feat: add auth and addtional requested changes #26

[mbristol580]

Summary by cubic

Adds optional OAuth 2.0 client-credentials auth and a configurable API endpoint path to the JUnit client to support secured Fern Platform deployments. Default behavior remains unchanged when OAuth is not configured.

• New Features
  • OAuth support via env vars: AUTH_URL, FERN_AUTH_CLIENT_ID, FERN_AUTH_CLIENT_SECRET, optional FERN_CLIENT_SCOPE; sends Bearer token and refreshes before expiry.
  • Configurable API endpoint path with FERN_API_ENDPOINT_PATH (default: api/v1/test-runs).
  • Verbose mode now logs payload, endpoint, OAuth status, response status/body/headers.
  • CLI help and README updated for Fern Platform and OAuth examples.
  • Added comprehensive unit tests for OAuth and authenticated send flow.

^{Written for commit 1185754. Summary will update automatically on new commits.}

[cubic-dev-ai]

2 issues found across 6 files

Prompt for AI agents (all 2 issues)

Understand the root cause of the following 2 issues and fix them.


<file name="pkg/auth/oauth.go">

<violation number="1" location="pkg/auth/oauth.go:120">
fetchToken updates c.token without synchronization, so sharing this OAuthClient through HTTPClient leads to data races when the client is used concurrently.</violation>
</file>

<file name="pkg/auth/oauth_test.go">

<violation number="1" location="pkg/auth/oauth_test.go:357">
Sleeping for 35s here makes this test suite take roughly half a minute to run every time. Please simulate the timeout with a faster failure path (e.g., cancel the context or dial an unreachable address) instead of a long sleep so the test stays fast.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

fetchToken updates c.token without synchronization, so sharing this OAuthClient through HTTPClient leads to data races when the client is used concurrently.

Prompt for AI agents

Address the following comment on pkg/auth/oauth.go at line 120:

<comment>fetchToken updates c.token without synchronization, so sharing this OAuthClient through HTTPClient leads to data races when the client is used concurrently.</comment>

<file context>
@@ -0,0 +1,181 @@
+	}
+
+	// Store the token and calculate expiry
+	c.token = &amp;tokenResp
+	// Subtract 30 seconds from expiry to ensure we refresh before it actually expires
+	expiryDuration := time.Duration(tokenResp.ExpiresIn-30) * time.Second
</file context>

[cubic-dev-ai]

No issues found across 4 files