js/libs/keycloak-admin-client/test/client.spec.ts:30

• responses is declared but not initialized before it’s used in the server request handler (responses.shift()), which can throw TypeError: Cannot read properties of undefined if a request arrives before a test assigns responses (or if a test forgets to). Initialize responses to an empty array (and consider resetting it in beforeEach) so the handler fails gracefully with the intended 500 response instead of crashing.

  let responses: object[];

  before(async () => {
    server = createServer((_req, res) => {
      const response = responses.shift();
      res.writeHead(response ? 200 : 500, {
        "content-type": "application/json",
      });
      res.end(JSON.stringify(response ?? { error: "No response queued." }));
    });

js/libs/keycloak-admin-client/src/client.ts:150

• Using a truthiness check here treats an empty string refresh token as “missing” and silently clears decoded state. If the intent is specifically “only skip decode when the token is absent,” check for token !== undefined (or typeof token !== \"undefined\") rather than truthiness so behavior matches the declared type (string | undefined).

  public setRefreshToken(token?: string) {
    this.refreshToken = token;
    this.#refreshTokenDecoded = token ? decodeToken(token) : undefined;

js/libs/keycloak-admin-client/src/client.ts:190

• This condition is meant to detect “omitted refresh token,” but if (refreshToken) is a truthiness check and will also skip updates for empty-string values. To align with the comment and with refreshToken?: string, check explicitly for omission (e.g., refreshToken !== undefined) so the logic is based on presence rather than truthiness.

    // The current refresh token remains valid if the response does not carry a new one.
    if (refreshToken) {
      this.setRefreshToken(refreshToken);
    }

js/libs/keycloak-admin-client/src/client.ts:190

• if (refreshToken) treats an empty-string refresh token as “missing” and will incorrectly keep the old refresh token. Prefer checking explicitly for omission (e.g., refreshToken !== undefined) so only a truly absent field keeps the prior token.

    this.setAccessToken(accessToken);

    // The current refresh token remains valid if the response does not carry a new one.
    if (refreshToken) {
      this.setRefreshToken(refreshToken);
    }

js/libs/keycloak-admin-client/test/client.spec.ts:44

• The stubbed token endpoint responses don’t match the library’s declared TokenResponseRaw shape (many fields are required by type, but omitted in tests). To keep these tests robust against future implementation changes (e.g., if auth starts reading expires_in, token_type, etc.), consider returning a more realistic full response object in the fixtures while still omitting refresh_token in the relevant cases.

    responses = [{ access_token: token(60) }];

js/libs/keycloak-admin-client/test/client.spec.ts:59

• The stubbed token endpoint responses don’t match the library’s declared TokenResponseRaw shape (many fields are required by type, but omitted in tests). To keep these tests robust against future implementation changes (e.g., if auth starts reading expires_in, token_type, etc.), consider returning a more realistic full response object in the fixtures while still omitting refresh_token in the relevant cases.

    responses = [
      { access_token: token(-60), refresh_token: refreshToken },
      { access_token: renewedAccessToken },
    ];

js/libs/keycloak-admin-client/test/client.spec.ts:37

• closeAllConnections() was added in Node 18.2, while this package declares support for all Node versions >=18; on 18.0/18.1 the teardown throws a TypeError. Guard the optional cleanup method so the test still runs across the declared engine range.

    server.closeAllConnections();

js/libs/keycloak-admin-client/src/client.ts:150

• The new auth test starts with an empty client, so it would still pass if a missing refresh token were handled as a no-op and a token from a previous auth() remained. Add a regression case that authenticates once with a refresh token and then without one, asserting both the stored and decoded refresh-token state are cleared (for example via isRefreshTokenExpired() after using an already-expired first token).

  public setRefreshToken(token?: string) {
    this.refreshToken = token;
    this.#refreshTokenDecoded = token ? decodeToken(token) : undefined;