test(linear-feedback): rewrite tests against OAuth context signature

Wave C migrated postIssueComment / addIssueReaction / reportIssueFailure
from a (secretArn: string, ...) signature to a (ctx: LinearFeedbackContext,
...) signature, but the test file still passed bare strings — TypeScript
caught it at compile time only when CI ran a full build. Three test
suites failed to compile (the typecheck error blocked the whole suite,
not just this file).

- Mock `resolveLinearOauthToken` (the new resolver) instead of
  `getLinearSecret` (the old PAK fetcher).
- Build a `LinearFeedbackContext` fixture with linearWorkspaceId +
  registryTableName, pass it everywhere SECRET_ARN was used.
- Update the Authorization-header assertion to match the new
  `Bearer <token>` form (PAK was bare-token; OAuth is Bearer-prefixed).

All 41 tests across linear-feedback, linear-webhook-processor, and
orchestrate-task-feedback pass locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bgagent

cdk/test/handlers/shared/linear-feedback.test.ts

@@ -17,9 +17,9 @@
  *  SOFTWARE.
  */
 
-const getLinearSecretMock = jest.fn();
-jest.mock('../../../src/handlers/shared/linear-verify', () => ({
-  getLinearSecret: (...args: unknown[]) => getLinearSecretMock(...args),
+const resolveLinearOauthTokenMock = jest.fn();
+jest.mock('../../../src/handlers/shared/linear-oauth-resolver', () => ({
+  resolveLinearOauthToken: (...args: unknown[]) => resolveLinearOauthTokenMock(...args),
 }));
 
 const fetchMock = jest.fn();
@@ -28,13 +28,17 @@ const fetchMock = jest.fn();
 
 import {
   addIssueReaction,
+  type LinearFeedbackContext,
   postIssueComment,
   reportIssueFailure,
 } from '../../../src/handlers/shared/linear-feedback';
 
-const SECRET_ARN = 'arn:aws:secretsmanager:us-east-1:123:secret:bgagent/linear/api-token-XYZ';
+const CTX: LinearFeedbackContext = {
+  linearWorkspaceId: 'ws-uuid-1',
+  registryTableName: 'TestLinearWorkspaceRegistry',
+};
 const ISSUE_ID = 'issue-1';
-const TOKEN = 'lin_api_TESTTOKEN';
+const TOKEN = 'lin_oauth_TESTTOKEN';
 
 function jsonResponse(body: unknown, status: number = 200): Response {
   return {
@@ -46,34 +50,40 @@ function jsonResponse(body: unknown, status: number = 200): Response {
 
 describe('linear-feedback', () => {
   beforeEach(() => {
-    getLinearSecretMock.mockReset();
+    resolveLinearOauthTokenMock.mockReset();
     fetchMock.mockReset();
-    getLinearSecretMock.mockResolvedValue(TOKEN);
+    resolveLinearOauthTokenMock.mockResolvedValue({
+      accessToken: TOKEN,
+      scope: 'read write',
+      workspaceSlug: 'acme',
+      oauthSecretArn: 'arn:secret:acme',
+    });
     fetchMock.mockResolvedValue(jsonResponse({ data: { commentCreate: { success: true } } }));
   });
 
   describe('postIssueComment', () => {
     test('POSTs the commentCreate mutation with the issue id and body', async () => {
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, '❌ blocked');
+      const ok = await postIssueComment(CTX, ISSUE_ID, '❌ blocked');
 
       expect(ok).toBe(true);
       expect(fetchMock).toHaveBeenCalledTimes(1);
       const [url, init] = fetchMock.mock.calls[0];
       expect(url).toBe('https://api.linear.app/graphql');
       expect(init.method).toBe('POST');
       expect(init.headers).toMatchObject({
-        'Authorization': TOKEN,
+        // OAuth tokens use Bearer prefix per Phase 2.0b-O2.
+        'Authorization': `Bearer ${TOKEN}`,
         'Content-Type': 'application/json',
       });
       const body = JSON.parse(init.body as string) as { query: string; variables: Record<string, string> };
       expect(body.query).toContain('commentCreate');
       expect(body.variables).toEqual({ issueId: ISSUE_ID, body: '❌ blocked' });
     });
 
-    test('returns false (and logs warn) when the secret cannot be resolved', async () => {
-      getLinearSecretMock.mockResolvedValueOnce(null);
+    test('returns false (and logs warn) when the token cannot be resolved', async () => {
+      resolveLinearOauthTokenMock.mockResolvedValueOnce(null);
 
