fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-22 15:45:06 +08:00
parent e1557e7f21
commit f719529d66
81 changed files with 2149 additions and 474 deletions
@@ -0,0 +1,43 @@
+import axios from 'axios';
+import Cookies from 'js-cookie';
+import createAPIClient from './APIHelper';
+
+describe('APIHelper browser session exchange', () => {
+  it('keeps the access token in memory across reload exchange and 401 refresh', async () => {
+    vi.spyOn(Cookies, 'get').mockImplementation(name =>
+      name === 'cw_d_session_state' ? '1' : undefined
+    );
+    const requests = [];
+    let protectedCalls = 0;
+    const client = createAPIClient(axios);
+    client.defaults.adapter = config => {
+      requests.push(config);
+      if (config.url === '/auth/validate_token') {
+        return Promise.resolve({
+          data: {},
+          status: 200,
+          statusText: 'OK',
+          headers: { 'access-token': 'short-lived', client: 'browser' },
+          config,
+        });
+      }
+      protectedCalls += 1;
+      if (protectedCalls === 1) {
+        return Promise.reject({ config, response: { status: 401 } });
+      }
+      return Promise.resolve({
+        data: {},
+        status: 200,
+        statusText: 'OK',
+        headers: {},
+        config,
+      });
+    };
+
+    await client.get('/auth/validate_token');
+    await client.get('/api/v1/protected');
+
+    expect(requests.at(-1).headers['access-token']).toBe('short-lived');
+    expect(localStorage.getItem('access-token')).toBeNull();
+  });
+});