuthUrlParamValueRedirect       = "http://localhost:" + strconv.Itoa(httpAuthPort) + "/authorization"
 	oAuthTokenEndpoint               = "https://auth.qovery.com/oauth/token"
 
+	authFailureMessage = "Authentication failed. Run 'qovery auth' again, or contact #support on https://discord.qovery.com."
+
 	// exitProcess is replaceable so tests can observe an authentication failure.
 	exitProcess = os.Exit
 )
@@ -109,36 +111,55 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 	srv := &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}
 	mux := http.NewServeMux()
 
+	// The page only shows what /authorization/valid answers: the success message
+	// is not part of it, so a failed token exchange can never look like a success.
 	mux.HandleFunc("/authorization", func(writer http.ResponseWriter, request *http.Request) {
-		js := fmt.Sprintf(`<script type="text/javascript" charset="utf-8">
-				var hash = window.location.search.split("=")[1].split("&")[0];
-				var xmlHttp = new XMLHttpRequest();
-				xmlHttp.open("GET", "http://localhost:%d/authorization/valid?code=" + hash, false);
-				xmlHttp.send(null);
-				xmlHttp.responseText;
-				window.setTimeout('window.location="`+qoveryConsoleUrl+`"; ',2000);
-             </script>`, httpAuthPort)
-
-		_, _ = writer.Write([]byte(js))
-		_, _ = writer.Write([]byte("Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: <a href='" + qoveryConsoleUrl + "'>" + qoveryConsoleUrl + "</a>"))
+		page := fmt.Sprintf(`<p id="status">Authenticating...</p>
+<script type="text/javascript" charset="utf-8">
+	var status = document.getElementById("status");
+	var code = new URLSearchParams(window.location.search).get("code") || "";
+	var xmlHttp = new XMLHttpRequest();
+	xmlHttp.open("GET", "http://localhost:%d/authorization/valid?code=" + encodeURIComponent(code), true);
+	xmlHttp.onload = function () {
+		status.textContent = xmlHttp.responseText;
+		if (xmlHttp.status === 200) {
+			var link = document.createElement("a");
+			link.href = %q;
+			link.textContent = %q;
+			status.appendChild(link);
+			window.setTimeout(function () { window.location = %q; }, 2000);
+		}
+	};
+	xmlHttp.onerror = function () {
+		status.textContent = "Authentication failed, the Qovery CLI could not be reached. Run 'qovery auth' again.";
+	};
+	xmlHttp.send(null);
+</script>`, httpAuthPort, qoveryConsoleUrl, qoveryConsoleUrl, qoveryConsoleUrl)
+
+		writer.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = writer.Write([]byte(page))
 	})
 
 	mux.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
 		codes := request.URL.Query()["code"]
-		if len(codes) == 0 {
-			http.Error(writer, "missing authorization code", http.StatusBadRequest)
+		if len(codes) == 0 || codes[0] == "" {
+			http.Error(writer, authFailureMessage, http.StatusBadRequest)
 			return
 		}
 		tokens, err := exchangeAuthorizationCode(verifier, codes[0])
 		if err != nil {
 			// A rejected or stale code must not be stored nor reported as a success.
-			http.Error(writer, "authentication unsuccessful", http.StatusUnauthorized)
+			http.Error(writer, authFailureMessage, http.StatusUnauthorized)
+			if flusher, ok := writer.(http.Flusher); ok {
+				flusher.Flush() // the browser must get its answer before the process exits
+			}
 			utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-			exitProcess(0)
+			exitProcess(1)
 			return
 		}
 		onTokens(tokens)
 		utils.PrintlnInfo("Success!")
+		_, _ = writer.Write([]byte("Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: "))
 
 		delay := authShutdownDelay
 		go func() {
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 1b534c1c..a1576a22 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -53,6 +54,17 @@ func stubTokenEndpointWith(t *testing.T, status int, body string) *exchangeRecor
 	return recorder
 }
 
+func getStatus(t *testing.T, url string) (int, string) {
+	t.Helper()
+	res, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("GET %s: %v", url, err)
+	}
+	defer func() { _ = res.Body.Close() }()
+	body, _ := io.ReadAll(res.Body)
+	return res.StatusCode, string(body)
+}
+
 func get(t *testing.T, url string) string {
 	t.Helper()
 	res, err := http.Get(url)
@@ -181,32 +193,77 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
+			body, _ := io.ReadAll(res.Body)
 			_ = res.Body.Close()
 
 			if stored != 0 {
 				t.Errorf("tokens stored %d time(s) after a rejected exchange", stored)
 			}
-			if len(exits) != 1 {
-				t.Errorf("exit calls = %v, want exactly one", exits)
+			if len(exits) != 1 || exits[0] == 0 {
+				t.Errorf("exit calls = %v, want exactly one nonzero exit", exits)
 			}
 			if res.StatusCode != http.StatusUnauthorized {
 				t.Errorf("status = %d, want %d", res.StatusCode, http.StatusUnauthorized)
 			}
+			if body := string(body); strings.Contains(body, "successful") || !strings.Contains(body, "failed") {
+				t.Errorf("browser body = %q, want a failure message", body)
+			}
 		})
 	}
 }
 
 func TestAuthorizationServerMissingCodeIsABadRequest(t *testing.T) {
-	stubTokenEndpoint(t)
+	exchanges := stubTokenEndpoint(t)
 	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { t.Error("tokens stored") }).Handler)
 	defer ts.Close()
 
-	res, err := http.Get(ts.URL + "/authorization/valid")
-	if err != nil {
-		t.Fatal(err)
+	for _, path := range []string{"/authorization/valid", "/authorization/valid?code="} {
+		status, body := getStatus(t, ts.URL+path)
+		if status != http.StatusBadRequest {
+			t.Errorf("%s: status = %d, want %d", path, status, http.StatusBadRequest)
+		}
+		if strings.Contains(body, "successful") {
+			t.Errorf("%s: body = %q, want a failure message", path, body)
+		}
+	}
+	if got := exchanges.snapshot(); len(got) != 0 {
+		t.Errorf("token exchanges = %v, want none", got)
+	}
+}
+
+// The callback page is served before the token exchange runs, so it must not
+// claim success itself.
+func TestAuthorizationPageDoesNotClaimSuccess(t *testing.T) {
+	exchanges := stubTokenEndpoint(t)
+	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) {}).Handler)
+	defer ts.Close()
+
+	status, body := getStatus(t, ts.URL+"/authorization?code=abc")
+	if status != http.StatusOK {
+		t.Fatalf("status = %d, want %d", status, http.StatusOK)
+	}
+	if strings.Contains(strings.ToLower(body), "successful") {
+		t.Errorf("page claims success before the exchange: %q", body)
+	}
+	if !strings.Contains(body, "/authorization/valid") {
+		t.Errorf("page does not call /authorization/valid: %q", body)
+	}
+	if got := exchanges.snapshot(); len(got) != 0 {
+		t.Errorf("serving the page triggered token exchanges: %v", got)
+	}
+}
+
+func TestAuthorizationServerSuccessfulExchangeAnswersSuccess(t *testing.T) {
+	stubTokenEndpoint(t)
+	var stored []TokensResponse
+	ts := httptest.NewServer(newAuthorizationServer("v", func(tokens TokensResponse) { stored = append(stored, tokens) }).Handler)
+	defer ts.Close()
+
+	status, body := getStatus(t, ts.URL+"/authorization/valid?code=ok")
+	if status != http.StatusOK || !strings.Contains(body, "Authentication successful") {
+		t.Errorf("status = %d, body = %q, want 200 with the success message", status, body)
 	}
-	_ = res.Body.Close()
-	if res.StatusCode != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d", res.StatusCode, http.StatusBadRequest)
+	if len(stored) != 1 {
+		t.Errorf("stored tokens = %+v, want one entry", stored)
 	}
 }

From 318db2035fb8cc7740e3c60e164c6d76eba63958 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:12:40 +0200
Subject: [PATCH 05/15] test(auth): assert a failed exchange exits with status
 1

---
 pkg/auth_service_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index a1576a22..8c654646 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -199,8 +199,8 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 			if stored != 0 {
 				t.Errorf("tokens stored %d time(s) after a rejected exchange", stored)
 			}
-			if len(exits) != 1 || exits[0] == 0 {
-				t.Errorf("exit calls = %v, want exactly one nonzero exit", exits)
+			if len(exits) != 1 || exits[0] != 1 {
+				t.Errorf("exit calls = %v, want exactly one exit with status 1", exits)
 			}
 			if res.StatusCode != http.StatusUnauthorized {
 				t.Errorf("status = %d, want %d", res.StatusCode, http.StatusUnauthorized)

From b9565bd32fb59e68894b2b410ccc7ff93b0f92d8 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:17:31 +0200
Subject: [PATCH 06/15] fix(auth): avoid window.status clash in callback page
 and test its script in node

---
 pkg/auth_service.go               |  43 +++++-----
 pkg/auth_service_test.go          | 130 ++++++++++++++++++++++++++++++
 pkg/testdata/auth_page_harness.js | 123 ++++++++++++++++++++++++++++
 3 files changed, 277 insertions(+), 19 deletions(-)
 create mode 100644 pkg/testdata/auth_page_harness.js

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index d90537c6..e831de9f 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -102,42 +102,47 @@ func storeTokens(tokens TokensResponse) {
 	_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
 }
 
-// newAuthorizationServer builds a server with its own mux for one interactive
-// authentication attempt. The handlers must not be registered on
-// http.DefaultServeMux: a second attempt in the same process (re-auth after a
-// 401) would panic on the duplicate "/authorization" pattern. The PKCE verifier
-// is captured per attempt.
-func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *http.Server {
-	srv := &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}
-	mux := http.NewServeMux()
-
-	// The page only shows what /authorization/valid answers: the success message
-	// is not part of it, so a failed token exchange can never look like a success.
-	mux.HandleFunc("/authorization", func(writer http.ResponseWriter, request *http.Request) {
-		page := fmt.Sprintf(`<p id="status">Authenticating...</p>
+// authorizationPage is the callback page. The script avoids top-level `var`
+// declarations: they become window properties, and names like `status` are
+// read-only strings there, which breaks DOM updates.
+func authorizationPage(port int) string {
+	return fmt.Sprintf(`<p id="status">Authenticating...</p>
 <script type="text/javascript" charset="utf-8">
-	var status = document.getElementById("status");
+	var statusElement = document.getElementById("status");
 	var code = new URLSearchParams(window.location.search).get("code") || "";
 	var xmlHttp = new XMLHttpRequest();
 	xmlHttp.open("GET", "http://localhost:%d/authorization/valid?code=" + encodeURIComponent(code), true);
 	xmlHttp.onload = function () {
-		status.textContent = xmlHttp.responseText;
+		statusElement.textContent = xmlHttp.responseText;
 		if (xmlHttp.status === 200) {
 			var link = document.createElement("a");
 			link.href = %q;
 			link.textContent = %q;
-			status.appendChild(link);
+			statusElement.appendChild(link);
 			window.setTimeout(function () { window.location = %q; }, 2000);
 		}
 	};
 	xmlHttp.onerror = function () {
-		status.textContent = "Authentication failed, the Qovery CLI could not be reached. Run 'qovery auth' again.";
+		statusElement.textContent = "Authentication failed, the Qovery CLI could not be reached. Run 'qovery auth' again.";
 	};
 	xmlHttp.send(null);
-</script>`, httpAuthPort, qoveryConsoleUrl, qoveryConsoleUrl, qoveryConsoleUrl)
+</script>`, port, qoveryConsoleUrl, qoveryConsoleUrl, qoveryConsoleUrl)
+}
 
