63 lines
2.4 KiB
TypeScript
63 lines
2.4 KiB
TypeScript
|
/**
|
||
|
|
* csrfMiddleware 401-handling regression tests.
|
||
|
|
*
|
||
|
|
* Bug: clicking Logout (or landing on /login) flooded GET /api/session with 401s
|
||
|
|
* and the page hung instead of returning to the login screen.
|
||
|
|
*
|
||
|
|
* Root cause: the middleware redirected on EVERY 401, including the session
|
||
|
|
* probe's own 401. The redirect invalidated the ['session'] query, which
|
||
|
|
* refetched GET /api/session, which 401'd, which redirected again → an infinite
|
||
|
|
* refetch loop. These tests pin the fix: the session probe and the login
|
||
|
|
* endpoint own their 401s (no redirect); any other endpoint's 401 still
|
||
|
|
* redirects (session expired mid-use).
|
||
|
|
*
|
||
|
|
* We call onResponse() directly (rather than going through apiClient.GET) so the
|
||
|
|
* test exercises the exact 401 branch without the singleton's relative baseUrl,
|
||
|
|
* which has no absolute origin to resolve against under jsdom.
|
||
|
|
*/
|
||
|
|
|
||
|
|
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||
|
|
import type { Middleware } from 'openapi-fetch'
|
||
|
|
import { csrfMiddleware, registerLoginRedirect } from './client'
|
||
|
|
|
||
|
|
type OnResponse = NonNullable<Middleware['onResponse']>
|
||
|
|
type OnResponseParams = Parameters<OnResponse>[0]
|
||
|
|
|
||
|
|
/** Build the minimal onResponse params for the given schema path + response. */
|
||
|
|
function params(schemaPath: string, response: Response): OnResponseParams {
|
||
|
|
return { schemaPath, response, request: new Request('http://test.local' + schemaPath) } as OnResponseParams
|
||
|
|
}
|
||
|
|
|
||
|
|
function response401(): Response {
|
||
|
|
return new Response(JSON.stringify({ detail: 'unauthorized' }), {
|
||
|
|
status: 401,
|
||
|
|
headers: { 'Content-Type': 'application/json' },
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
const onResponse = csrfMiddleware.onResponse as OnResponse
|
||
|
|
|
||
|
|
describe('csrfMiddleware 401 redirect (session-flood regression)', () => {
|
||
|
|
const redirect = vi.fn()
|
||
|
|
|
||
|
|
beforeEach(() => {
|
||
|
|
redirect.mockReset()
|
||
|
|
registerLoginRedirect(redirect)
|
||
|
|
})
|
||
|
|
|
||
|
|
it('does NOT redirect when GET /api/session returns 401 (probe owns its 401)', async () => {
|
||
|
|
await onResponse(params('/api/session', response401()))
|
||
|
|
expect(redirect).not.toHaveBeenCalled()
|
||
|
|
})
|
||
|
|
|
||
|
|
it('does NOT redirect when POST /api/auth/login returns 401 (bad credentials)', async () => {
|
||
|
|
await onResponse(params('/api/auth/login', response401()))
|
||
|
|
expect(redirect).not.toHaveBeenCalled()
|
||
|
|
})
|
||
|
|
|
||
|
|
it('redirects when a normal endpoint returns 401 (session expired mid-use)', async () => {
|
||
|
|
await onResponse(params('/api/locations', response401()))
|
||
|
|
expect(redirect).toHaveBeenCalledTimes(1)
|
||
|
|
})
|
||
|
|
})
|