mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
33 lines
1.3 KiB
JavaScript
33 lines
1.3 KiB
JavaScript
import assert from "node:assert/strict"
|
|
import test from "node:test"
|
|
import { createSessionRequestGuard, isSameSession } from "./session-request-guard.ts"
|
|
|
|
const account = (id, accessToken) => ({ user: { id }, accessToken })
|
|
|
|
test("late profile success, error, and finally are stale after sign-out", () => {
|
|
let current = account(1, "test-session-a")
|
|
const guard = createSessionRequestGuard(() => current)
|
|
const isCurrent = guard.begin(current)
|
|
current = null
|
|
assert.equal(isCurrent(), false)
|
|
})
|
|
|
|
test("old account and rotated-token responses cannot clear the current session", () => {
|
|
const previous = account(1, "test-session-a")
|
|
assert.equal(isSameSession(previous, account(2, "test-session-b")), false)
|
|
assert.equal(isSameSession(previous, account(1, "test-session-rotated")), false)
|
|
assert.equal(isSameSession(null, account(1, "test-session-a")), false)
|
|
assert.equal(isSameSession(previous, previous), true)
|
|
})
|
|
|
|
test("only the latest profile request can commit, including same-token requests", () => {
|
|
const current = account(1, "test-session-a")
|
|
const guard = createSessionRequestGuard(() => current)
|
|
const first = guard.begin(current)
|
|
const second = guard.begin(current)
|
|
assert.equal(first(), false)
|
|
assert.equal(second(), true)
|
|
guard.invalidate()
|
|
assert.equal(second(), false)
|
|
})
|