+// newAuthorizationServer builds a server with its own mux for one interactive
+// authentication attempt. The handlers must not be registered on
+// http.DefaultServeMux: a second attempt in the same process (re-auth after a
+// 401) would panic on the duplicate "/authorization" pattern. The PKCE verifier
+// is captured per attempt.
+func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *http.Server {
+	srv := &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}
+	mux := http.NewServeMux()
+
+	// The page only shows what /authorization/valid answers: the success message
+	// is not part of it, so a failed token exchange can never look like a success.
+	mux.HandleFunc("/authorization", func(writer http.ResponseWriter, request *http.Request) {
 		writer.Header().Set("Content-Type", "text/html; charset=utf-8")
-		_, _ = writer.Write([]byte(page))
+		_, _ = writer.Write([]byte(authorizationPage(httpAuthPort)))
 	})
 
 	mux.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 8c654646..3ba04463 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -1,10 +1,14 @@
 package pkg
 
 import (
+	"encoding/json"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"os/exec"
+	"regexp"
 	"strings"
 	"sync"
 	"testing"
@@ -267,3 +271,129 @@ func TestAuthorizationServerSuccessfulExchangeAnswersSuccess(t *testing.T) {
 		t.Errorf("stored tokens = %+v, want one entry", stored)
 	}
 }
+
+type pageSnapshot struct {
+	Text     string `json:"text"`
+	Children []struct {
+		Tag  string `json:"tag"`
+		Href string `json:"href"`
+		Text string `json:"text"`
+	} `json:"children"`
+	Requests []struct {
+		Method string `json:"method"`
+		URL    string `json:"url"`
+		Async  bool   `json:"async"`
+		Sent   bool   `json:"sent"`
+	} `json:"requests"`
+	Timers      []int    `json:"timers"`
+	Navigations []string `json:"navigations"`
+}
+
+type pageRun struct {
+	Pending       pageSnapshot `json:"pending"`
+	AfterResponse pageSnapshot `json:"afterResponse"`
+	AfterTimers   pageSnapshot `json:"afterTimers"`
+	Error         string       `json:"error"`
+}
+
+// runAuthorizationPage serves the real /authorization page, extracts its inline
+// script and runs it in node against a fake browser (testdata/auth_page_harness.js).
+func runAuthorizationPage(t *testing.T, scenario string) pageRun {
+	t.Helper()
+	node, err := exec.LookPath("node")
+	if err != nil {
+		t.Skip("node is required to run the callback page script")
+	}
+	stubTokenEndpoint(t)
+	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) {}).Handler)
+	defer ts.Close()
+
+	_, page := getStatus(t, ts.URL+"/authorization?code=abc%20123")
+	match := regexp.MustCompile(`(?s)<script[^>]*>(.*)</script>`).FindStringSubmatch(page)
+	if match == nil {
+		t.Fatalf("no inline script in page: %q", page)
+	}
+
+	cmd := exec.Command(node, "testdata/auth_page_harness.js", scenario)
+	cmd.Stdin = strings.NewReader(match[1])
+	stdout, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("harness failed: %v\n%s", err, stdout)
+	}
+	var run pageRun
+	if err := json.Unmarshal(stdout, &run); err != nil {
+		t.Fatalf("harness output %q: %v", stdout, err)
+	}
+	if run.Error != "" {
+		t.Fatalf("page script threw: %s", run.Error)
+	}
+	return run
+}
+
+func assertPendingPage(t *testing.T, run pageRun) {
+	t.Helper()
+	p := run.Pending
+	if p.Text != "Authenticating..." || len(p.Children) != 0 {
+		t.Errorf("pending text = %q with %d children, want the Authenticating... placeholder", p.Text, len(p.Children))
+	}
+	wantURL := fmt.Sprintf("http://localhost:%d/authorization/valid?code=abc%%20123", httpAuthPort)
+	if len(p.Requests) != 1 || p.Requests[0].Method != "GET" || p.Requests[0].URL != wantURL || !p.Requests[0].Async || !p.Requests[0].Sent {
+		t.Errorf("requests = %+v, want one sent async GET %s", p.Requests, wantURL)
+	}
+	if len(p.Timers) != 0 || len(p.Navigations) != 0 {
+		t.Errorf("pending page scheduled timers %v / navigations %v", p.Timers, p.Navigations)
+	}
+}
+
+func TestAuthorizationPagePending(t *testing.T) {
+	run := runAuthorizationPage(t, "pending")
+	assertPendingPage(t, run)
+	if got := run.AfterResponse; got.Text != "Authenticating..." || len(got.Timers) != 0 {
+		t.Errorf("page changed without an answer: %+v", got)
+	}
+}
+
+func TestAuthorizationPageSuccessShowsLinkAndSchedulesRedirect(t *testing.T) {
+	run := runAuthorizationPage(t, "success")
+	assertPendingPage(t, run)
+
+	got := run.AfterResponse
+	if !strings.HasPrefix(got.Text, "Authentication successful") {
+		t.Errorf("text = %q, want the server's success message", got.Text)
+	}
+	if len(got.Children) != 1 || got.Children[0].Tag != "a" || got.Children[0].Href != qoveryConsoleUrl || got.Children[0].Text != qoveryConsoleUrl {
+		t.Errorf("children = %+v, want one link to %s", got.Children, qoveryConsoleUrl)
+	}
+	if len(got.Timers) != 1 || got.Timers[0] != 2000 || len(got.Navigations) != 0 {
+		t.Errorf("timers = %v, navigations = %v, want one 2000ms timer and no navigation yet", got.Timers, got.Navigations)
+	}
+	if after := run.AfterTimers; len(after.Navigations) != 1 || after.Navigations[0] != qoveryConsoleUrl {
+		t.Errorf("navigations after the timer = %v, want [%s]", after.Navigations, qoveryConsoleUrl)
+	}
+}
+
+func TestAuthorizationPageHTTPErrorShowsServerMessage(t *testing.T) {
+	run := runAuthorizationPage(t, "http-error")
+	assertPendingPage(t, run)
+
+	got := run.AfterResponse
+	if !strings.Contains(got.Text, "Authentication failed") || strings.Contains(got.Text, "successful") {
+		t.Errorf("text = %q, want the failure message", got.Text)
+	}
+	if len(got.Children) != 0 || len(got.Timers) != 0 || len(run.AfterTimers.Navigations) != 0 {
+		t.Errorf("failure must not add a link or redirect: %+v", run.AfterTimers)
+	}
+}
+
+func TestAuthorizationPageNetworkErrorShowsUnreachableMessage(t *testing.T) {
+	run := runAuthorizationPage(t, "network-error")
+	assertPendingPage(t, run)
+
+	got := run.AfterResponse
+	if !strings.Contains(got.Text, "could not be reached") || strings.Contains(got.Text, "successful") {
+		t.Errorf("text = %q, want the unreachable message", got.Text)
+	}
+	if len(got.Children) != 0 || len(got.Timers) != 0 || len(run.AfterTimers.Navigations) != 0 {
+		t.Errorf("failure must not add a link or redirect: %+v", run.AfterTimers)
+	}
+}
diff --git a/pkg/testdata/auth_page_harness.js b/pkg/testdata/auth_page_harness.js
new file mode 100644
index 00000000..6618087f
--- /dev/null
+++ b/pkg/testdata/auth_page_harness.js
@@ -0,0 +1,123 @@
+// Runs the callback page script against a minimal fake browser and prints the
+// observable state as JSON. Usage: node auth_page_harness.js <scenario> < script.js
+// Scenarios: pending, success, http-error, network-error.
+const vm = require("vm");
+
+const scenario = process.argv[2];
+const script = require("fs").readFileSync(0, "utf8");
+
+function makeElement(tag) {
+  let text = "";
+  const el = {
+    tagName: tag,
+    children: [],
+    href: "",
+    appendChild(child) {
+      if (typeof child !== "object" || child === null) {
+        throw new TypeError("appendChild: argument is not a Node");
+      }
+      this.children.push(child);
+      return child;
+    },
+  };
+  // Like the DOM, setting textContent drops the existing children.
+  Object.defineProperty(el, "textContent", {
+    get: () => text,
+    set: (v) => {
+      text = String(v);
+      el.children = [];
+    },
+  });
+  return el;
+}
+
+const statusElement = makeElement("p");
+statusElement.textContent = "Authenticating...";
+
+const requests = [];
+const timers = [];
+const navigations = [];
+let windowStatus = "";
+
+class FakeXHR {
+  constructor() {
+    this.status = 0;
+    this.responseText = "";
+    requests.push(this);
+  }
+  open(method, url, async) {
+    this.method = method;
+    this.url = url;
+    this.async = async;
+  }
+  send(body) {
+    this.sent = true;
+    this.body = body;
+  }
+}
+
+// The page runs as a top-level script, so its `var` declarations land on the
+// global object, which is the window. In browsers window.status is a string
+// accessor: assigning an element to it stores the element's string form.
+const sandbox = {
+  URLSearchParams,
+  encodeURIComponent,
+  XMLHttpRequest: FakeXHR,
+  document: {
+    getElementById: (id) => (id === "status" ? statusElement : null),
+    createElement: makeElement,
+  },
+  setTimeout: (fn, delay) => timers.push({ fn, delay }),
+};
+sandbox.window = sandbox;
+Object.defineProperty(sandbox, "status", {
+  get: () => windowStatus,
+  set: (v) => {
+    windowStatus = String(v);
+  },
+});
+let location = { search: "?code=abc%20123" };
+Object.defineProperty(sandbox, "location", {
+  get: () => location,
+  set: (v) => {
+    navigations.push(String(v));
+  },
+});
+vm.createContext(sandbox);
+
+function snapshot() {
+  return {
+    text: statusElement.textContent,
+    children: statusElement.children.map((c) => ({ tag: c.tagName, href: c.href, text: c.textContent })),
+    requests: requests.map((r) => ({ method: r.method, url: r.url, async: r.async, sent: !!r.sent })),
+    timers: timers.map((t) => t.delay),
+    navigations: navigations.slice(),
+  };
+}
+
+const out = {};
+try {
+  vm.runInContext(script, sandbox);
+  out.pending = snapshot();
+
+  const xhr = requests[0];
+  if (scenario === "success") {
+    xhr.status = 200;
+    xhr.responseText = "Authentication successful, you'll be redirected. Click: ";
+    xhr.onload();
+  } else if (scenario === "http-error") {
+    xhr.status = 401;
+    xhr.responseText = "Authentication failed, run 'qovery auth' again.";
+    xhr.onload();
+  } else if (scenario === "network-error") {
+    xhr.onerror();
+  }
+  out.afterResponse = snapshot();
+
+  // Firing the scheduled redirect must navigate the window.
+  timers.forEach((t) => t.fn());
+  out.afterTimers = snapshot();
+} catch (e) {
+  out.error = String(e);
+}
+console.log(JSON.stringify(out));

