Harden bridge state and reauthentication handling

tests/test_config_flow.py

@@ -2,11 +2,12 @@
 
 from unittest.mock import patch
 
-from homeassistant.config_entries import SOURCE_HASSIO, SOURCE_USER
+from homeassistant.config_entries import SOURCE_HASSIO, SOURCE_REAUTH, SOURCE_USER
 from homeassistant.const import CONF_HOST, CONF_PORT
 from homeassistant.core import HomeAssistant
 from homeassistant.data_entry_flow import FlowResultType
 from homeassistant.helpers.service_info.hassio import HassioServiceInfo
+from pytest_homeassistant_custom_component.common import MockConfigEntry
 
 from custom_components.mb_secure.api import BridgeAuthenticationError
 from custom_components.mb_secure.const import CONF_TOKEN, DOMAIN
@@ -146,3 +147,74 @@ async def test_hassio_discovery_rejects_incomplete_data(
 
     assert result["type"] is FlowResultType.ABORT
     assert result["reason"] == "invalid_discovery"
+
+
+async def test_reauth_updates_token_for_same_bridge(hass: HomeAssistant) -> None:
+    """A replacement token is accepted only for the configured bridge."""
+    entry = MockConfigEntry(
+        domain=DOMAIN,
+        data=USER_INPUT,
+        unique_id="bridge-installation-1",
+    )
+    entry.add_to_hass(hass)
+    result = await hass.config_entries.flow.async_init(
+        DOMAIN,
+        context={"source": SOURCE_REAUTH, "entry_id": entry.entry_id},
+        data=entry.data,
+    )
+    info = BridgeInfo(
+        bridge_id="bridge-installation-1",
+        bridge_version="0.1.0",
+        api_version=1,
+        connected=True,
+        capabilities=frozenset(),
+    )
+    new_token = "y" * 32
+
+    with patch(
+        "custom_components.mb_secure.api.BridgeClient.async_get_info",
+        return_value=info,
+    ):
+        result = await hass.config_entries.flow.async_configure(
+            result["flow_id"], {CONF_TOKEN: new_token}
+        )
+
+    assert result["type"] is FlowResultType.ABORT
+    assert result["reason"] == "reauth_successful"
+    assert entry.data[CONF_TOKEN] == new_token
+
+
+async def test_reauth_rejects_token_for_different_bridge(
+    hass: HomeAssistant,
+) -> None:
+    """A valid token from another installation cannot replace the token."""
+    entry = MockConfigEntry(
+        domain=DOMAIN,
+        data=USER_INPUT,
+        unique_id="bridge-installation-1",
+    )
+    entry.add_to_hass(hass)
+    result = await hass.config_entries.flow.async_init(
+        DOMAIN,
+        context={"source": SOURCE_REAUTH, "entry_id": entry.entry_id},
+        data=entry.data,
+    )
+    info = BridgeInfo(
+        bridge_id="bridge-installation-2",
+        bridge_version="0.1.0",
+        api_version=1,
+        connected=True,
+        capabilities=frozenset(),
+    )
+
+    with patch(
+        "custom_components.mb_secure.api.BridgeClient.async_get_info",
+        return_value=info,
+    ):
+        result = await hass.config_entries.flow.async_configure(
+            result["flow_id"], {CONF_TOKEN: "y" * 32}
+        )
+
+    assert result["type"] is FlowResultType.ABORT
+    assert result["reason"] == "wrong_account"
+    assert entry.data[CONF_TOKEN] == USER_INPUT[CONF_TOKEN]