新增案例库浏览器登录态

src/app/api/__tests__/auth-session.test.ts

@@ -0,0 +1,79 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import {
+  DELETE as deleteSession,
+  GET as getSession,
+  POST as createSession,
+} from "../auth/session/route";
+
+describe("auth session API", () => {
+  const originalApiKey = process.env.API_ACCESS_KEY;
+  const originalAuthDisabled = process.env.API_AUTH_DISABLED;
+
+  beforeEach(() => {
+    process.env.API_ACCESS_KEY = "test-key";
+    process.env.API_AUTH_DISABLED = "false";
+  });
+
+  afterEach(() => {
+    process.env.API_ACCESS_KEY = originalApiKey;
+    process.env.API_AUTH_DISABLED = originalAuthDisabled;
+  });
+
+  it("creates an HttpOnly browser session after validating the access key", async () => {
+    const response = await createSession(request({ api_access_key: "test-key" }));
+    const body = (await response.json()) as { authenticated: boolean };
+    const setCookie = response.headers.get("set-cookie") ?? "";
+
+    expect(response.status).toBe(200);
+    expect(body.authenticated).toBe(true);
+    expect(setCookie).toContain("geo_api_session=");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toMatch(/SameSite=Lax/i);
+    expect(setCookie).toContain("Path=/");
+    expect(setCookie).not.toContain("test-key");
+  });
+
+  it("rejects invalid access keys without setting a session cookie", async () => {
+    const response = await createSession(request({ api_access_key: "wrong" }));
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get("set-cookie")).toBeNull();
+  });
+
+  it("reports the current browser session state", async () => {
+    const login = await createSession(request({ api_access_key: "test-key" }));
+    const cookie = login.headers.get("set-cookie")?.split(";")[0] ?? "";
+
+    const anonymous = await getSession(new Request("http://localhost/api/auth/session"));
+    const authenticated = await getSession(
+      new Request("http://localhost/api/auth/session", {
+        headers: { cookie },
+      }),
+    );
+
+    await expect(anonymous.json()).resolves.toEqual({ authenticated: false });
+    await expect(authenticated.json()).resolves.toEqual({ authenticated: true });
+  });
+
+  it("clears the browser session cookie", async () => {
+    const response = await deleteSession(
+      new Request("http://localhost/api/auth/session", { method: "DELETE" }),
+    );
+    const setCookie = response.headers.get("set-cookie") ?? "";
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ authenticated: false });
+    expect(setCookie).toContain("geo_api_session=");
+    expect(setCookie).toContain("Max-Age=0");
+    expect(setCookie).toContain("HttpOnly");
+  });
+});
+
+function request(body: unknown) {
+  return new Request("http://localhost/api/auth/session", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}