From e4ab34d297c590c5b6b68695873e3f6158d19374 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:20:17 +0200
Subject: [PATCH 07/15] docs(auth): correct the authorizationPage comment on
 the window.status clash

---
 pkg/auth_service.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index e831de9f..5dbfbb63 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -102,9 +102,10 @@ func storeTokens(tokens TokensResponse) {
 	_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
 }
 
-// authorizationPage is the callback page. The script avoids top-level `var`
-// declarations: they become window properties, and names like `status` are
-// read-only strings there, which breaks DOM updates.
+// authorizationPage is the callback page. Top-level `var` declarations in the
+// script become window properties, and `window.status` is a string property
+// that would coerce an element to text. The element is named statusElement to
+// avoid that clash.
 func authorizationPage(port int) string {
 	return fmt.Sprintf(`<p id="status">Authenticating...</p>
 <script type="text/javascript" charset="utf-8">

From 8364a5af90149e4f1d1e5b2d7947b677bbaca4e6 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:21:30 +0200
Subject: [PATCH 08/15] docs(auth): clarify statusElement comment

---
 pkg/auth_service.go | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 5dbfbb63..3e823724 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -102,10 +102,8 @@ func storeTokens(tokens TokensResponse) {
 	_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
 }
 
-// authorizationPage is the callback page. Top-level `var` declarations in the
-// script become window properties, and `window.status` is a string property
-// that would coerce an element to text. The element is named statusElement to
-// avoid that clash.
+// authorizationPage is the callback page. It names the DOM element statusElement
+// to avoid using the global name status, which conflicts with window.status.
 func authorizationPage(port int) string {
 	return fmt.Sprintf(`<p id="status">Authenticating...</p>
 <script type="text/javascript" charset="utf-8">

From eabdf364d4dcb0032059fc90771be00e3288b7ff Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 12:24:12 +0200
Subject: [PATCH 09/15] fix(auth): reject trailing data in token response and
 synchronize exit assertion in test

---
 pkg/auth_service.go      | 14 +++++++++++---
 pkg/auth_service_test.go | 39 +++++++++++++++++++++++++++------------
 2 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 3e823724..2a39e9f3 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"math/rand"
 	"net"
 	"net/http"
@@ -102,8 +103,9 @@ func storeTokens(tokens TokensResponse) {
 	_ = utils.SetAccessToken(utils.AccessToken(tokens.AccessToken), expiredAt, utils.RefreshToken(tokens.RefreshToken))
 }
 
-// authorizationPage is the callback page. It names the DOM element statusElement
-// to avoid using the global name status, which conflicts with window.status.
+// authorizationPage is the callback page. The element is named statusElement
+// because a global status resolves to window.status, which is string-valued:
+// assigning the DOM element to it would store a string and lose the element.
 func authorizationPage(port int) string {
 	return fmt.Sprintf(`<p id="status">Authenticating...</p>
 <script type="text/javascript" charset="utf-8">
@@ -197,8 +199,14 @@ func exchangeAuthorizationCode(verifier string, code string) (TokensResponse, er
 	if res.StatusCode != http.StatusOK {
 		return TokensResponse{}, fmt.Errorf("token endpoint answered %d", res.StatusCode)
 	}
+	// Read the whole body: Unmarshal rejects trailing data after the first JSON
+	// value, which a streaming Decode would accept.
+	payload, err := io.ReadAll(res.Body)
+	if err != nil {
+		return TokensResponse{}, err
+	}
 	tokens := TokensResponse{}
-	if err := json.NewDecoder(res.Body).Decode(&tokens); err != nil {
+	if err := json.Unmarshal(payload, &tokens); err != nil {
 		return TokensResponse{}, err
 	}
 	if tokens.AccessToken == "" {
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 3ba04463..0cf15cd4 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -11,6 +11,7 @@ import (
 	"regexp"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -175,22 +176,26 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 		status int
 		body   string
 	}{
-		"non-200 answer":     {http.StatusForbidden, `{"error":"invalid_grant"}`},
-		"200, empty tokens":  {http.StatusOK, `{}`},
-		"200, invalid JSON":  {http.StatusOK, `not json`},
-		"200, error payload": {http.StatusOK, `{"error":"invalid_grant"}`},
+		"non-200 answer":                          {http.StatusForbidden, `{"error":"invalid_grant"}`},
+		"200, empty tokens":                       {http.StatusOK, `{}`},
+		"200, invalid JSON":                       {http.StatusOK, `not json`},
+		"200, error payload":                      {http.StatusOK, `{"error":"invalid_grant"}`},
+		"200, valid tokens then trailing garbage": {http.StatusOK, `{"access_token":"at","refresh_token":"rt","expires_in":3600} not json`},
+		"200, valid tokens then a second value":   {http.StatusOK, `{"access_token":"at","refresh_token":"rt","expires_in":3600}{}`},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
 			stubTokenEndpointWith(t, tc.status, tc.body)
 
-			var exits []int
+			// exitProcess runs in the handler goroutine, after the response is flushed,
+			// so the test waits on the channel instead of reading shared state.
+			exits := make(chan int, 4)
 			prevExit := exitProcess
-			exitProcess = func(code int) { exits = append(exits, code) }
+			exitProcess = func(code int) { exits <- code }
 			t.Cleanup(func() { exitProcess = prevExit })
 
-			stored := 0
-			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored++ }).Handler)
+			var stored atomic.Int32
+			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored.Add(1) }).Handler)
 			defer ts.Close()
 
 			res, err := http.Get(ts.URL + "/authorization/valid?code=stale")
@@ -200,11 +205,21 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 			body, _ := io.ReadAll(res.Body)
 			_ = res.Body.Close()
 
-			if stored != 0 {
-				t.Errorf("tokens stored %d time(s) after a rejected exchange", stored)
+			select {
+			case code := <-exits:
+				if code != 1 {
+					t.Errorf("exit status = %d, want 1", code)
+				}
+			case <-time.After(5 * time.Second):
+				t.Fatal("exitProcess was not called")
 			}
-			if len(exits) != 1 || exits[0] != 1 {
-				t.Errorf("exit calls = %v, want exactly one exit with status 1", exits)
+			// Close waits for in-flight handlers, so no further exit can arrive after it.
+			ts.Close()
+			if extra := len(exits); extra != 0 {
+				t.Errorf("%d extra exit call(s), want exactly one", extra)
+			}
+			if n := stored.Load(); n != 0 {
+				t.Errorf("tokens stored %d time(s) after a rejected exchange", n)
 			}
 			if res.StatusCode != http.StatusUnauthorized {
 				t.Errorf("status = %d, want %d", res.StatusCode, http.StatusUnauthorized)

From 5a177e85bb6df051c3c73f190cd2fd624680f649 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:22:15 +0200
Subject: [PATCH 10/15] fix(auth): exit on missing code, make the callback
 one-shot and harden page tests

---
 pkg/auth_service.go               |  40 ++++--
 pkg/auth_service_test.go          | 204 ++++++++++++++++++++++++------
 pkg/testdata/auth_page_harness.js |  23 ++--
 3 files changed, 210 insertions(+), 57 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 2a39e9f3..06859098 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -15,6 +15,7 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/pkg/browser"
@@ -40,6 +41,7 @@ var (
 	oAuthUrlParamValueRedirect       = "http://localhost:" + strconv.Itoa(httpAuthPort) + "/authorization"
 	oAuthTokenEndpoint               = "https://auth.qovery.com/oauth/token"
 
+	authSuccessMessage = "Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: "
 	authFailureMessage = "Authentication failed. Run 'qovery auth' again, or contact #support on https://discord.qovery.com."
 
 	// exitProcess is replaceable so tests can observe an authentication failure.
@@ -146,26 +148,36 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 		_, _ = writer.Write([]byte(authorizationPage(httpAuthPort)))
 	})
 
+	// The callback is one-shot. A repeat (page reload, double request) must not
+	// replay the consumed code: it gets the first success again, whatever it
+	// carries. The lock also makes a concurrent repeat wait for the first exchange.
+	var (
+		mu   sync.Mutex
+		done bool
+	)
 	mux.HandleFunc("/authorization/valid", func(writer http.ResponseWriter, request *http.Request) {
+		mu.Lock()
+		defer mu.Unlock()
+		if done {
+			_, _ = writer.Write([]byte(authSuccessMessage))
+			return
+		}
+
 		codes := request.URL.Query()["code"]
 		if len(codes) == 0 || codes[0] == "" {
-			http.Error(writer, authFailureMessage, http.StatusBadRequest)
+			failAuthentication(writer, http.StatusBadRequest)
 			return
 		}
 		tokens, err := exchangeAuthorizationCode(verifier, codes[0])
 		if err != nil {
 			// A rejected or stale code must not be stored nor reported as a success.
-			http.Error(writer, authFailureMessage, http.StatusUnauthorized)
-			if flusher, ok := writer.(http.Flusher); ok {
-				flusher.Flush() // the browser must get its answer before the process exits
-			}
-			utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-			exitProcess(1)
+			failAuthentication(writer, http.StatusUnauthorized)
 			return
 		}
+		done = true
 		onTokens(tokens)
 		utils.PrintlnInfo("Success!")
-		_, _ = writer.Write([]byte("Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: "))
+		_, _ = writer.Write([]byte(authSuccessMessage))
 
 		delay := authShutdownDelay
 		go func() {
@@ -180,6 +192,18 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 	return srv
 }
 
+// failAuthentication answers the browser with the failure message, then ends the
+// attempt with a nonzero status so the CLI never keeps waiting on a callback
+// that already failed.
+func failAuthentication(writer http.ResponseWriter, status int) {
+	http.Error(writer, authFailureMessage, status)
+	if flusher, ok := writer.(http.Flusher); ok {
+		flusher.Flush() // the browser must get its answer before the process exits
+	}
+	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
+	exitProcess(1)
+}
+
 // exchangeAuthorizationCode trades the authorization code for tokens. It fails
 // on a non-200 answer or an empty access token, which is how the token endpoint
 // reports a rejected or already used code.
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 0cf15cd4..2133c840 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"os/exec"
 	"regexp"
 	"strings"
@@ -59,6 +60,49 @@ func stubTokenEndpointWith(t *testing.T, status int, body string) *exchangeRecor
 	return recorder
 }
 
