descope
diff --git a/‎tests/management/test_outbound_application.py‎
Lines changed: 57 additions & 0 deletions b/‎tests/management/test_outbound_application.py‎
Lines changed: 57 additions & 0 deletions
diff --git a/‎tests/test_http_client.py‎
Lines changed: 33 additions & 0 deletions b/‎tests/test_http_client.py‎
Lines changed: 33 additions & 0 deletions
@@ -958,3 +958,60 @@ async def test_fetch_tenant_token_failure(self, client_factory):
                         "tenant789",
                     )
                 )
+
+
+class TestOutboundApplicationByTokenVerbose:
+    async def test_by_token_response_reaches_client_get_last_response(self, client_factory):
+        """The by-token client builds its own key-less HTTPClient.
+
+        It has to be handed the owning client's verbose flag and last-response store,
+        or its responses are invisible to DescopeClient.get_last_response().
+        """
+        client = client_factory.make(
+            PROJECT_ID,
+            PUBLIC_KEY_DICT,
+            False,
+            management_key="test-mgmt-key",
+            verbose=True,
+        )
+        if client_factory.mode == "async":
+            client._raw._license_attempted = True
+
+        response = make_response(TOKEN_RESPONSE)
+        response.headers = {"cf-ray": "by-token-ray"}
+
+        with client.mock_mgmt_by_token_post(response):
+            await client.invoke(
+                client.mgmt.outbound_application_by_token.fetch_token_by_scopes(
+                    DUMMY_TOKEN,
+                    "app123",
+                    "user456",
+                    ["read"],
+                )
+            )
+
+        last_resp = client.get_last_response()
+        assert last_resp is not None
+        assert last_resp.headers.get("cf-ray") == "by-token-ray"
+
+    async def test_by_token_not_captured_when_verbose_disabled(self, client_factory):
+        client = client_factory.make(
+            PROJECT_ID,
+            PUBLIC_KEY_DICT,
+            False,
+            management_key="test-mgmt-key",
+        )
+        if client_factory.mode == "async":
+            client._raw._license_attempted = True
+
+        with client.mock_mgmt_by_token_post(make_response(TOKEN_RESPONSE)):
+            await client.invoke(
+                client.mgmt.outbound_application_by_token.fetch_token_by_scopes(
+                    DUMMY_TOKEN,
+                    "app123",
+                    "user456",
+                    ["read"],
+                )
+            )
+
+        assert client.get_last_response() is None
@@ -64,6 +64,39 @@ def test_json_caching(self):
         # json() should only be called once on the underlying response
         assert mock_response.json.call_count == 1
 
+    def test_null_json_body_parses_once(self):
+        """A `null` body is a real cached value, not a miss to retry.
+
+        The old `if self._json_data is None` sentinel re-parsed on every access here,
+        which test_json_caching cannot catch because its body is a dict.
+        """
+        mock_response = Mock()
+        mock_response.json.return_value = None
+
+        resp = DescopeResponse(mock_response)
+
+        assert resp.json() is None
+        assert resp.json() is None
+        assert mock_response.json.call_count == 1
+
+    def test_is_json_does_not_reparse_non_json_body(self):
+        """is_json probes by parsing, so an unparseable body must not re-probe."""
+        body = "<html>502</html>"
+        mock_response = Mock()
+        mock_response.json.side_effect = json.JSONDecodeError("Expecting value", body, 0)
+        mock_response.text = body
+
+        resp = DescopeResponse(mock_response)
+
+        assert resp.is_json is False
+        assert resp.is_json is False
+        assert resp.is_json is False
+        assert mock_response.json.call_count == 1
+
+        # A failed parse is not cached, so json() itself still raises every time.
+        with self.assertRaises(json.JSONDecodeError):
+            resp.json()
+
     def test_dict_like_values_items(self):
         """Test that values() and items() work correctly."""
         mock_response = Mock()