chore: rework msw usage to support more runtimes

[frederikprijck]

Description

• Replace msw/node with a custom mock-http.ts fetch-patching implementation across all packages (auth0-auth-js, auth0-server-js, auth0-api-js) so tests run on Bun, Deno, and Cloudflare Workers without Node.js
  HTTP interceptors
  • Add a BroadcastChannel stub polyfill for the Workers runtime, where MSW imports it unconditionally but it is not available as a global
  • Update vitest.config.workers.ts and wrangler.toml in each package to wire up the new test utilities

References

N/A

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

Summary by CodeRabbit

• Chores
  • Introduced shared testing utilities package for improved test setup and consistency across projects.
  • Updated CI workflows to properly execute tests in package directories.
  • Enhanced test environment configuration with standardized polyfills for browser APIs and storage.
  • Migrated test infrastructure to use shared HTTP mocking utilities.

[coderabbitai]

Warning

Review limit reached

@frederikprijck, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 43 minutes and 37 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a3484d21-49d8-43a6-8597-06972608db1e

📥 Commits

Reviewing files that changed from the base of the PR and between 383c54b and 6e64497.

📒 Files selected for processing (1)

• packages/test-utils/src/http.ts

📝 Walkthrough

Walkthrough

This PR establishes a centralized test utilities package (@auth0/test-utils) with custom MSW HTTP mocking, localStorage, and BroadcastChannel polyfills, then migrates three auth0 packages to use these shared utilities while updating their Vitest configurations to define package constants and include all spec files.

Changes

Test utilities and MSW migration

Layer / File(s)	Summary
Test utilities package foundation packages/test-utils/package.json, packages/test-utils/src/http.ts, packages/test-utils/src/localstorage-polyfill.ts, packages/test-utils/src/workers-polyfill.ts	Introduces @auth0/test-utils with three exports: a custom setupServer() that wraps MSW and patches globalThis.fetch to route requests through handlers, an in-memory localStorage backed by a Map, and a BroadcastChannel stub for Workers environments.
auth0-api-js test infrastructure packages/auth0-api-js/package.json, packages/auth0-api-js/src/api-client.spec.ts, packages/auth0-api-js/src/dpop-api.scenarios.spec.ts, packages/auth0-api-js/src/test-utils/workers-polyfills.ts, packages/auth0-api-js/vitest.config.ts, packages/auth0-api-js/vitest.config.workers.ts	Adds test-utils dependency, migrates test harnesses to use the new setupServer (moving server creation into async beforeAll hooks), adds workers-polyfills setup file, configures Vitest to load localStorage polyfill, and updates worker config to expose __AUTH0_API_JS_PACKAGE_NAME__ and __AUTH0_API_JS_PACKAGE_VERSION__ constants while expanding test discovery from *.workers.spec.ts to all *.spec.ts files.
auth0-auth-js test infrastructure packages/auth0-auth-js/package.json, packages/auth0-auth-js/src/auth-client.spec.ts, packages/auth0-auth-js/src/mfa/mfa-client.spec.ts, packages/auth0-auth-js/src/passkey/passkey-client.spec.ts, packages/auth0-auth-js/src/test-utils/workers-polyfills.ts, packages/auth0-auth-js/vitest.config.ts, packages/auth0-auth-js/vitest.config.workers.ts	Integrates test-utils into three test suites, replaces msw/node setupServer with the custom variant, removes onUnhandledRequest: 'error' configuration from server startup, adds workers-polyfills setup, and configures Vitest with localStorage polyfill, package constants, and broader spec file matching.
auth0-server-js test infrastructure packages/auth0-server-js/package.json, packages/auth0-server-js/src/server-client.spec.ts, packages/auth0-server-js/src/mfa/server-mfa-client.spec.ts, packages/auth0-server-js/src/test-utils/workers-polyfills.ts, packages/auth0-server-js/vitest.config.ts, packages/auth0-server-js/vitest.config.workers.ts	Adds test-utils dependency, updates server test harnesses to use the new setupServer from @auth0/test-utils/http, adds workers-polyfills configuration, and configures Vitest with localStorage polyfill and package name/version constants while expanding test discovery pattern.
CI workflow directory alignment .github/workflows/runtime-bun.yml, .github/workflows/runtime-deno.yml, .github/workflows/runtime-workers.yml	Adds working-directory: packages/${{ matrix.package }} to test steps in Bun and Deno workflows, and aligns formatting in the Workers workflow, ensuring test execution runs from the correct package subdirectory.