+// tokenStore collects stored tokens. onTokens runs on a server goroutine, so
+// the test reads them through snapshot.
+type tokenStore struct {
+	mu     sync.Mutex
+	tokens []TokensResponse
+}
+
+func (s *tokenStore) store(tokens TokensResponse) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.tokens = append(s.tokens, tokens)
+}
+
+func (s *tokenStore) snapshot() []TokensResponse {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]TokensResponse(nil), s.tokens...)
+}
+
+// stubExit replaces exitProcess. The handler calls it on a server goroutine
+// after the response is flushed, so tests wait on the channel instead of
+// reading shared state.
+func stubExit(t *testing.T) chan int {
+	t.Helper()
+	exits := make(chan int, 4)
+	prevExit := exitProcess
+	exitProcess = func(code int) { exits <- code }
+	t.Cleanup(func() { exitProcess = prevExit })
+	return exits
+}
+
+func waitForExit(t *testing.T, exits chan int, want int) {
+	t.Helper()
+	select {
+	case code := <-exits:
+		if code != want {
+			t.Errorf("exit status = %d, want %d", code, want)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("exitProcess was not called")
+	}
+}
+
 func getStatus(t *testing.T, url string) (int, string) {
 	t.Helper()
 	res, err := http.Get(url)
@@ -92,9 +136,9 @@ func TestAuthorizationServerRepeatedAttemptsUseTheirOwnVerifier(t *testing.T) {
 	addr := first.Addr().String()
 	listener := first
 
-	var stored []TokensResponse
+	store := &tokenStore{}
 	for i, verifier := range []string{"verifier-1", "verifier-2", "verifier-3"} {
-		srv := newAuthorizationServer(verifier, func(tokens TokensResponse) { stored = append(stored, tokens) })
+		srv := newAuthorizationServer(verifier, store.store)
 
 		done := make(chan error, 1)
 		// A second attempt used to panic here on the duplicate "/authorization" pattern.
@@ -133,7 +177,7 @@ func TestAuthorizationServerRepeatedAttemptsUseTheirOwnVerifier(t *testing.T) {
 			t.Errorf("exchange %d = %q, want %q", i, got[i], want[i])
 		}
 	}
-	if len(stored) != 3 || stored[0].AccessToken != "at" || stored[0].RefreshToken != "rt" {
+	if stored := store.snapshot(); len(stored) != 3 || stored[0].AccessToken != "at" || stored[0].RefreshToken != "rt" {
 		t.Errorf("stored tokens = %+v", stored)
 	}
 }
@@ -187,12 +231,7 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			stubTokenEndpointWith(t, tc.status, tc.body)
 
-			// exitProcess runs in the handler goroutine, after the response is flushed,
-			// so the test waits on the channel instead of reading shared state.
-			exits := make(chan int, 4)
-			prevExit := exitProcess
-			exitProcess = func(code int) { exits <- code }
-			t.Cleanup(func() { exitProcess = prevExit })
+			exits := stubExit(t)
 
 			var stored atomic.Int32
 			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored.Add(1) }).Handler)
@@ -205,14 +244,7 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 			body, _ := io.ReadAll(res.Body)
 			_ = res.Body.Close()
 
-			select {
-			case code := <-exits:
-				if code != 1 {
-					t.Errorf("exit status = %d, want 1", code)
-				}
-			case <-time.After(5 * time.Second):
-				t.Fatal("exitProcess was not called")
-			}
+			waitForExit(t, exits, 1)
 			// Close waits for in-flight handlers, so no further exit can arrive after it.
 			ts.Close()
 			if extra := len(exits); extra != 0 {
@@ -231,22 +263,34 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 	}
 }
 
-func TestAuthorizationServerMissingCodeIsABadRequest(t *testing.T) {
-	exchanges := stubTokenEndpoint(t)
-	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { t.Error("tokens stored") }).Handler)
-	defer ts.Close()
-
+func TestAuthorizationServerMissingCodeFailsAndExits(t *testing.T) {
 	for _, path := range []string{"/authorization/valid", "/authorization/valid?code="} {
-		status, body := getStatus(t, ts.URL+path)
-		if status != http.StatusBadRequest {
-			t.Errorf("%s: status = %d, want %d", path, status, http.StatusBadRequest)
-		}
-		if strings.Contains(body, "successful") {
-			t.Errorf("%s: body = %q, want a failure message", path, body)
-		}
-	}
-	if got := exchanges.snapshot(); len(got) != 0 {
-		t.Errorf("token exchanges = %v, want none", got)
+		t.Run(path, func(t *testing.T) {
+			exchanges := stubTokenEndpoint(t)
+			exits := stubExit(t)
+			var stored atomic.Int32
+			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored.Add(1) }).Handler)
+			defer ts.Close()
+
+			status, body := getStatus(t, ts.URL+path)
+			if status != http.StatusBadRequest {
+				t.Errorf("status = %d, want %d", status, http.StatusBadRequest)
+			}
+			if body != authFailureMessage+"\n" {
+				t.Errorf("body = %q, want the failure message", body)
+			}
+			waitForExit(t, exits, 1)
+			ts.Close()
+			if extra := len(exits); extra != 0 {
+				t.Errorf("%d extra exit call(s), want exactly one", extra)
+			}
+			if got := exchanges.snapshot(); len(got) != 0 {
+				t.Errorf("token exchanges = %v, want none", got)
+			}
+			if n := stored.Load(); n != 0 {
+				t.Errorf("tokens stored %d time(s) without a code", n)
+			}
+		})
 	}
 }
 
@@ -274,15 +318,70 @@ func TestAuthorizationPageDoesNotClaimSuccess(t *testing.T) {
 
 func TestAuthorizationServerSuccessfulExchangeAnswersSuccess(t *testing.T) {
 	stubTokenEndpoint(t)
-	var stored []TokensResponse
-	ts := httptest.NewServer(newAuthorizationServer("v", func(tokens TokensResponse) { stored = append(stored, tokens) }).Handler)
+	store := &tokenStore{}
+	ts := httptest.NewServer(newAuthorizationServer("v", store.store).Handler)
 	defer ts.Close()
 
 	status, body := getStatus(t, ts.URL+"/authorization/valid?code=ok")
-	if status != http.StatusOK || !strings.Contains(body, "Authentication successful") {
+	if status != http.StatusOK || body != authSuccessMessage {
 		t.Errorf("status = %d, body = %q, want 200 with the success message", status, body)
 	}
-	if len(stored) != 1 {
+	if stored := store.snapshot(); len(stored) != 1 {
+		t.Errorf("stored tokens = %+v, want one entry", stored)
+	}
+}
+
+// A repeated callback must not replay the consumed code: with a real token
+// endpoint it would fail and take the CLI down after the tokens were stored.
+func TestAuthorizationServerRepeatedCallbackIsOneShot(t *testing.T) {
+	exchanges := stubTokenEndpoint(t)
+	exits := stubExit(t)
+	store := &tokenStore{}
+	ts := httptest.NewServer(newAuthorizationServer("v", store.store).Handler)
+	defer ts.Close()
+
+	for _, path := range []string{"/authorization/valid?code=ok", "/authorization/valid?code=ok", "/authorization/valid?code=other", "/authorization/valid"} {
+		if status, body := getStatus(t, ts.URL+path); status != http.StatusOK || body != authSuccessMessage {
+			t.Errorf("%s: status = %d, body = %q, want the first success again", path, status, body)
+		}
+	}
+	ts.Close()
+	if got := exchanges.snapshot(); len(got) != 1 {
+		t.Errorf("token exchanges = %v, want exactly one", got)
+	}
+	if stored := store.snapshot(); len(stored) != 1 {
+		t.Errorf("stored tokens = %+v, want one entry", stored)
+	}
+	if len(exits) != 0 {
+		t.Errorf("a repeated callback exited the process")
+	}
+}
+
+func TestAuthorizationServerConcurrentCallbacksExchangeOnce(t *testing.T) {
+	exchanges := stubTokenEndpoint(t)
+	stubExit(t)
+	store := &tokenStore{}
+	ts := httptest.NewServer(newAuthorizationServer("v", store.store).Handler)
+	defer ts.Close()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			res, err := http.Get(ts.URL + "/authorization/valid?code=ok")
+			if err != nil {
+				t.Error(err)
+				return
+			}
+			_ = res.Body.Close()
+		}()
+	}
+	wg.Wait()
+	if got := exchanges.snapshot(); len(got) != 1 {
+		t.Errorf("token exchanges = %v, want exactly one", got)
+	}
+	if stored := store.snapshot(); len(stored) != 1 {
 		t.Errorf("stored tokens = %+v, want one entry", stored)
 	}
 }
@@ -319,7 +418,21 @@ func runAuthorizationPage(t *testing.T, scenario string) pageRun {
 	if err != nil {
 		t.Skip("node is required to run the callback page script")
 	}
-	stubTokenEndpoint(t)
+	// The page runs against what the real callback server answers, not a copy
+	// of its strings.
+	var answerStatus int
+	var answerBody string
+	switch scenario {
+	case "success":
+		stubTokenEndpoint(t)
+		answerStatus, answerBody = callbackAnswer(t)
+	case "http-error":
+		stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
+		stubExit(t)
+		answerStatus, answerBody = callbackAnswer(t)
+	default:
+		stubTokenEndpoint(t)
+	}
 	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) {}).Handler)
 	defer ts.Close()
 
@@ -331,6 +444,7 @@ func runAuthorizationPage(t *testing.T, scenario string) pageRun {
 
 	cmd := exec.Command(node, "testdata/auth_page_harness.js", scenario)
 	cmd.Stdin = strings.NewReader(match[1])
+	cmd.Env = append(os.Environ(), fmt.Sprintf("AUTH_RESPONSE_STATUS=%d", answerStatus), "AUTH_RESPONSE_BODY="+answerBody)
 	stdout, err := cmd.Output()
 	if err != nil {
 		t.Fatalf("harness failed: %v\n%s", err, stdout)
@@ -345,6 +459,14 @@ func runAuthorizationPage(t *testing.T, scenario string) pageRun {
 	return run
 }
 
