auth: surface refresh-slot read errors in LoadTokens

contextTokenStore.LoadTokens swallowed every error from the refresh-slot
Get, so a transient keyring/file-store failure silently became an empty
refresh token — discarding a valid token and forcing a re-login on what
was really a recoverable storage hiccup. Mirror the access-token handling:
ErrNotFound means no refresh, any other error surfaces.

Adds tokenstore.UseFailingGetBackendForTesting (read-side fault seam) and a
test asserting the error propagates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: toothbrush

cmd/entire/cli/auth/refresh.go

@@ -52,7 +52,14 @@ func (s contextTokenStore) LoadTokens(string) (tokens.TokenSet, error) {
 		return tokens.TokenSet{}, fmt.Errorf("read access token: %w", err)
 	}
 	access, expiresAt := tokenstore.DecodeTokenWithExpiration(enc)
-	refresh, _ := tokenstore.Get(tokenstore.RefreshService(s.service), s.handle) //nolint:errcheck // an absent refresh token is fine — treated as no-refresh
+	// A missing refresh slot is fine (login predating offline_access) — treat
+	// it as no-refresh. Any other store error must surface, not be swallowed:
+	// dropping it would silently discard a valid refresh token and force a
+	// re-login on what was really a transient keyring/file-store failure.
+	refresh, err := tokenstore.Get(tokenstore.RefreshService(s.service), s.handle)
+	if err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
+		return tokens.TokenSet{}, fmt.Errorf("read refresh token: %w", err)
+	}
 	return tokens.TokenSet{
 		AccessToken:  access,
 		RefreshToken: refresh,

cmd/entire/cli/auth/refresh_test.go

@@ -18,11 +18,15 @@ import (
 	"github.com/entireio/cli/internal/entireclient/tokenstore"
 )
 
+// testCoreService is the keychain access-token service used across the
+// contextTokenStore tests (paired refresh slot is RefreshService(it)).
+const testCoreService = "entire-core:https://core.example"
+
 func TestContextTokenStore_RoundTrip(t *testing.T) {
 	restore := tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json"))
 	t.Cleanup(restore)
 
-	st := contextTokenStore{service: "entire-core:https://core.example", handle: "alice"}
+	st := contextTokenStore{service: testCoreService, handle: "alice"}
 
 	// Missing → ErrNotFound.
 	if _, err := st.LoadTokens(""); !errors.Is(err, authtokenstore.ErrNotFound) {
@@ -60,6 +64,32 @@ func TestContextTokenStore_RoundTrip(t *testing.T) {
 	}
 }
 
+// A non-NotFound failure reading the refresh slot must surface, not be
+// swallowed — swallowing would discard a valid refresh token and force a
+// re-login on a transient keyring/file-store hiccup.
+func TestContextTokenStore_LoadTokens_RefreshReadErrorSurfaces(t *testing.T) {
+	svc := testCoreService
+
+	// Seed a valid access token through a clean backend.
+	path := filepath.Join(t.TempDir(), "tokens.json")
+	seedRestore := tokenstore.UseFileBackendForTesting(path)
+	access := makeJWT(t, fmt.Sprintf(`{"iss":"https://core.example","handle":"alice","exp":%d}`, time.Now().Add(time.Hour).Unix()))
+	if err := tokenstore.Set(svc, "alice", tokenstore.EncodeTokenWithExpiration(access, 3600)); err != nil {
+		t.Fatalf("seed access: %v", err)
+	}
+	seedRestore()
+
+	// Fail only the refresh-slot read; the access read still succeeds.
+	failRefreshGet := func(service, _ string) bool { return service == tokenstore.RefreshService(svc) }
+	restore := tokenstore.UseFailingGetBackendForTesting(path, failRefreshGet)
+	t.Cleanup(restore)
+
+	st := contextTokenStore{service: svc, handle: "alice"}
+	if _, err := st.LoadTokens(""); err == nil {
+		t.Fatal("LoadTokens: want error when the refresh-slot read fails, got nil")
+	}
+}
+
 func TestNewRefreshingLoginProvider_Validation(t *testing.T) {
 	if _, err := NewRefreshingLoginProvider(nil, nil, false); err == nil {
 		t.Error("nil context: want error")
@@ -189,7 +219,7 @@ func TestNewRefreshingLoginProvider_RefreshesAndRotates(t *testing.T) {
 // re-login. The store persists refresh-first to invert both failure modes.
 func TestContextTokenStore_SaveTokens_RefreshFirstOrdering(t *testing.T) {
 	t.Run("refresh write fails: access slot untouched", func(t *testing.T) {
-		svc := "entire-core:https://core.example"
+		svc := testCoreService
 		path := filepath.Join(t.TempDir(), "tokens.json")
 
 		// Seed an existing good pair through a clean backend first — the fault
@@ -224,7 +254,7 @@ func TestContextTokenStore_SaveTokens_RefreshFirstOrdering(t *testing.T) {
 	})
 
 	t.Run("access write fails: refresh slot already advanced (self-heals)", func(t *testing.T) {
-		svc := "entire-core:https://core.example"
+		svc := testCoreService
 		failAccess := func(service, _ string) bool { return service == svc }
 		restore := tokenstore.UseFailingBackendForTesting(filepath.Join(t.TempDir(), "tokens.json"), failAccess)
 		t.Cleanup(restore)

internal/entireclient/tokenstore/testing.go

@@ -33,10 +33,21 @@ func UseFileBackendForTesting(path string) func() {
 // paths (e.g. the refresh-then-access ordering in contextTokenStore) without
 // exposing the unexported store interface. Returns a cleanup function.
 func UseFailingBackendForTesting(path string, failSet func(service, user string) bool) func() {
+	return installFaultStore(faultStore{inner: &fileStore{path: path}, failSet: failSet})
+}
+
+// UseFailingGetBackendForTesting is the read-side analogue: Get returns an
+// error for any (service, user) pair where failGet reports true. Used to test
+// that callers surface a real store failure rather than swallowing it.
+func UseFailingGetBackendForTesting(path string, failGet func(service, user string) bool) func() {
+	return installFaultStore(faultStore{inner: &fileStore{path: path}, failGet: failGet})
+}
+
+func installFaultStore(fs faultStore) func() {
 	backendMu.Lock()
 	prevBackend := backend
 	prevResolved := resolved
-	backend = faultStore{inner: &fileStore{path: path}, failSet: failSet}
+	backend = fs
 	resolved = true
 	backendMu.Unlock()
 
@@ -51,9 +62,13 @@ func UseFailingBackendForTesting(path string, failSet func(service, user string)
 type faultStore struct {
 	inner   store
 	failSet func(service, user string) bool
+	failGet func(service, user string) bool
 }
 
 func (f faultStore) Get(service, user string) (string, error) {
+	if f.failGet != nil && f.failGet(service, user) {
+		return "", fmt.Errorf("injected Get failure for %s/%s", service, user)
+	}
 	//nolint:wrapcheck // thin test wrapper; callers handle errors
 	return f.inner.Get(service, user)
 }