test(auth): add functional test for jwtaccess cache segregation

[westarle]

Add cache segregation test to functionally verify JWTAccess isolates token caches correctly by scopes and URLs.

[gemini-code-assist]

Code Review

This pull request adds a new test case to verify cache isolation by scopes and URLs when retrieving request headers. However, the test contains several critical issues that will cause it to fail at runtime, including missing await keywords for asynchronous calls, incorrect usage of .get() on a plain object, and a typo in the test URLs. A code suggestion has been provided to resolve these issues.

[gemini-code-assist]

There are multiple critical issues in this test that will cause it to fail at runtime:

1. Missing await: getRequestHeaders is an asynchronous method returning a Promise<Headers>. It must be awaited to resolve the headers.
2. Invalid .get() call: The returned Headers is a plain object ({[key: string]: string}), not a Map or a Headers class instance. Calling .get('authorization') will throw a TypeError. Instead, access the Authorization property directly.
3. URL Typo: The test URLs are missing a slash (http:/ instead of http://).

    const testUri1 = 'http://example.com/service1';
    const testUri2 = 'http://example.com/service2';

    // 1. Different scopes for the same URL should return different tokens
    const headersScope1 = await client.getRequestHeaders(testUri1, undefined, 'scope1');
    const tokenScope1 = headersScope1.Authorization;
    assert(tokenScope1);

    const headersScope2 = await client.getRequestHeaders(testUri1, undefined, 'scope2');
    const tokenScope2 = headersScope2.Authorization;
    assert(tokenScope2);
    assert.notStrictEqual(tokenScope1, tokenScope2);

    // 2. Different URLs (without scopes) should return different tokens (different audience)
    const headersUrl1 = await client.getRequestHeaders(testUri1);
    const tokenUrl1 = headersUrl1.Authorization;
    assert(tokenUrl1);

    const headersUrl2 = await client.getRequestHeaders(testUri2);
    const tokenUrl2 = headersUrl2.Authorization;
    assert(tokenUrl2);
    assert.notStrictEqual(tokenUrl1, tokenUrl2);

    // 3. Verify cache hit works for the exact same parameters
    const headersScope1Cached = await client.getRequestHeaders(testUri1, undefined, 'scope1');
    const tokenScope1Cached = headersScope1Cached.Authorization;
    assert.strictEqual(tokenScope1, tokenScope1Cached);

[pearigee]

1. It looks like there are multiple getRequestHeaders methods that are Promises . . . but the JWTAccess one is not. The test looks correct.

https://github.com/search?q=repo%3Agoogleapis%2Fgoogle-cloud-node+path%3A%2F%5Ecore%5C%2Fpackages%5C%2Fgoogle-auth-library-nodejs%5C%2F%2F+getRequestHeaders&type=code

2. Again, I think Gemini is wrong here. The data returned is a Headers object, which does have a get method:

   google-cloud-node/core/packages/google-auth-library-nodejs/src/auth/jwtaccess.ts

   Line 162 in 550635c

   const headers = new Headers({authorization: `Bearer ${signedJWT}`});

3. This is fair, but clearly a nit.