+// callbackAnswer asks a real callback server for its /authorization/valid answer.
+func callbackAnswer(t *testing.T) (int, string) {
+	t.Helper()
+	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) {}).Handler)
+	defer ts.Close()
+	return getStatus(t, ts.URL+"/authorization/valid?code=abc")
+}
+
 func assertPendingPage(t *testing.T, run pageRun) {
 	t.Helper()
 	p := run.Pending
@@ -373,8 +495,8 @@ func TestAuthorizationPageSuccessShowsLinkAndSchedulesRedirect(t *testing.T) {
 	assertPendingPage(t, run)
 
 	got := run.AfterResponse
-	if !strings.HasPrefix(got.Text, "Authentication successful") {
-		t.Errorf("text = %q, want the server's success message", got.Text)
+	if got.Text != authSuccessMessage {
+		t.Errorf("text = %q, want the server's success message %q", got.Text, authSuccessMessage)
 	}
 	if len(got.Children) != 1 || got.Children[0].Tag != "a" || got.Children[0].Href != qoveryConsoleUrl || got.Children[0].Text != qoveryConsoleUrl {
 		t.Errorf("children = %+v, want one link to %s", got.Children, qoveryConsoleUrl)
@@ -392,8 +514,8 @@ func TestAuthorizationPageHTTPErrorShowsServerMessage(t *testing.T) {
 	assertPendingPage(t, run)
 
 	got := run.AfterResponse
-	if !strings.Contains(got.Text, "Authentication failed") || strings.Contains(got.Text, "successful") {
-		t.Errorf("text = %q, want the failure message", got.Text)
+	if got.Text != authFailureMessage+"\n" {
+		t.Errorf("text = %q, want the server's failure message %q", got.Text, authFailureMessage+"\n")
 	}
 	if len(got.Children) != 0 || len(got.Timers) != 0 || len(run.AfterTimers.Navigations) != 0 {
 		t.Errorf("failure must not add a link or redirect: %+v", run.AfterTimers)
diff --git a/pkg/testdata/auth_page_harness.js b/pkg/testdata/auth_page_harness.js
index 6618087f..01aa672f 100644
--- a/pkg/testdata/auth_page_harness.js
+++ b/pkg/testdata/auth_page_harness.js
@@ -1,6 +1,8 @@
 // Runs the callback page script against a minimal fake browser and prints the
 // observable state as JSON. Usage: node auth_page_harness.js <scenario> < script.js
 // Scenarios: pending, success, http-error, network-error.
+// For success and http-error, AUTH_RESPONSE_STATUS and AUTH_RESPONSE_BODY carry
+// the answer the real callback server gave, so the page is run against it.
 const vm = require("vm");
 
 const scenario = process.argv[2];
@@ -76,12 +78,17 @@ Object.defineProperty(sandbox, "status", {
     windowStatus = String(v);
   },
 });
-let location = { search: "?code=abc%20123" };
+// Every way a page can navigate is recorded: assigning window.location,
+// assigning location.href, and location.assign/replace.
+const navigate = (target) => navigations.push(String(target));
+const location = { search: "?code=abc%20123", assign: navigate, replace: navigate };
+Object.defineProperty(location, "href", {
+  get: () => "http://localhost:10999/authorization" + location.search,
+  set: navigate,
+});
 Object.defineProperty(sandbox, "location", {
   get: () => location,
-  set: (v) => {
-    navigations.push(String(v));
-  },
+  set: navigate,
 });
 vm.createContext(sandbox);
 
@@ -102,12 +109,12 @@ try {
 
   const xhr = requests[0];
   if (scenario === "success") {
-    xhr.status = 200;
-    xhr.responseText = "Authentication successful, you'll be redirected. Click: ";
+    xhr.status = Number(process.env.AUTH_RESPONSE_STATUS);
+    xhr.responseText = process.env.AUTH_RESPONSE_BODY;
     xhr.onload();
   } else if (scenario === "http-error") {
-    xhr.status = 401;
-    xhr.responseText = "Authentication failed, run 'qovery auth' again.";
+    xhr.status = Number(process.env.AUTH_RESPONSE_STATUS);
+    xhr.responseText = process.env.AUTH_RESPONSE_BODY;
     xhr.onload();
   } else if (scenario === "network-error") {
     xhr.onerror();

From 0ac98a5459b07e6dfc0915780efd419d16b6d274 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:27:19 +0200
Subject: [PATCH 11/15] fix(auth): finish the failure response before the CLI
 exits

---
 pkg/auth_service.go      |  77 +++++++++++-----
 pkg/auth_service_test.go | 188 ++++++++++++++++++++++++++++-----------
 2 files changed, 192 insertions(+), 73 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 06859098..ff7bebfc 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -16,6 +16,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/pkg/browser"
@@ -44,6 +45,10 @@ var (
 	authSuccessMessage = "Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: "
 	authFailureMessage = "Authentication failed. Run 'qovery auth' again, or contact #support on https://discord.qovery.com."
 
+	// Upper bound for letting in-flight callback responses finish before the
+	// server closes.
+	authShutdownTimeout = 5 * time.Second
+
 	// exitProcess is replaceable so tests can observe an authentication failure.
 	exitProcess = os.Exit
 )
@@ -95,9 +100,47 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 
 	fmt.Println("\nOpening your browser, waiting for your authentication... ")
 
-	// Serve returns as soon as Shutdown starts, and Shutdown closes the listener
-	// first, so the fixed port is free again when this function returns.
+	serveAuthorization(srv, listener)
+}
+
+// authorizationServer is the callback server of one authentication attempt.
+type authorizationServer struct {
+	*http.Server
+	failed atomic.Bool
+}
+
+// serveAuthorization serves until the attempt ends. Serve returns as soon as
+// Shutdown starts, and Shutdown closes the listener first, so the fixed port is
+// free again when this function returns. On failure the process exits here, not
+// in the handler: Shutdown has then waited for the failure response to be
+// written in full and the connection to close, so the browser gets it complete.
+func serveAuthorization(srv *authorizationServer, listener net.Listener) {
 	_ = srv.Serve(listener)
+	srv.shutdown()
+	if srv.failed.Load() {
+		exitProcess(1)
+	}
+}
+
+// shutdown stops the server and waits, within authShutdownTimeout, for in-flight
+// requests to finish. It is safe to call more than once.
+func (s *authorizationServer) shutdown() {
+	ctx, cancel := context.WithTimeout(context.Background(), authShutdownTimeout)
+	defer cancel()
+	if err := s.Shutdown(ctx); err != nil {
+		utils.PrintlnError(err)
+	}
+}
+
+// fail answers the browser with the failure message and ends the attempt. The
+// handler only returns: exiting here would kill the process before the response
+// is complete (a flushed response is still chunked and unterminated).
+func (s *authorizationServer) fail(writer http.ResponseWriter, status int) {
+	http.Error(writer, authFailureMessage, status)
+	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
+	if s.failed.CompareAndSwap(false, true) {
+		go s.shutdown()
+	}
 }
 
 func storeTokens(tokens TokensResponse) {
@@ -137,8 +180,8 @@ func authorizationPage(port int) string {
 // http.DefaultServeMux: a second attempt in the same process (re-auth after a
 // 401) would panic on the duplicate "/authorization" pattern. The PKCE verifier
 // is captured per attempt.
-func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *http.Server {
-	srv := &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}
+func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *authorizationServer {
+	srv := &authorizationServer{Server: &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}}
 	mux := http.NewServeMux()
 
 	// The page only shows what /authorization/valid answers: the success message
@@ -163,15 +206,21 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 			return
 		}
 
+		// The attempt already failed and is shutting down: do not exchange again.
+		if srv.failed.Load() {
+			http.Error(writer, authFailureMessage, http.StatusUnauthorized)
+			return
+		}
+
 		codes := request.URL.Query()["code"]
 		if len(codes) == 0 || codes[0] == "" {
-			failAuthentication(writer, http.StatusBadRequest)
+			srv.fail(writer, http.StatusBadRequest)
 			return
 		}
 		tokens, err := exchangeAuthorizationCode(verifier, codes[0])
 		if err != nil {
 			// A rejected or stale code must not be stored nor reported as a success.
-			failAuthentication(writer, http.StatusUnauthorized)
+			srv.fail(writer, http.StatusUnauthorized)
 			return
 		}
 		done = true
@@ -182,9 +231,7 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 		delay := authShutdownDelay
 		go func() {
 			time.Sleep(delay)
-			if err := srv.Shutdown(context.TODO()); err != nil {
-				utils.PrintlnError(err)
-			}
+			srv.shutdown()
 		}()
 	})
 
@@ -192,18 +239,6 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *htt
 	return srv
 }
 
-// failAuthentication answers the browser with the failure message, then ends the
-// attempt with a nonzero status so the CLI never keeps waiting on a callback
-// that already failed.
-func failAuthentication(writer http.ResponseWriter, status int) {
-	http.Error(writer, authFailureMessage, status)
-	if flusher, ok := writer.(http.Flusher); ok {
-		flusher.Flush() // the browser must get its answer before the process exits
-	}
-	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-	exitProcess(1)
-}
-
 // exchangeAuthorizationCode trades the authorization code for tokens. It fails
 // on a non-200 answer or an empty access token, which is how the token endpoint
 // reports a rejected or already used code.
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 2133c840..93f5f23c 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -79,9 +79,34 @@ func (s *tokenStore) snapshot() []TokensResponse {
 	return append([]TokensResponse(nil), s.tokens...)
 }
 
-// stubExit replaces exitProcess. The handler calls it on a server goroutine
-// after the response is flushed, so tests wait on the channel instead of
-// reading shared state.
+// trackingListener remembers accepted connections so a test can sever them the
+// way a dying process would.
+type trackingListener struct {
+	net.Listener
+	mu    sync.Mutex
+	conns []net.Conn
+}
+
+func (l *trackingListener) Accept() (net.Conn, error) {
+	conn, err := l.Listener.Accept()
+	if err == nil {
+		l.mu.Lock()
+		l.conns = append(l.conns, conn)
+		l.mu.Unlock()
+	}
+	return conn, err
+}
+
+func (l *trackingListener) killConnections() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	for _, conn := range l.conns {
+		_ = conn.Close()
+	}
+}
+
+// stubExit replaces exitProcess with a channel for tests that only mount the
+// handler. The handler must never exit on these paths.
 func stubExit(t *testing.T) chan int {
 	t.Helper()
 	exits := make(chan int, 4)
@@ -91,7 +116,47 @@ func stubExit(t *testing.T) chan int {
 	return exits
 }
 
-func waitForExit(t *testing.T, exits chan int, want int) {
+// runningAuthorization is a callback server run the way DoRequestUserToAuthenticate
+// runs it, through serveAuthorization. The exit stub severs every connection
+// before it reports the code, like the real process exit does: a response that
+// was not completed before the exit reaches the client truncated.
+type runningAuthorization struct {
+	url   string
+	exits chan int
+	done  chan struct{}
+}
+
+func startAuthorization(t *testing.T, onTokens func(TokensResponse)) *runningAuthorization {
+	t.Helper()
+	inner, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	listener := &trackingListener{Listener: inner}
+	running := &runningAuthorization{
+		url:   "http://" + inner.Addr().String(),
+		exits: make(chan int, 4),
+		done:  make(chan struct{}),
+	}
+	prevExit := exitProcess
+	exitProcess = func(code int) {
+		listener.killConnections()
+		running.exits <- code
+	}
+	srv := newAuthorizationServer("v", onTokens)
+	go func() {
+		defer close(running.done)
+		serveAuthorization(srv, listener)
+	}()
+	t.Cleanup(func() {
+		_ = srv.Close()
+		<-running.done
+		exitProcess = prevExit
+	})
+	return running
+}
+
+func waitForExit(t *testing.T, exits <-chan int, want int) {
 	t.Helper()
 	select {
 	case code := <-exits:
@@ -230,58 +295,64 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
 			stubTokenEndpointWith(t, tc.status, tc.body)
-
-			exits := stubExit(t)
-
 			var stored atomic.Int32
-			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored.Add(1) }).Handler)
-			defer ts.Close()
-
-			res, err := http.Get(ts.URL + "/authorization/valid?code=stale")
-			if err != nil {
-				t.Fatal(err)
-			}
-			body, _ := io.ReadAll(res.Body)
-			_ = res.Body.Close()
+			a := startAuthorization(t, func(TokensResponse) { stored.Add(1) })
 
