[DEVOPS-4768] fix(auth): do not send stale tokenId on login

VERSION

@@ -1 +1 @@
-0.21.0
+0.21.1

authentication.go

@@ -122,7 +122,7 @@ func (c *Client) loginWithContext(ctx context.Context) error {
 		return fmt.Errorf("failed to build login url: %w", err)
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodPost, loginContentType, bytes.NewBufferString(loginBody))
+	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodPost, loginContentType, "", bytes.NewBufferString(loginBody))
 	if err != nil {
 		return fmt.Errorf("error while submitting login request: %w", err)
 	}
@@ -148,7 +148,7 @@ func (c *Client) isLoggedWithContext(ctx context.Context) (bool, error) {
 		return false, fmt.Errorf("failed to build isLogged url: %w", err)
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodGet, defaultContentType, nil)
+	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodGet, defaultContentType, c.credential.token, nil)
 	if err != nil && !strings.Contains(err.Error(), "json: cannot unmarshal bool into Go value") {
 		return false, fmt.Errorf("error while submitting isLogged request: %w", err)
 	}

dvls.go

@@ -76,14 +76,14 @@ func (c *Client) RequestWithContext(ctx context.Context, url string, reqMethod s
 		opts = options[0]
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, url, reqMethod, defaultContentType, reqBody, opts)
+	resp, err := c.rawRequestWithContext(ctx, url, reqMethod, defaultContentType, c.credential.token, reqBody, opts)
 	if err != nil {
 		return Response{}, err
 	}
 	return resp, nil
 }
 
-func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMethod string, contentType string, reqBody io.Reader, options ...RequestOptions) (Response, error) {
+func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMethod string, contentType string, token string, reqBody io.Reader, options ...RequestOptions) (Response, error) {
 	var opts RequestOptions
 	if len(options) > 0 {
 		opts = options[0]
@@ -97,8 +97,8 @@ func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMetho
 	req.Header.Add("Content-Type", contentType)
 	if c.credential.useApiKey() {
 		req.Header.Add("Authorization", "Bearer "+c.credential.apiKey)
-	} else {
-		req.Header.Add("tokenId", c.credential.token)
+	} else if token != "" {
+		req.Header.Add("tokenId", token)
 	}
 
 	resp, err := c.client.Do(req)

dvls_unit_test.go

@@ -30,6 +30,38 @@ func TestNewClient_Login(t *testing.T) {
 	assert.NotNil(t, client.Vaults)
 }
 
+func TestRequest_ReloginAfterTokenExpiry(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/login", func(w http.ResponseWriter, r *http.Request) {
+		assert.Empty(t, r.Header.Get("tokenId"), "login must not send the expired token")
+		w.Write([]byte(`{"tokenId":"new-token"}`))
+	})
+	mux.HandleFunc("/api/is-logged", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("tokenId") == "new-token" {
+			w.Write([]byte("true"))
+			return
+		}
+		w.Write([]byte("false"))
+	})
+	mux.HandleFunc("/api/v1/vault", func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "new-token", r.Header.Get("tokenId"))
+		w.Write([]byte(`{"result":1}`))
+	})
+
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	client := &Client{
+		baseUri:    server.URL,
+		client:     server.Client(),
+		credential: credentials{appKey: "test-key", appSecret: "test-secret", token: "expired-token"},
+	}
+
+	_, err := client.Request(server.URL+"/api/v1/vault", http.MethodGet, nil)
+	require.NoError(t, err)
+	assert.Equal(t, "new-token", client.credential.token)
+}
+
 func TestNewClientWithApiKey(t *testing.T) {
 	mux := http.NewServeMux()
 	loginCalled := false