From aa44a5909bf425c1b419b35332eb76062308e898 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 8 Sep 2026 05:15:27 +0900
Subject: [PATCH] test(codex): compare admission substitution against the
 stored JWT

(cherry picked from commit 9b9e4d28bebf58dcb07c161914b3b9e324c55713)

Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
---
 tests/codex-integration/codex-auth-context.test.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/codex-integration/codex-auth-context.test.ts b/tests/codex-integration/codex-auth-context.test.ts
index bb4f24a098..73417b85f7 100644
--- a/tests/codex-integration/codex-auth-context.test.ts
+++ b/tests/codex-integration/codex-auth-context.test.ts
@@ -1447,8 +1447,9 @@ describe("Codex auth context", () => {
     // The caller proved admission with one of OUR secrets. That secret must never leave the
     // process, so the only acceptable outcome is the stored main credential in its place.
     const admissionSecret = "ocx_data_localsecret";
+    const storedCredential = liveJwt();
     writeFileSync(join(testDir, "auth.json"), JSON.stringify({
-      tokens: { access_token: liveJwt(), account_id: "stored_main_acc" },
+      tokens: { access_token: storedCredential, account_id: "stored_main_acc" },
     }));
 
     const headers = materializeCodexUpstreamAuth(
@@ -1458,7 +1459,7 @@ describe("Codex auth context", () => {
     );
 
     expect(headers.get("authorization")).not.toContain(admissionSecret);
-    expect(headers.get("authorization")).toBe(`Bearer ${liveJwt()}`);
+    expect(headers.get("authorization")).toBe(`Bearer ${storedCredential}`);
     expect(headers.get("chatgpt-account-id")).toBe("stored_main_acc");
     // Unrelated forwarded headers still ride along.
     expect(headers.get("openai-beta")).toBe("responses=experimental");