-			waitForExit(t, exits, 1)
-			// Close waits for in-flight handlers, so no further exit can arrive after it.
-			ts.Close()
-			if extra := len(exits); extra != 0 {
+			res, body := getComplete(t, a.url+"/authorization/valid?code=stale")
+			assertCompleteFailure(t, res, body, http.StatusUnauthorized)
+			waitForExit(t, a.exits, 1)
+			<-a.done
+			if extra := len(a.exits); extra != 0 {
 				t.Errorf("%d extra exit call(s), want exactly one", extra)
 			}
 			if n := stored.Load(); n != 0 {
 				t.Errorf("tokens stored %d time(s) after a rejected exchange", n)
 			}
-			if res.StatusCode != http.StatusUnauthorized {
-				t.Errorf("status = %d, want %d", res.StatusCode, http.StatusUnauthorized)
-			}
-			if body := string(body); strings.Contains(body, "successful") || !strings.Contains(body, "failed") {
-				t.Errorf("browser body = %q, want a failure message", body)
-			}
 		})
 	}
 }
 
+// getComplete reads the whole response and fails if the connection was cut
+// before the body was complete.
+func getComplete(t *testing.T, url string) (*http.Response, string) {
+	t.Helper()
+	res, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("GET %s: %v", url, err)
+	}
+	defer func() { _ = res.Body.Close() }()
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		t.Fatalf("GET %s: response truncated: %v (got %q)", url, err, body)
+	}
+	return res, string(body)
+}
+
+func assertCompleteFailure(t *testing.T, res *http.Response, body string, wantStatus int) {
+	t.Helper()
+	if res.StatusCode != wantStatus {
+		t.Errorf("status = %d, want %d", res.StatusCode, wantStatus)
+	}
+	if want := authFailureMessage + "\n"; body != want {
+		t.Errorf("body = %q, want %q", body, want)
+	}
+	if res.ContentLength != int64(len(body)) {
+		t.Errorf("Content-Length = %d, want %d: the response is not framed as complete", res.ContentLength, len(body))
+	}
+}
+
 func TestAuthorizationServerMissingCodeFailsAndExits(t *testing.T) {
 	for _, path := range []string{"/authorization/valid", "/authorization/valid?code="} {
 		t.Run(path, func(t *testing.T) {
 			exchanges := stubTokenEndpoint(t)
-			exits := stubExit(t)
 			var stored atomic.Int32
-			ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) { stored.Add(1) }).Handler)
-			defer ts.Close()
+			a := startAuthorization(t, func(TokensResponse) { stored.Add(1) })
 
-			status, body := getStatus(t, ts.URL+path)
-			if status != http.StatusBadRequest {
-				t.Errorf("status = %d, want %d", status, http.StatusBadRequest)
-			}
-			if body != authFailureMessage+"\n" {
-				t.Errorf("body = %q, want the failure message", body)
-			}
-			waitForExit(t, exits, 1)
-			ts.Close()
-			if extra := len(exits); extra != 0 {
+			res, body := getComplete(t, a.url+path)
+			assertCompleteFailure(t, res, body, http.StatusBadRequest)
+			waitForExit(t, a.exits, 1)
+			<-a.done
+			if extra := len(a.exits); extra != 0 {
 				t.Errorf("%d extra exit call(s), want exactly one", extra)
 			}
 			if got := exchanges.snapshot(); len(got) != 0 {
@@ -345,13 +416,13 @@ func TestAuthorizationServerRepeatedCallbackIsOneShot(t *testing.T) {
 			t.Errorf("%s: status = %d, body = %q, want the first success again", path, status, body)
 		}
 	}
-	ts.Close()
 	if got := exchanges.snapshot(); len(got) != 1 {
 		t.Errorf("token exchanges = %v, want exactly one", got)
 	}
 	if stored := store.snapshot(); len(stored) != 1 {
 		t.Errorf("stored tokens = %+v, want one entry", stored)
 	}
+	ts.Close()
 	if len(exits) != 0 {
 		t.Errorf("a repeated callback exited the process")
 	}
@@ -359,31 +430,46 @@ func TestAuthorizationServerRepeatedCallbackIsOneShot(t *testing.T) {
 
 func TestAuthorizationServerConcurrentCallbacksExchangeOnce(t *testing.T) {
 	exchanges := stubTokenEndpoint(t)
-	stubExit(t)
+	exits := stubExit(t)
 	store := &tokenStore{}
 	ts := httptest.NewServer(newAuthorizationServer("v", store.store).Handler)
 	defer ts.Close()
 
-	var wg sync.WaitGroup
-	for i := 0; i < 8; i++ {
-		wg.Add(1)
+	const callers = 8
+	type answer struct {
+		status int
+		body   string
+		err    error
+	}
+	answers := make(chan answer, callers)
+	for i := 0; i < callers; i++ {
 		go func() {
-			defer wg.Done()
 			res, err := http.Get(ts.URL + "/authorization/valid?code=ok")
 			if err != nil {
-				t.Error(err)
+				answers <- answer{err: err}
 				return
 			}
-			_ = res.Body.Close()
+			defer func() { _ = res.Body.Close() }()
+			body, err := io.ReadAll(res.Body)
+			answers <- answer{status: res.StatusCode, body: string(body), err: err}
 		}()
 	}
-	wg.Wait()
+	for i := 0; i < callers; i++ {
+		got := <-answers
+		if got.err != nil || got.status != http.StatusOK || got.body != authSuccessMessage {
+			t.Errorf("concurrent callback: status = %d, body = %q, err = %v, want the success answer", got.status, got.body, got.err)
+		}
+	}
 	if got := exchanges.snapshot(); len(got) != 1 {
 		t.Errorf("token exchanges = %v, want exactly one", got)
 	}
 	if stored := store.snapshot(); len(stored) != 1 {
 		t.Errorf("stored tokens = %+v, want one entry", stored)
 	}
+	ts.Close()
+	if len(exits) != 0 {
+		t.Errorf("a concurrent callback exited the process")
+	}
 }
 
 type pageSnapshot struct {
@@ -428,7 +514,6 @@ func runAuthorizationPage(t *testing.T, scenario string) pageRun {
 		answerStatus, answerBody = callbackAnswer(t)
 	case "http-error":
 		stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
-		stubExit(t)
 		answerStatus, answerBody = callbackAnswer(t)
 	default:
 		stubTokenEndpoint(t)
@@ -462,9 +547,8 @@ func runAuthorizationPage(t *testing.T, scenario string) pageRun {
 // callbackAnswer asks a real callback server for its /authorization/valid answer.
 func callbackAnswer(t *testing.T) (int, string) {
 	t.Helper()
-	ts := httptest.NewServer(newAuthorizationServer("v", func(TokensResponse) {}).Handler)
-	defer ts.Close()
-	return getStatus(t, ts.URL+"/authorization/valid?code=abc")
+	a := startAuthorization(t, func(TokensResponse) {})
+	return getStatus(t, a.url+"/authorization/valid?code=abc")
 }
 
 func assertPendingPage(t *testing.T, run pageRun) {

From 9e27c45736e3a8b9ae577b198cfb7d1d3780af40 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:30:28 +0200
Subject: [PATCH 12/15] fix(auth): wait for the failure response to be
 delivered before exiting

---
 pkg/auth_service.go      | 73 ++++++++++++++++++++++++++++++++++-----
 pkg/auth_service_test.go | 74 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 137 insertions(+), 10 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index ff7bebfc..d16eaade 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -45,10 +45,14 @@ var (
 	authSuccessMessage = "Authentication successful, you'll be redirected to Qovery console. If it's not the case, click on this link: "
 	authFailureMessage = "Authentication failed. Run 'qovery auth' again, or contact #support on https://discord.qovery.com."
 
-	// Upper bound for letting in-flight callback responses finish before the
-	// server closes.
+	// Upper bound for the graceful shutdown. It frees the port; it does not
+	// decide when the failure response is complete, see awaitFailureDelivered.
 	authShutdownTimeout = 5 * time.Second
 
+	// Last-resort bound on waiting for the failure response to be written. The
+	// body is one short line, so it only elapses if the connection is wedged.
+	authDeliveryTimeout = 30 * time.Second
+
 	// exitProcess is replaceable so tests can observe an authentication failure.
 	exitProcess = os.Exit
 )
@@ -107,23 +111,39 @@ func DoRequestUserToAuthenticate(headless bool, skipVersionCheck bool) {
 type authorizationServer struct {
 	*http.Server
 	failed atomic.Bool
+
+	// failedConn is the connection that carries the failure response.
+	// delivered closes once it is idle or closed, which the http server only
+	// reaches after the response is completely written.
+	failMu        sync.Mutex
+	failedConn    net.Conn
+	delivered     chan struct{}
+	deliveredOnce sync.Once
+}
+
+type connContextKey struct{}
+
+func (s *authorizationServer) markDelivered() {
+	s.deliveredOnce.Do(func() { close(s.delivered) })
 }
 
 // serveAuthorization serves until the attempt ends. Serve returns as soon as
 // Shutdown starts, and Shutdown closes the listener first, so the fixed port is
 // free again when this function returns. On failure the process exits here, not
-// in the handler: Shutdown has then waited for the failure response to be
-// written in full and the connection to close, so the browser gets it complete.
+// in the handler, and only once the failure response is completely written: the
+// browser must not get it truncated.
 func serveAuthorization(srv *authorizationServer, listener net.Listener) {
 	_ = srv.Serve(listener)
 	srv.shutdown()
 	if srv.failed.Load() {
+		srv.awaitFailureDelivered()
 		exitProcess(1)
 	}
 }
 
 // shutdown stops the server and waits, within authShutdownTimeout, for in-flight
-// requests to finish. It is safe to call more than once.
+// requests to finish. It is safe to call more than once. A timeout here does not
+// mean the failure response is complete: see awaitFailureDelivered.
 func (s *authorizationServer) shutdown() {
 	ctx, cancel := context.WithTimeout(context.Background(), authShutdownTimeout)
 	defer cancel()
@@ -132,10 +152,27 @@ func (s *authorizationServer) shutdown() {
 	}
 }
 
