From 5dc4a1b742168a43f69c02685a170f592168761d Mon Sep 17 00:00:00 2001
From: Senior Engineer <senior-engineer@frenocorp.com>
Date: Sun, 10 May 2026 09:38:21 -0400
Subject: [PATCH] Fix FRE-4693 code review findings: 2-arg constructor, 403
 error test, error content check

- Pass nil refresher to NewProtonMailClient at all 5 call sites
- Change TestListMessages_APIError from 401 to 403 (avoids refresh interception)
- Add error content assertion to TestGetMessage_NotFound
---
 internal/mail/client_test.go | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/internal/mail/client_test.go b/internal/mail/client_test.go
index e8c90d7..98aa6e1 100644
--- a/internal/mail/client_test.go
+++ b/internal/mail/client_test.go
@@ -87,7 +87,7 @@ func newTestClient(t *testing.T, srv *mockServer) *Client {
 		RateLimitReq: 100,
 		RateLimitWin: 60,
 	}
-	apiClient := api.NewProtonMailClient(cfg)
+	apiClient := api.NewProtonMailClient(cfg, nil)
 	apiClient.SetAuthHeader("test-token")
 	return NewClient(apiClient)
 }
@@ -294,8 +294,8 @@ func TestListMessages_APIError(t *testing.T) {
 	client := newTestClient(t, srv)
 
 	srv.Handle("POST /api/messages", func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnauthorized)
-		fmt.Fprintf(w, `{"Code":401,"Message":"invalid token"}`)
+		w.WriteHeader(http.StatusForbidden)
+		fmt.Fprintf(w, `{"Code":403,"Message":"invalid token"}`)
 	})
 
 	_, err := client.ListMessages(ListMessagesRequest{
@@ -304,7 +304,7 @@ func TestListMessages_APIError(t *testing.T) {
 		Passphrase: "pass",
 	})
 	if err == nil {
-		t.Fatal("expected error for 401 response")
+		t.Fatal("expected error for 403 response")
 	}
 	if !strings.Contains(err.Error(), "invalid token") {
 		t.Errorf("expected 'invalid token' in error, got: %s", err.Error())
@@ -404,6 +404,9 @@ func TestGetMessage_NotFound(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error for 404")
 	}
+	if !strings.Contains(err.Error(), "message not found") {
+		t.Errorf("expected 'message not found' in error, got: %s", err.Error())
+	}
 }
 
 func TestGetMessage_DecryptBody(t *testing.T) {
@@ -417,7 +420,7 @@ func TestGetMessage_DecryptBody(t *testing.T) {
 		RateLimitReq: 100,
 		RateLimitWin: 60,
 	}
-	apiClient := api.NewProtonMailClient(cfg)
+	apiClient := api.NewProtonMailClient(cfg, nil)
 	apiClient.SetAuthHeader("test-token")
 	client := NewClient(apiClient)
 	client.SetPGPService(svc)
@@ -488,7 +491,7 @@ func TestSend_WithPGP(t *testing.T) {
 		RateLimitReq: 100,
 		RateLimitWin: 60,
 	}
-	apiClient := api.NewProtonMailClient(cfg)
+	apiClient := api.NewProtonMailClient(cfg, nil)
 	apiClient.SetAuthHeader("test-token")
 	client := NewClient(apiClient)
 	client.SetPGPService(svc)
@@ -1089,7 +1092,7 @@ func TestAuthHeader_Propagated(t *testing.T) {
 		RateLimitReq: 100,
 		RateLimitWin: 60,
 	}
-	apiClient := api.NewProtonMailClient(cfg)
+	apiClient := api.NewProtonMailClient(cfg, nil)
 	apiClient.SetAuthHeader("my-test-token")
 	client := NewClient(apiClient)
 
@@ -1324,7 +1327,7 @@ func TestListMessages_Timeout(t *testing.T) {
 		RateLimitReq: 100,
 		RateLimitWin: 60,
 	}
-	apiClient := api.NewProtonMailClient(cfg)
+	apiClient := api.NewProtonMailClient(cfg, nil)
 	apiClient.SetAuthHeader("test-token")
 	client := NewClient(apiClient)