[swolfand]

Summary

SessionAuthorizationTest > "has on a cached token stays under one millisecond" timed 1000 calls of checkAuthorization(plan = "plus") with System.nanoTime and required the 95th percentile to be under 1 ms. On shared CI runners, JIT warm-up, GC and other jobs on the same machine make that fail at random. It failed on #960 (run 38603921984, test-module :source:api, blacksmith-4vcpu-ubuntu-2404), and #960 doesn't touch this code.

The test now checks how much work each call does instead of timing it:

• It counts JWT claim reads (JWT.getClaim, through a MockK constructor spy that calls the real method). It asserts that 100 more calls do exactly 100 × the claim reads of the first call, so the work per call stays the same and doesn't grow.
• It asserts every call returns true, and that the call leaves SessionTokensCache empty: the read path neither stores nor fetches tokens.

The result is deterministic and doesn't depend on runner speed.

Note: SessionAuthorization.evaluate has no memoization. Each call decodes the JWT again (TokenFreshness.matches plus featuresClaim, plansClaim, issuedAtMillis and factorVerificationAgeClaim). So a check that "the token is decoded once across calls" would fail against the current code. Adding a per-JWT claim cache would change production code, so it is left out of this test-only PR.

Verification

• ./gradlew :source:api:testDebugUnitTest spotlessCheck detekt passes locally.
• Not run on an emulator: this PR only changes a JVM unit test, and nothing in source/api, source/ui or :e2e changes at runtime.

Summary by CodeRabbit

• Tests
  • Updated session authorization tests to verify consistent JWT claim reads across repeated calls and confirm that token caching remains unused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: clerk/clerk-android/.coderabbit.yaml
• Review profile: CHILL
• Plan: Team
• Run ID: de024973-b262-44cd-89f5-50151d6f940c

📥 Commits

Reviewing files that changed from the base of the PR and between 6698f7e and b5424a1.

📒 Files selected for processing: 1

• source/api/src/test/java/com/clerk/api/session/SessionAuthorizationTest.kt

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

📝 Walkthrough

The session authorization test replaces elapsed-time assertions with JWT claim-read counts. It measures a baseline authorization call, repeats authorization 100 times, and checks the total reads and token cache state.

Changes: Session authorization test

Layer / File(s)	Summary
Instrument repeated authorization calls source/api/src/test/java/com/clerk/api/session/SessionAuthorizationTest.kt	The test counts JWT claim reads for a successful authorization call, repeats authorization 100 times, and asserts the expected total and an empty token cache.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: mikepitre

Merge Risk: ⚪ Minimal · up to b5424

This change replaces a timing-sensitive check with deterministic assertions in a JVM unit test and does not change runtime authorization behavior. No material merge risk remains.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: making the cached-token authorization test deterministic.
Description check		The description explains the timing-test problem, the replacement assertions, the test scope, and local verification. It does not use the template headings exactly and omits screenshots, but those omi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}