80 lines
2.8 KiB
TypeScript
80 lines
2.8 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
DELETE as deleteSession,
|
|
GET as getSession,
|
|
POST as createSession,
|
|
} from "../auth/session/route";
|
|
|
|
describe("auth session API", () => {
|
|
const originalApiKey = process.env.API_ACCESS_KEY;
|
|
const originalAuthDisabled = process.env.API_AUTH_DISABLED;
|
|
|
|
beforeEach(() => {
|
|
process.env.API_ACCESS_KEY = "test-key";
|
|
process.env.API_AUTH_DISABLED = "false";
|
|
});
|
|
|
|
afterEach(() => {
|
|
process.env.API_ACCESS_KEY = originalApiKey;
|
|
process.env.API_AUTH_DISABLED = originalAuthDisabled;
|
|
});
|
|
|
|
it("creates an HttpOnly browser session after validating the access key", async () => {
|
|
const response = await createSession(request({ api_access_key: "test-key" }));
|
|
const body = (await response.json()) as { authenticated: boolean };
|
|
const setCookie = response.headers.get("set-cookie") ?? "";
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(body.authenticated).toBe(true);
|
|
expect(setCookie).toContain("geo_api_session=");
|
|
expect(setCookie).toContain("HttpOnly");
|
|
expect(setCookie).toMatch(/SameSite=Lax/i);
|
|
expect(setCookie).toContain("Path=/");
|
|
expect(setCookie).not.toContain("test-key");
|
|
});
|
|
|
|
it("rejects invalid access keys without setting a session cookie", async () => {
|
|
const response = await createSession(request({ api_access_key: "wrong" }));
|
|
|
|
expect(response.status).toBe(401);
|
|
expect(response.headers.get("set-cookie")).toBeNull();
|
|
});
|
|
|
|
it("reports the current browser session state", async () => {
|
|
const login = await createSession(request({ api_access_key: "test-key" }));
|
|
const cookie = login.headers.get("set-cookie")?.split(";")[0] ?? "";
|
|
|
|
const anonymous = await getSession(new Request("http://localhost/api/auth/session"));
|
|
const authenticated = await getSession(
|
|
new Request("http://localhost/api/auth/session", {
|
|
headers: { cookie },
|
|
}),
|
|
);
|
|
|
|
await expect(anonymous.json()).resolves.toEqual({ authenticated: false });
|
|
await expect(authenticated.json()).resolves.toEqual({ authenticated: true });
|
|
});
|
|
|
|
it("clears the browser session cookie", async () => {
|
|
const response = await deleteSession(
|
|
new Request("http://localhost/api/auth/session", { method: "DELETE" }),
|
|
);
|
|
const setCookie = response.headers.get("set-cookie") ?? "";
|
|
|
|
expect(response.status).toBe(200);
|
|
await expect(response.json()).resolves.toEqual({ authenticated: false });
|
|
expect(setCookie).toContain("geo_api_session=");
|
|
expect(setCookie).toContain("Max-Age=0");
|
|
expect(setCookie).toContain("HttpOnly");
|
|
});
|
|
});
|
|
|
|
function request(body: unknown) {
|
|
return new Request("http://localhost/api/auth/session", {
|
|
method: "POST",
|
|
headers: { "content-type": "application/json" },
|
|
body: JSON.stringify(body),
|
|
});
|
|
}
|