Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
44 lines
1.3 KiB
JavaScript
44 lines
1.3 KiB
JavaScript
import axios from 'axios';
|
|
import Cookies from 'js-cookie';
|
|
import createAPIClient from './APIHelper';
|
|
|
|
describe('APIHelper browser session exchange', () => {
|
|
it('keeps the access token in memory across reload exchange and 401 refresh', async () => {
|
|
vi.spyOn(Cookies, 'get').mockImplementation(name =>
|
|
name === 'cw_d_session_state' ? '1' : undefined
|
|
);
|
|
const requests = [];
|
|
let protectedCalls = 0;
|
|
const client = createAPIClient(axios);
|
|
client.defaults.adapter = config => {
|
|
requests.push(config);
|
|
if (config.url === '/auth/validate_token') {
|
|
return Promise.resolve({
|
|
data: {},
|
|
status: 200,
|
|
statusText: 'OK',
|
|
headers: { 'access-token': 'short-lived', client: 'browser' },
|
|
config,
|
|
});
|
|
}
|
|
protectedCalls += 1;
|
|
if (protectedCalls === 1) {
|
|
return Promise.reject({ config, response: { status: 401 } });
|
|
}
|
|
return Promise.resolve({
|
|
data: {},
|
|
status: 200,
|
|
statusText: 'OK',
|
|
headers: {},
|
|
config,
|
|
});
|
|
};
|
|
|
|
await client.get('/auth/validate_token');
|
|
await client.get('/api/v1/protected');
|
|
|
|
expect(requests.at(-1).headers['access-token']).toBe('short-lived');
|
|
expect(localStorage.getItem('access-token')).toBeNull();
|
|
});
|
|
});
|