From ff7ab2308dba2878ef62c398fae160d94e16f234 Mon Sep 17 00:00:00 2001
From: neboyang <neboyang@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:03:59 +0800
Subject: [PATCH] test(oauth): lock AuthorizeURL to claude.com/cai endpoint

---
 backend/internal/pkg/oauth/oauth_test.go | 25 ++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/backend/internal/pkg/oauth/oauth_test.go b/backend/internal/pkg/oauth/oauth_test.go
index 9e59f0f0b4..4e359392e7 100644
--- a/backend/internal/pkg/oauth/oauth_test.go
+++ b/backend/internal/pkg/oauth/oauth_test.go
@@ -1,11 +1,36 @@
 package oauth
 
 import (
+	"strings"
 	"sync"
 	"testing"
 	"time"
 )
 
+func TestAuthorizeURLMatchesClaudeCodeCLI(t *testing.T) {
+	const want = "https://claude.com/cai/oauth/authorize"
+	if AuthorizeURL != want {
+		t.Fatalf("AuthorizeURL = %q, want %q", AuthorizeURL, want)
+	}
+
+	authURL := BuildAuthorizationURL("state-value", "challenge-value", ScopeOAuth)
+	if !strings.HasPrefix(authURL, want+"?") {
+		t.Fatalf("BuildAuthorizationURL() = %q, want prefix %q", authURL, want+"?")
+	}
+	for _, part := range []string{
+		"code=true",
+		"client_id=" + ClientID,
+		"response_type=code",
+		"code_challenge=challenge-value",
+		"code_challenge_method=S256",
+		"state=state-value",
+	} {
+		if !strings.Contains(authURL, part) {
+			t.Fatalf("BuildAuthorizationURL() missing %q\nURL: %s", part, authURL)
+		}
+	}
+}
+
 func TestSessionStore_Stop_Idempotent(t *testing.T) {
 	store := NewSessionStore()