+// awaitFailureDelivered blocks until the failure response is completely
+// written, however long a slow connection takes, up to authDeliveryTimeout.
+func (s *authorizationServer) awaitFailureDelivered() {
+	select {
+	case <-s.delivered:
+	case <-time.After(authDeliveryTimeout):
+	}
+}
+
 // fail answers the browser with the failure message and ends the attempt. The
 // handler only returns: exiting here would kill the process before the response
 // is complete (a flushed response is still chunked and unterminated).
-func (s *authorizationServer) fail(writer http.ResponseWriter, status int) {
+func (s *authorizationServer) fail(writer http.ResponseWriter, request *http.Request, status int) {
+	conn, _ := request.Context().Value(connContextKey{}).(net.Conn)
+	s.failMu.Lock()
+	s.failedConn = conn
+	s.failMu.Unlock()
+	if conn == nil {
+		s.markDelivered() // not served through serveAuthorization: nothing to wait for
+	}
+
 	http.Error(writer, authFailureMessage, status)
 	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
 	if s.failed.CompareAndSwap(false, true) {
@@ -181,7 +218,25 @@ func authorizationPage(port int) string {
 // 401) would panic on the duplicate "/authorization" pattern. The PKCE verifier
 // is captured per attempt.
 func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *authorizationServer {
-	srv := &authorizationServer{Server: &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)}}
+	srv := &authorizationServer{
+		Server:    &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)},
+		delivered: make(chan struct{}),
+	}
+	srv.ConnContext = func(ctx context.Context, conn net.Conn) context.Context {
+		return context.WithValue(ctx, connContextKey{}, conn)
+	}
+	srv.ConnState = func(conn net.Conn, state http.ConnState) {
+		switch state {
+		case http.StateIdle, http.StateClosed, http.StateHijacked:
+			srv.failMu.Lock()
+			isFailed := conn == srv.failedConn
+			srv.failMu.Unlock()
+			if isFailed {
+				srv.markDelivered()
+			}
+		case http.StateNew, http.StateActive:
+		}
+	}
 	mux := http.NewServeMux()
 
 	// The page only shows what /authorization/valid answers: the success message
@@ -214,13 +269,13 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *aut
 
 		codes := request.URL.Query()["code"]
 		if len(codes) == 0 || codes[0] == "" {
-			srv.fail(writer, http.StatusBadRequest)
+			srv.fail(writer, request, http.StatusBadRequest)
 			return
 		}
 		tokens, err := exchangeAuthorizationCode(verifier, codes[0])
 		if err != nil {
 			// A rejected or stale code must not be stored nor reported as a success.
-			srv.fail(writer, http.StatusUnauthorized)
+			srv.fail(writer, request, http.StatusUnauthorized)
 			return
 		}
 		done = true
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 93f5f23c..89435c68 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -83,12 +83,29 @@ func (s *tokenStore) snapshot() []TokensResponse {
 // way a dying process would.
 type trackingListener struct {
 	net.Listener
+	// gate, when set, holds back every write on accepted connections until it
+	// is closed. It simulates a slow client.
+	gate  chan struct{}
 	mu    sync.Mutex
 	conns []net.Conn
 }
 
+// gatedConn blocks writes until the gate is closed.
+type gatedConn struct {
+	net.Conn
+	gate <-chan struct{}
+}
+
+func (c *gatedConn) Write(b []byte) (int, error) {
+	<-c.gate
+	return c.Conn.Write(b)
+}
+
 func (l *trackingListener) Accept() (net.Conn, error) {
 	conn, err := l.Listener.Accept()
+	if err == nil && l.gate != nil {
+		conn = &gatedConn{Conn: conn, gate: l.gate}
+	}
 	if err == nil {
 		l.mu.Lock()
 		l.conns = append(l.conns, conn)
@@ -127,12 +144,17 @@ type runningAuthorization struct {
 }
 
 func startAuthorization(t *testing.T, onTokens func(TokensResponse)) *runningAuthorization {
+	t.Helper()
+	return startAuthorizationOn(t, onTokens, nil)
+}
+
+func startAuthorizationOn(t *testing.T, onTokens func(TokensResponse), gate chan struct{}) *runningAuthorization {
 	t.Helper()
 	inner, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
-	listener := &trackingListener{Listener: inner}
+	listener := &trackingListener{Listener: inner, gate: gate}
 	running := &runningAuthorization{
 		url:   "http://" + inner.Addr().String(),
 		exits: make(chan int, 4),
@@ -314,6 +336,56 @@ func TestAuthorizationServerRejectedExchangeStoresNothing(t *testing.T) {
 
 // getComplete reads the whole response and fails if the connection was cut
 // before the body was complete.
+// The graceful shutdown gives up after authShutdownTimeout, but a failure
+// response still being written must not be cut by the exit that follows.
+func TestAuthorizationServerFailureExitWaitsForSlowDelivery(t *testing.T) {
+	stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
+	prevTimeout := authShutdownTimeout
+	authShutdownTimeout = 20 * time.Millisecond
+	t.Cleanup(func() { authShutdownTimeout = prevTimeout })
+
+	gate := make(chan struct{})
+	var release sync.Once
+	releaseGate := func() { release.Do(func() { close(gate) }) }
+	t.Cleanup(releaseGate)
+	a := startAuthorizationOn(t, func(TokensResponse) {}, gate)
+
+	type result struct {
+		res  *http.Response
+		body string
+		err  error
+	}
+	delivered := make(chan result, 1)
+	go func() {
+		res, err := http.Get(a.url + "/authorization/valid?code=stale")
+		if err != nil {
+			delivered <- result{err: err}
+			return
+		}
+		defer func() { _ = res.Body.Close() }()
+		body, err := io.ReadAll(res.Body)
+		delivered <- result{res, string(body), err}
+	}()
+
+	// Well past the graceful timeout, the response is still held back.
+	select {
+	case code := <-a.exits:
+		t.Fatalf("exitProcess(%d) ran while the failure response was not delivered", code)
+	case got := <-delivered:
+		t.Fatalf("response arrived while the connection was gated: %+v", got)
+	case <-time.After(300 * time.Millisecond):
+	}
+
+	releaseGate()
+	got := <-delivered
+	if got.err != nil {
+		t.Fatalf("response truncated: %v (got %q)", got.err, got.body)
+	}
+	assertCompleteFailure(t, got.res, got.body, http.StatusUnauthorized)
+	waitForExit(t, a.exits, 1)
+	<-a.done
+}
+
 func getComplete(t *testing.T, url string) (*http.Response, string) {
 	t.Helper()
 	res, err := http.Get(url)

From 80f0e17967e87d86cc2f30584f9dc6de464563a4 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:34:32 +0200
Subject: [PATCH 13/15] fix(auth): exit only once the failure response is
 confirmed delivered

---
 pkg/auth_service.go      | 44 ++++++++++++++----------
 pkg/auth_service_test.go | 72 +++++++++++++++++++++++++++++++++++-----
 2 files changed, 90 insertions(+), 26 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index d16eaade..4d700407 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -49,10 +49,6 @@ var (
 	// decide when the failure response is complete, see awaitFailureDelivered.
 	authShutdownTimeout = 5 * time.Second
 
-	// Last-resort bound on waiting for the failure response to be written. The
-	// body is one short line, so it only elapses if the connection is wedged.
-	authDeliveryTimeout = 30 * time.Second
-
 	// exitProcess is replaceable so tests can observe an authentication failure.
 	exitProcess = os.Exit
 )
@@ -112,9 +108,14 @@ type authorizationServer struct {
 	*http.Server
 	failed atomic.Bool
 
+	// shutdownTimeout is read once at construction, so the package variable is
+	// not touched from server goroutines.
+	shutdownTimeout time.Duration
+
 	// failedConn is the connection that carries the failure response.
-	// delivered closes once it is idle or closed, which the http server only
-	// reaches after the response is completely written.
+	// delivered closes once that connection is idle again after the failing
+	// handler: the http server only gets there after the response is completely
+	// written. Closed and hijacked connections prove nothing about delivery.
 	failMu        sync.Mutex
 	failedConn    net.Conn
 	delivered     chan struct{}
@@ -130,8 +131,9 @@ func (s *authorizationServer) markDelivered() {
 // serveAuthorization serves until the attempt ends. Serve returns as soon as
 // Shutdown starts, and Shutdown closes the listener first, so the fixed port is
 // free again when this function returns. On failure the process exits here, not
-// in the handler, and only once the failure response is completely written: the
-// browser must not get it truncated.
+// in the handler, and only once the failure response is confirmed completely
+// written: the browser must not get it truncated. If that never gets confirmed
+// (connection lost mid-write), the CLI keeps waiting instead of exiting.
 func serveAuthorization(srv *authorizationServer, listener net.Listener) {
 	_ = srv.Serve(listener)
 	srv.shutdown()
@@ -145,20 +147,18 @@ func serveAuthorization(srv *authorizationServer, listener net.Listener) {
 // requests to finish. It is safe to call more than once. A timeout here does not
 // mean the failure response is complete: see awaitFailureDelivered.
 func (s *authorizationServer) shutdown() {
-	ctx, cancel := context.WithTimeout(context.Background(), authShutdownTimeout)
+	ctx, cancel := context.WithTimeout(context.Background(), s.shutdownTimeout)
 	defer cancel()
 	if err := s.Shutdown(ctx); err != nil {
 		utils.PrintlnError(err)
 	}
 }
 
-// awaitFailureDelivered blocks until the failure response is completely
-// written, however long a slow connection takes, up to authDeliveryTimeout.
+// awaitFailureDelivered blocks until the failure response is confirmed
+// completely written. There is no timeout on purpose: exiting earlier could
+// truncate the response the user is about to read.
 func (s *authorizationServer) awaitFailureDelivered() {
-	select {
-	case <-s.delivered:
-	case <-time.After(authDeliveryTimeout):
-	}
+	<-s.delivered
 }
 
 // fail answers the browser with the failure message and ends the attempt. The
@@ -176,7 +176,13 @@ func (s *authorizationServer) fail(writer http.ResponseWriter, request *http.Req
 	http.Error(writer, authFailureMessage, status)
 	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
 	if s.failed.CompareAndSwap(false, true) {
-		go s.shutdown()
+		// Shutdown disables keep-alive, so a response finished during it closes
+		// the connection without ever going idle and delivery could not be
+		// confirmed. Shut down only once it is.
+		go func() {
+			s.awaitFailureDelivered()
+			s.shutdown()
+		}()
 	}
 }
 
@@ -221,20 +227,22 @@ func newAuthorizationServer(verifier string, onTokens func(TokensResponse)) *aut
 	srv := &authorizationServer{
 		Server:    &http.Server{Addr: fmt.Sprintf("localhost:%d", httpAuthPort)},
 		delivered: make(chan struct{}),
+
+		shutdownTimeout: authShutdownTimeout,
 	}
 	srv.ConnContext = func(ctx context.Context, conn net.Conn) context.Context {
 		return context.WithValue(ctx, connContextKey{}, conn)
 	}
 	srv.ConnState = func(conn net.Conn, state http.ConnState) {
 		switch state {
-		case http.StateIdle, http.StateClosed, http.StateHijacked:
+		case http.StateIdle:
 			srv.failMu.Lock()
 			isFailed := conn == srv.failedConn
 			srv.failMu.Unlock()
 			if isFailed {
 				srv.markDelivered()
 			}
-		case http.StateNew, http.StateActive:
+		case http.StateNew, http.StateActive, http.StateHijacked, http.StateClosed:
 		}
 	}
 	mux := http.NewServeMux()
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 89435c68..61aeb1c4 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -2,6 +2,7 @@ package pkg
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -85,26 +86,33 @@ type trackingListener struct {
 	net.Listener
 	// gate, when set, holds back every write on accepted connections until it
 	// is closed. It simulates a slow client.
-	gate  chan struct{}
-	mu    sync.Mutex
-	conns []net.Conn
+	gate chan struct{}
+	// failWrites makes the gated writes fail once the gate opens, like a client
+	// that went away mid-response.
+	failWrites bool
+	mu         sync.Mutex
+	conns      []net.Conn
 }
 
