Our OAuth auth-code exchange needed to reject a code that had already been used, but I needed to verify the behavior under realistic sequences — not just the happy path.
02
Task
Confirm the flow returns success for a fresh code and the right error when a code is replayed.
03
Action
I drove a deliberate test matrix through the API client and checked the logs after each call to confirm the server actually behaved as expected.
The sequence that proves single-use: fresh code succeeds, replay fails, a new code succeeds, its replay fails.The behavior, as a testjava
@Test
void authCode_isSingleUse() {
String code = issueAuthCode(user);
// (1) correct code -> success
assertThat(exchange(code).getStatusCode()).isEqualTo(OK);
// (2) same code again -> already used
assertThat(exchange(code).getStatusCode()).isEqualTo(BAD_REQUEST);
// (3) a new code -> success
String next = issueAuthCode(user);
assertThat(exchange(next).getStatusCode()).isEqualTo(OK);
// (4) replay the new code -> error
assertThat(exchange(next).getStatusCode()).isEqualTo(BAD_REQUEST);
}
04
Result
Verified single-use enforcement end-to-end and locked it in with tests.
Prevented a subtle security regression in the auth flow before it could ship.
Turned an implicit expectation into an explicit, regression-proof contract.