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, 'msg');
+      const ok = await postIssueComment(CTX, ISSUE_ID, 'msg');
 
       expect(ok).toBe(false);
       expect(fetchMock).not.toHaveBeenCalled();
@@ -82,31 +92,31 @@ describe('linear-feedback', () => {
     test('returns false on non-2xx response (no throw)', async () => {
       fetchMock.mockResolvedValueOnce(jsonResponse({}, 500));
 
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, 'msg');
+      const ok = await postIssueComment(CTX, ISSUE_ID, 'msg');
 
       expect(ok).toBe(false);
     });
 
     test('returns false on GraphQL errors (no throw)', async () => {
       fetchMock.mockResolvedValueOnce(jsonResponse({ errors: [{ message: 'auth' }] }));
 
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, 'msg');
+      const ok = await postIssueComment(CTX, ISSUE_ID, 'msg');
 
       expect(ok).toBe(false);
     });
 
     test('returns false on network failure (swallowed)', async () => {
       fetchMock.mockRejectedValueOnce(new Error('ECONNRESET'));
 
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, 'msg');
+      const ok = await postIssueComment(CTX, ISSUE_ID, 'msg');
 
       expect(ok).toBe(false);
     });
 
-    test('returns false when getLinearSecret throws (swallowed at resolveToken layer)', async () => {
-      getLinearSecretMock.mockRejectedValueOnce(new Error('AccessDenied'));
+    test('returns false when resolveLinearOauthToken throws (swallowed at resolveToken layer)', async () => {
+      resolveLinearOauthTokenMock.mockRejectedValueOnce(new Error('AccessDenied'));
 
-      const ok = await postIssueComment(SECRET_ARN, ISSUE_ID, 'msg');
+      const ok = await postIssueComment(CTX, ISSUE_ID, 'msg');
 
       expect(ok).toBe(false);
       expect(fetchMock).not.toHaveBeenCalled();
@@ -115,7 +125,7 @@ describe('linear-feedback', () => {
 
   describe('addIssueReaction', () => {
     test('defaults to ❌ (emoji short-code "x")', async () => {
-      await addIssueReaction(SECRET_ARN, ISSUE_ID);
+      await addIssueReaction(CTX, ISSUE_ID);
 
       const init = fetchMock.mock.calls[0][1];
       const body = JSON.parse(init.body as string) as { query: string; variables: { emoji: string } };
@@ -124,7 +134,7 @@ describe('linear-feedback', () => {
     });
 
     test('honours an explicit emoji argument', async () => {
-      await addIssueReaction(SECRET_ARN, ISSUE_ID, 'eyes');
+      await addIssueReaction(CTX, ISSUE_ID, 'eyes');
 
       const init = fetchMock.mock.calls[0][1];
       const body = JSON.parse(init.body as string) as { variables: { emoji: string } };
@@ -134,7 +144,7 @@ describe('linear-feedback', () => {
 
   describe('reportIssueFailure', () => {
     test('posts comment + ❌ in parallel via Promise.allSettled', async () => {
-      await reportIssueFailure(SECRET_ARN, ISSUE_ID, '❌ failed');
+      await reportIssueFailure(CTX, ISSUE_ID, '❌ failed');
 
       expect(fetchMock).toHaveBeenCalledTimes(2);
       const queries = fetchMock.mock.calls.map((c) => {
@@ -151,13 +161,13 @@ describe('linear-feedback', () => {
         .mockResolvedValueOnce(jsonResponse({}, 500))
         .mockResolvedValueOnce(jsonResponse({ data: { reactionCreate: { success: true } } }));
 
-      await expect(reportIssueFailure(SECRET_ARN, ISSUE_ID, 'msg')).resolves.toBeUndefined();
+      await expect(reportIssueFailure(CTX, ISSUE_ID, 'msg')).resolves.toBeUndefined();
     });
 
     test('does not throw when both legs fail', async () => {
       fetchMock.mockRejectedValue(new Error('ECONNRESET'));
 
-      await expect(reportIssueFailure(SECRET_ARN, ISSUE_ID, 'msg')).resolves.toBeUndefined();
+      await expect(reportIssueFailure(CTX, ISSUE_ID, 'msg')).resolves.toBeUndefined();
     });
   });
 });