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• auth0/auth0-auth-js#150: Extends the runtime workflow setup by adjusting working-directory and test.include patterns introduced in this PR.

Suggested reviewers

• Piyush-85

Poem

🐰 A rabbit hops through test-utils divine,
MSW mocked at each request line,
Polyfills bundled, no more repeat—
One package to rule the test suite.
Now auth0 dances to setupServer's beat! 🎭✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'chore: rework msw usage to support more runtimes' accurately reflects the primary objective: refactoring MSW usage to work across multiple runtime environments (Bun, Deno, Cloudflare Workers).
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/runtimes-ci-refactor-tests

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[frederikprijck]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/test-utils/src/http.ts`:
- Around line 21-23: The listen/close pair currently overwrites originalFetch on
repeated listen() calls and blindly restores globalThis.fetch on close(),
causing corruption; update listen() (the function that assigns originalFetch and
patches globalThis.fetch) to only set originalFetch if it is currently
undefined/null (i.e., preserve the first saved original fetch) and make close()
check that globalThis.fetch is still the patched function before restoring
originalFetch and then clear originalFetch so repeated close()/listen() cycles
are safe; reference the originalFetch variable and the patched globalThis.fetch
assignment in listen() and the restore logic in close().
- Around line 6-7: The MockHttpServer interface wrongly types resetHandlers as
parameterless while the implementation allows replacing handlers; update the
resetHandlers signature in the interface to accept handler arguments like use
does (e.g., resetHandlers: (...handlers: RequestHandler[]) => void or
resetHandlers: (handlers?: RequestHandler[] | RequestHandler) => void) so
callers can pass replacement handlers; adjust both occurrences of resetHandlers
in the interface to match the implementation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1da5f806-3ade-4367-8453-a706a9984207

📥 Commits

Reviewing files that changed from the base of the PR and between aef75b1 and 383c54b.

📒 Files selected for processing (27)

• .github/workflows/runtime-bun.yml
• .github/workflows/runtime-deno.yml
• .github/workflows/runtime-workers.yml
• packages/auth0-api-js/package.json
• packages/auth0-api-js/src/api-client.spec.ts
• packages/auth0-api-js/src/dpop-api.scenarios.spec.ts
• packages/auth0-api-js/src/index.workers.spec.ts
• packages/auth0-api-js/src/test-utils/workers-polyfills.ts
• packages/auth0-api-js/vitest.config.ts
• packages/auth0-api-js/vitest.config.workers.ts
• packages/auth0-auth-js/package.json
• packages/auth0-auth-js/src/auth-client.spec.ts
• packages/auth0-auth-js/src/mfa/mfa-client.spec.ts
• packages/auth0-auth-js/src/passkey/passkey-client.spec.ts
• packages/auth0-auth-js/src/test-utils/workers-polyfills.ts
• packages/auth0-auth-js/vitest.config.ts
• packages/auth0-auth-js/vitest.config.workers.ts
• packages/auth0-server-js/package.json
• packages/auth0-server-js/src/mfa/server-mfa-client.spec.ts
• packages/auth0-server-js/src/server-client.spec.ts
• packages/auth0-server-js/src/test-utils/workers-polyfills.ts
• packages/auth0-server-js/vitest.config.ts
• packages/auth0-server-js/vitest.config.workers.ts
• packages/test-utils/package.json
• packages/test-utils/src/http.ts
• packages/test-utils/src/localstorage-polyfill.ts
• packages/test-utils/src/workers-polyfill.ts

💤 Files with no reviewable changes (1)

• packages/auth0-api-js/src/index.workers.spec.ts