38 lines
1.6 KiB
TypeScript
38 lines
1.6 KiB
TypeScript
import { afterEach, expect, test, vi } from 'vitest';
|
|
import { canAdminister, canOperate, clearAccessToken, getAccessToken, notifyUnauthorizedSession, PLATFORM_UNAUTHORIZED_EVENT, setAccessToken } from './session';
|
|
|
|
afterEach(() => {
|
|
window.sessionStorage.clear();
|
|
window.localStorage.clear();
|
|
});
|
|
|
|
test('access token is scoped to the browser session and can be cleared', () => {
|
|
setAccessToken(' secret-token ');
|
|
expect(getAccessToken()).toBe('secret-token');
|
|
expect(window.localStorage.length).toBe(0);
|
|
clearAccessToken();
|
|
expect(getAccessToken()).toBe('');
|
|
});
|
|
|
|
test('role helpers follow the server permission hierarchy', () => {
|
|
expect(canOperate({ name: 'v', role: 'viewer', authMode: 'enforce' })).toBe(false);
|
|
expect(canOperate({ name: 'o', role: 'operator', authMode: 'enforce' })).toBe(true);
|
|
expect(canAdminister({ name: 'o', role: 'operator', authMode: 'enforce' })).toBe(false);
|
|
expect(canAdminister({ name: 'a', role: 'admin', authMode: 'enforce' })).toBe(true);
|
|
});
|
|
|
|
test('invalidates only the currently active rejected token', () => {
|
|
const unauthorized = vi.fn();
|
|
window.addEventListener(PLATFORM_UNAUTHORIZED_EVENT, unauthorized);
|
|
setAccessToken('new-token');
|
|
|
|
expect(notifyUnauthorizedSession('old-token')).toBe(false);
|
|
expect(getAccessToken()).toBe('new-token');
|
|
expect(notifyUnauthorizedSession('new-token')).toBe(true);
|
|
expect(getAccessToken()).toBe('');
|
|
expect(notifyUnauthorizedSession('new-token')).toBe(false);
|
|
expect(unauthorized).toHaveBeenCalledTimes(1);
|
|
|
|
window.removeEventListener(PLATFORM_UNAUTHORIZED_EVENT, unauthorized);
|
|
});
|