From 2dd23608f86a594fa12a4ee9d25fc0f3cbd22390 Mon Sep 17 00:00:00 2001
From: Gustavo Madeira Santana <gumadeiras@gmail.com>
Date: Sat, 14 Feb 2026 16:00:34 -0500
Subject: [PATCH] test: remove nullable token fallbacks in pairing coverage

---
 src/infra/device-pairing.test.ts | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/infra/device-pairing.test.ts b/src/infra/device-pairing.test.ts
index bed6f0928bc..2335c2f7d74 100644
--- a/src/infra/device-pairing.test.ts
+++ b/src/infra/device-pairing.test.ts
@@ -23,16 +23,23 @@ async function setupPairedOperatorDevice(baseDir: string, scopes: string[]) {
   await approveDevicePairing(request.request.requestId, baseDir);
 }
 
+function requireToken(token: string | undefined): string {
+  expect(typeof token).toBe("string");
+  if (typeof token !== "string") {
+    throw new Error("expected operator token to be issued");
+  }
+  return token;
+}
+
 describe("device pairing tokens", () => {
   test("generates base64url device tokens with 256-bit entropy output length", async () => {
     const baseDir = await mkdtemp(join(tmpdir(), "openclaw-device-pairing-"));
     await setupPairedOperatorDevice(baseDir, ["operator.admin"]);
 
     const paired = await getPairedDevice("device-1", baseDir);
-    const token = paired?.tokens?.operator?.token;
-    expect(typeof token).toBe("string");
+    const token = requireToken(paired?.tokens?.operator?.token);
     expect(token).toMatch(/^[A-Za-z0-9_-]{43}$/);
-    expect(Buffer.from(token as string, "base64url")).toHaveLength(32);
+    expect(Buffer.from(token, "base64url")).toHaveLength(32);
   });
 
   test("preserves existing token scopes when rotating without scopes", async () => {
@@ -62,12 +69,11 @@ describe("device pairing tokens", () => {
     const baseDir = await mkdtemp(join(tmpdir(), "openclaw-device-pairing-"));
     await setupPairedOperatorDevice(baseDir, ["operator.read"]);
     const paired = await getPairedDevice("device-1", baseDir);
-    const token = paired?.tokens?.operator?.token;
-    expect(typeof token).toBe("string");
+    const token = requireToken(paired?.tokens?.operator?.token);
 
     const ok = await verifyDeviceToken({
       deviceId: "device-1",
-      token: token as string,
+      token,
       role: "operator",
       scopes: ["operator.read"],
       baseDir,
@@ -76,7 +82,7 @@ describe("device pairing tokens", () => {
 
     const mismatch = await verifyDeviceToken({
       deviceId: "device-1",
-      token: "x".repeat((token as string).length),
+      token: "x".repeat(token.length),
       role: "operator",
       scopes: ["operator.read"],
       baseDir,
@@ -89,10 +95,9 @@ describe("device pairing tokens", () => {
     const baseDir = await mkdtemp(join(tmpdir(), "openclaw-device-pairing-"));
     await setupPairedOperatorDevice(baseDir, ["operator.read"]);
     const paired = await getPairedDevice("device-1", baseDir);
-    const token = paired?.tokens?.operator?.token;
-    expect(typeof token).toBe("string");
-    const multibyteToken = "é".repeat((token as string).length);
-    expect(Buffer.from(multibyteToken).length).not.toBe(Buffer.from(token as string).length);
+    const token = requireToken(paired?.tokens?.operator?.token);
+    const multibyteToken = "é".repeat(token.length);
+    expect(Buffer.from(multibyteToken).length).not.toBe(Buffer.from(token).length);
 
     await expect(
       verifyDeviceToken({