38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { SessionManager } from "../src/auth.js";
|
|
|
|
test("session manager expires and revokes opaque sessions", () => {
|
|
let now = Date.parse("2026-08-02T00:00:00.000Z");
|
|
const sessions = new SessionManager({
|
|
username: "operator",
|
|
password: "secret",
|
|
sessionTtlMs: 60_000,
|
|
cookieSecure: true
|
|
}, () => now);
|
|
|
|
assert.equal(sessions.credentialsMatch("operator", "secret"), true);
|
|
assert.equal(sessions.credentialsMatch("operator", "wrong"), false);
|
|
assert.equal(sessions.credentialsMatch("wrong", "secret"), false);
|
|
|
|
const created = sessions.create();
|
|
const cookie = sessions.sessionCookie(created.token);
|
|
assert.match(cookie, /^condon_session=[A-Za-z0-9_-]+;/);
|
|
assert.match(cookie, /HttpOnly/);
|
|
assert.match(cookie, /SameSite=Lax/);
|
|
assert.match(cookie, /Secure/);
|
|
assert.match(cookie, /Max-Age=60/);
|
|
assert.equal(cookie.includes("secret"), false);
|
|
|
|
const requestCookie = cookie.split(";", 1)[0];
|
|
assert.equal(sessions.get(requestCookie)?.username, "operator");
|
|
now += 60_001;
|
|
assert.equal(sessions.get(requestCookie), null);
|
|
|
|
const replacement = sessions.create();
|
|
const replacementCookie = sessions.sessionCookie(replacement.token).split(";", 1)[0];
|
|
sessions.revoke(replacementCookie);
|
|
assert.equal(sessions.get(replacementCookie), null);
|
|
assert.match(sessions.clearedCookie(), /Max-Age=0/);
|
|
});
|