From f90ce8bace7c04cdc965a6db56492efe6980a283 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Fri, 19 Jun 2026 20:45:46 +0200
Subject: [PATCH] test(withings): scope the expired-nonce assertion to the
 token URL

The expired-nonce callback test asserted the global fetch spy was never
called. A preceding successful-connection test fires its webhook
subscriptions fire-and-forget, and those promises resolve into the next
test's freshly installed spy, so the broad assertion failed whenever the
background calls landed in time. Filter the recorded calls to the token
endpoint and assert none reached it, matching the replay and cross-user
tests in the same file and keeping the check true to its intent.
---
 tests/integration/withings-oauth-flow.test.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tests/integration/withings-oauth-flow.test.ts b/tests/integration/withings-oauth-flow.test.ts
index 4cf7faf7d..f6edb6d75 100644
--- a/tests/integration/withings-oauth-flow.test.ts
+++ b/tests/integration/withings-oauth-flow.test.ts
@@ -270,8 +270,15 @@ describe("Withings OAuth nonce ledger (real Postgres)", () => {
       "withings=error&reason=expired",
     );
 
-    // Token endpoint never hit.
-    expect(fetchSpy).not.toHaveBeenCalled();
+    // Token endpoint never hit. Scope the assertion to the token URL so a
+    // prior connection's fire-and-forget webhook subscriptions, which resolve
+    // asynchronously into this spy, cannot make the check flaky.
+    const tokenCalls = fetchSpy.mock.calls.filter(
+      ([input]) =>
+        (typeof input === "string" ? input : (input as Request).url) ===
+        WITHINGS_TOKEN_URL,
+    );
+    expect(tokenCalls).toHaveLength(0);
 
     // The handler stamps out the expired row so a clock-skewed replay
     // can't slip through.