alisaza
e1eaf5eff5
Extract admin dashboard from ghabilee-frontend2 into a dedicated Next.js app for backoffice.ghabilee.ir (no SEO indexing / Clarity).
38 lines
1.6 KiB
TypeScript
38 lines
1.6 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import {
|
|
expiredRefreshSessionSetCookieHeaders,
|
|
hasRefreshSessionCookie,
|
|
REFRESH_TOKEN_COOKIE_DEV,
|
|
REFRESH_TOKEN_COOKIE_HOST,
|
|
} from '@/lib/refreshSessionCookie'
|
|
|
|
describe('hasRefreshSessionCookie', () => {
|
|
it('detects the production __Host- cookie name', () => {
|
|
expect(hasRefreshSessionCookie((name) => (name === REFRESH_TOKEN_COOKIE_HOST ? { value: 'secret' } : undefined))).toBe(true)
|
|
})
|
|
|
|
it('detects the local HTTP cookie name', () => {
|
|
expect(hasRefreshSessionCookie((name) => (name === REFRESH_TOKEN_COOKIE_DEV ? { value: 'secret' } : undefined))).toBe(true)
|
|
})
|
|
|
|
it('ignores the legacy JS-readable refreshToken name', () => {
|
|
expect(hasRefreshSessionCookie((name) => (name === 'refreshToken' ? { value: 'secret' } : undefined))).toBe(false)
|
|
})
|
|
})
|
|
|
|
describe('expiredRefreshSessionSetCookieHeaders', () => {
|
|
it('expires both Nest names with HttpOnly Path=/ and Max-Age=0', () => {
|
|
const headers = expiredRefreshSessionSetCookieHeaders()
|
|
const hostHeader = headers.find((header) => header.startsWith(`${REFRESH_TOKEN_COOKIE_HOST}=`))
|
|
const insecureDev = headers.find((header) => header.startsWith(`${REFRESH_TOKEN_COOKIE_DEV}=`) && !header.includes('Secure'))
|
|
const secureDev = headers.find((header) => header.startsWith(`${REFRESH_TOKEN_COOKIE_DEV}=`) && header.includes('Secure'))
|
|
|
|
expect(insecureDev).toContain('HttpOnly')
|
|
expect(secureDev).toContain('HttpOnly')
|
|
expect(hostHeader).toContain('Secure')
|
|
expect(hostHeader).toContain('HttpOnly')
|
|
expect(headers.every((header) => header.includes('Path=/') && header.includes('Max-Age=0'))).toBe(true)
|
|
})
|
|
})
|