What causes "Invalid token" in ruvnet/ruflo?

Mint tokens in tests with await mock.generateToken(payload) and pass that to verifyToken

Invalid token

Error message

Invalid token

What it means

This mock auth service from the testing mock-factory only accepts tokens minted by its own generateToken(), which produces token: followed by base64-encoded JSON. verifyToken() throws Invalid token for anything else: real JWTs, opaque bearer tokens, or corrupted strings. The mock hash format (hashed: plus base64) and token format are paired by design.

Source

Thrown at v3/@claude-flow/testing/src/helpers/mock-factory.ts:549

    }
    return { valid: true };
  });

  mock.hashPassword.mockImplementation(async (password: string) => {
    return `hashed:${Buffer.from(password).toString('base64')}`;
  });

  mock.verifyPassword.mockImplementation(async (password: string, hash: string) => {
    return hash === `hashed:${Buffer.from(password).toString('base64')}`;
  });

  mock.generateToken.mockImplementation(async (payload: Record<string, unknown>) => {
    return `token:${Buffer.from(JSON.stringify(payload)).toString('base64')}`;
  });

  mock.verifyToken.mockImplementation(async (token: string) => {
    if (!token.startsWith('token:')) {
      throw new Error('Invalid token');
    }
    return JSON.parse(Buffer.from(token.slice(6), 'base64').toString());
  });

  mock.executeSecurely.mockImplementation(async () => ({
    stdout: '',
    stderr: '',
    exitCode: 0,
    duration: 100,
  }));

  return mock;
}

/**
 * Create mock swarm coordinator
 */
export function createMockSwarmCoordinator(): MockedInterface<ISwarmCoordinator> & { state: SwarmState } {

View on GitHub (pinned to fa13ee4ad6)

Solutions

Mint tokens in tests with await mock.generateToken(payload) and pass that to verifyToken
If an externally built token is required, construct it as token: plus base64 of JSON.stringify(payload)
Keep the mock generate/verify pair together; do not mix real auth clients with mock verification

Example fix

// before
const payload = await mock.verifyToken(realJwt); // throws: Invalid token

// after
const token = await mock.generateToken({ sub: 'user-1' });
const payload = await mock.verifyToken(token);

Defensive patterns

Strategy: validation

Validate before calling

function isMockToken(token: string): boolean {
  return token.startsWith('token:');
}

if (!isMockToken(token)) {
  token = await mock.generateToken({ sub: 'test-user' }); // mint a mock token
}
const payload = await mock.verifyToken(token);

Type guard

function isMockToken(token: string): token is string {
  return token.startsWith('token:') && token.length > 6;
}

Try / catch

try {
  payload = await mock.verifyToken(token);
} catch (err) {
  if (err instanceof Error && err.message === 'Invalid token') {
    const minted = await mock.generateToken(originalPayload);
    payload = await mock.verifyToken(minted);
  } else {
    throw err;
  }
}

Prevention

Always mint tokens through the mock in test setup instead of reusing env-based tokens
Centralize token creation in one test helper so no test hand-builds token strings
Treat prefix or format mismatches as config smells: never mix mock auth with real auth clients

When it happens

Trigger: Passing a real JWT or an environment-configured bearer token to mock.verifyToken(); hand-building token strings in tests with the wrong encoding; token truncation or corruption in transit.

Common situations: Pointing an app configured with production auth at the test mock without swapping token minting; copying token fixtures from another environment; base64 vs base64url mismatches.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/206e3a21cb2a18e0. Report an issue: GitHub.