 // gatedConn blocks writes until the gate is closed.
 type gatedConn struct {
 	net.Conn
 	gate <-chan struct{}
+	fail bool
 }
 
 func (c *gatedConn) Write(b []byte) (int, error) {
 	<-c.gate
+	if c.fail {
+		return 0, errors.New("simulated write failure")
+	}
 	return c.Conn.Write(b)
 }
 
 func (l *trackingListener) Accept() (net.Conn, error) {
 	conn, err := l.Listener.Accept()
 	if err == nil && l.gate != nil {
-		conn = &gatedConn{Conn: conn, gate: l.gate}
+		conn = &gatedConn{Conn: conn, gate: l.gate, fail: l.failWrites}
 	}
 	if err == nil {
 		l.mu.Lock()
@@ -143,18 +151,23 @@ type runningAuthorization struct {
 	done  chan struct{}
 }
 
+type authorizationOptions struct {
+	gate       chan struct{}
+	failWrites bool
+}
+
 func startAuthorization(t *testing.T, onTokens func(TokensResponse)) *runningAuthorization {
 	t.Helper()
-	return startAuthorizationOn(t, onTokens, nil)
+	return startAuthorizationOn(t, onTokens, authorizationOptions{})
 }
 
-func startAuthorizationOn(t *testing.T, onTokens func(TokensResponse), gate chan struct{}) *runningAuthorization {
+func startAuthorizationOn(t *testing.T, onTokens func(TokensResponse), opts authorizationOptions) *runningAuthorization {
 	t.Helper()
 	inner, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
-	listener := &trackingListener{Listener: inner, gate: gate}
+	listener := &trackingListener{Listener: inner, gate: opts.gate, failWrites: opts.failWrites}
 	running := &runningAuthorization{
 		url:   "http://" + inner.Addr().String(),
 		exits: make(chan int, 4),
@@ -172,6 +185,8 @@ func startAuthorizationOn(t *testing.T, onTokens func(TokensResponse), gate chan
 	}()
 	t.Cleanup(func() {
 		_ = srv.Close()
+		// An unconfirmed failure keeps serveAuthorization waiting by design.
+		srv.markDelivered()
 		<-running.done
 		exitProcess = prevExit
 	})
@@ -348,7 +363,7 @@ func TestAuthorizationServerFailureExitWaitsForSlowDelivery(t *testing.T) {
 	var release sync.Once
 	releaseGate := func() { release.Do(func() { close(gate) }) }
 	t.Cleanup(releaseGate)
-	a := startAuthorizationOn(t, func(TokensResponse) {}, gate)
+	a := startAuthorizationOn(t, func(TokensResponse) {}, authorizationOptions{gate: gate})
 
 	type result struct {
 		res  *http.Response
@@ -386,6 +401,47 @@ func TestAuthorizationServerFailureExitWaitsForSlowDelivery(t *testing.T) {
 	<-a.done
 }
 
+// A failure response that cannot be written is never confirmed delivered. The
+// connection closes without going idle, and that must not release the exit.
+func TestAuthorizationServerFailureExitNeverRunsWhenDeliveryIsUnconfirmed(t *testing.T) {
+	stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
+	// The old fixed delivery timeout, shortened: waiting longer than any of
+	// the graceful timeouts must still not exit.
+	prevTimeout := authShutdownTimeout
+	authShutdownTimeout = 20 * time.Millisecond
+	t.Cleanup(func() { authShutdownTimeout = prevTimeout })
+
+	gate := make(chan struct{})
+	a := startAuthorizationOn(t, func(TokensResponse) {}, authorizationOptions{gate: gate, failWrites: true})
+
+	clientErr := make(chan error, 1)
+	go func() {
+		res, err := http.Get(a.url + "/authorization/valid?code=stale")
+		if err == nil {
+			_ = res.Body.Close()
+		}
+		clientErr <- err
+	}()
+	close(gate)
+
+	// The client sees the connection die before any complete response.
+	select {
+	case err := <-clientErr:
+		if err == nil {
+			t.Fatal("client got a response although every write failed")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("client never saw the connection close")
+	}
+	select {
+	case code := <-a.exits:
+		t.Fatalf("exitProcess(%d) ran although the failure response was never delivered", code)
+	case <-a.done:
+		t.Fatal("serveAuthorization returned although the failure response was never delivered")
+	case <-time.After(500 * time.Millisecond):
+	}
+}
+
 func getComplete(t *testing.T, url string) (*http.Response, string) {
 	t.Helper()
 	res, err := http.Get(url)

From 8b8fabc1d6f0a385c72391b1ba05705e2fe2969f Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:37:46 +0200
Subject: [PATCH 14/15] fix(auth): never treat a missing tracked connection as
 delivered

---
 pkg/auth_service.go      |  7 +++---
 pkg/auth_service_test.go | 50 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/pkg/auth_service.go b/pkg/auth_service.go
index 4d700407..1bccc3e3 100644
--- a/pkg/auth_service.go
+++ b/pkg/auth_service.go
@@ -165,17 +165,16 @@ func (s *authorizationServer) awaitFailureDelivered() {
 // handler only returns: exiting here would kill the process before the response
 // is complete (a flushed response is still chunked and unterminated).
 func (s *authorizationServer) fail(writer http.ResponseWriter, request *http.Request, status int) {
+	// Without a tracked connection nothing can ever confirm delivery, so the
+	// attempt stays failed but neither exits nor shuts down.
 	conn, _ := request.Context().Value(connContextKey{}).(net.Conn)
 	s.failMu.Lock()
 	s.failedConn = conn
 	s.failMu.Unlock()
-	if conn == nil {
-		s.markDelivered() // not served through serveAuthorization: nothing to wait for
-	}
 
 	http.Error(writer, authFailureMessage, status)
 	utils.PrintlnError(errors.New("authentication unsuccessful. Try again later or contact #support on 'https://discord.qovery.com'. "))
-	if s.failed.CompareAndSwap(false, true) {
+	if s.failed.CompareAndSwap(false, true) && conn != nil {
 		// Shutdown disables keep-alive, so a response finished during it closes
 		// the connection without ever going idle and delivery could not be
 		// confirmed. Shut down only once it is.
diff --git a/pkg/auth_service_test.go b/pkg/auth_service_test.go
index 61aeb1c4..0e713495 100644
--- a/pkg/auth_service_test.go
+++ b/pkg/auth_service_test.go
@@ -154,6 +154,9 @@ type runningAuthorization struct {
 type authorizationOptions struct {
 	gate       chan struct{}
 	failWrites bool
+	// untracked drops the connection tracking, so the failing handler cannot
+	// tell which connection carries its response.
+	untracked bool
 }
 
 func startAuthorization(t *testing.T, onTokens func(TokensResponse)) *runningAuthorization {
@@ -179,6 +182,9 @@ func startAuthorizationOn(t *testing.T, onTokens func(TokensResponse), opts auth
 		running.exits <- code
 	}
 	srv := newAuthorizationServer("v", onTokens)
+	if opts.untracked {
+		srv.ConnContext = nil
+	}
 	go func() {
 		defer close(running.done)
 		serveAuthorization(srv, listener)
@@ -442,6 +448,50 @@ func TestAuthorizationServerFailureExitNeverRunsWhenDeliveryIsUnconfirmed(t *tes
 	}
 }
 
+// Without a tracked connection nothing proves the response was delivered, so a
+// failure must neither exit nor shut the server down, though the browser still
+// gets its complete answer.
+func TestAuthorizationServerFailureWithoutTrackedConnectionNeverExits(t *testing.T) {
+	stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
+	a := startAuthorizationOn(t, func(TokensResponse) {}, authorizationOptions{untracked: true})
+
+	res, body := getComplete(t, a.url+"/authorization/valid?code=stale")
+	assertCompleteFailure(t, res, body, http.StatusUnauthorized)
+
+	select {
+	case code := <-a.exits:
+		t.Fatalf("exitProcess(%d) ran without a confirmed delivery", code)
+	case <-a.done:
+		t.Fatal("serveAuthorization returned without a confirmed delivery")
+	case <-time.After(500 * time.Millisecond):
+	}
+	// Still serving: a later callback is refused without a new exchange.
+	if status, _ := getStatus(t, a.url+"/authorization/valid?code=again"); status != http.StatusUnauthorized {
+		t.Errorf("later callback status = %d, want %d", status, http.StatusUnauthorized)
+	}
+}
+
+// The handler alone, mounted without serveAuthorization, must not exit either.
+func TestAuthorizationServerFailureHandlerAloneNeverExits(t *testing.T) {
+	stubTokenEndpointWith(t, http.StatusForbidden, `{"error":"invalid_grant"}`)
+	exits := stubExit(t)
+	srv := newAuthorizationServer("v", func(TokensResponse) {})
+	ts := httptest.NewServer(srv.Handler)
+	defer ts.Close()
+
+	res, body := getComplete(t, ts.URL+"/authorization/valid?code=stale")
+	assertCompleteFailure(t, res, body, http.StatusUnauthorized)
+	ts.Close()
+	if len(exits) != 0 {
+		t.Errorf("the handler exited the process without a confirmed delivery")
+	}
+	select {
+	case <-srv.delivered:
+		t.Error("delivery marked confirmed without a tracked connection")
+	default:
+	}
+}
+
 func getComplete(t *testing.T, url string) (*http.Response, string) {
 	t.Helper()
 	res, err := http.Get(url)

From c0fb5cb166b9e16fa079f2774305ee653fdeeb09 Mon Sep 17 00:00:00 2001
From: Fabien FLEUREAU <ffleureau@qovery.com>
Date: Thu, 8 Oct 2026 14:39:35 +0200
Subject: [PATCH 15/15] test(auth): merge identical harness response branches

---
 pkg/testdata/auth_page_harness.js | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkg/testdata/auth_page_harness.js b/pkg/testdata/auth_page_harness.js
index 01aa672f..738df749 100644
--- a/pkg/testdata/auth_page_harness.js
+++ b/pkg/testdata/auth_page_harness.js
@@ -108,11 +108,7 @@ try {
   out.pending = snapshot();
 
   const xhr = requests[0];
-  if (scenario === "success") {
-    xhr.status = Number(process.env.AUTH_RESPONSE_STATUS);
-    xhr.responseText = process.env.AUTH_RESPONSE_BODY;
-    xhr.onload();
-  } else if (scenario === "http-error") {
+  if (scenario === "success" || scenario === "http-error") {
     xhr.status = Number(process.env.AUTH_RESPONSE_STATUS);
     xhr.responseText = process.env.AUTH_RESPONSE_BODY;
     xhr.onload();