alisaza
e1eaf5eff5
Extract admin dashboard from ghabilee-frontend2 into a dedicated Next.js app for backoffice.ghabilee.ir (no SEO indexing / Clarity).
31 lines
1.2 KiB
TypeScript
31 lines
1.2 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import { CLEAR_REFRESH_SESSION_HEADER, REFRESH_TOKEN_COOKIE_DEV, REFRESH_TOKEN_COOKIE_HOST } from '@/lib/refreshSessionCookie'
|
|
|
|
import { POST } from './route'
|
|
|
|
describe('POST /api/auth/clear-session', () => {
|
|
it('rejects requests without the logout header', () => {
|
|
const response = POST(new Request('http://127.0.0.1/api/auth/clear-session', { method: 'POST' }))
|
|
|
|
expect(response.status).toBe(403)
|
|
expect(response.headers.getSetCookie()).toEqual([])
|
|
})
|
|
|
|
it('expires both Nest refresh cookie names when the header is present', () => {
|
|
const response = POST(
|
|
new Request('http://127.0.0.1/api/auth/clear-session', {
|
|
method: 'POST',
|
|
headers: { [CLEAR_REFRESH_SESSION_HEADER]: '1' },
|
|
})
|
|
)
|
|
const cookies = response.headers.getSetCookie()
|
|
|
|
expect(response.status).toBe(200)
|
|
expect(response.headers.get('Cache-Control')).toBe('no-store')
|
|
expect(cookies).toHaveLength(3)
|
|
expect(cookies.some((cookie) => cookie.startsWith(`${REFRESH_TOKEN_COOKIE_DEV}=`) && cookie.includes('Max-Age=0'))).toBe(true)
|
|
expect(cookies.some((cookie) => cookie.startsWith(`${REFRESH_TOKEN_COOKIE_HOST}=`) && cookie.includes('Secure'))).toBe(true)
|
|
})
|
|
})
|