@aiquants/auth-react-router 0.6.0 → 0.7.3

package/src/server/session.spec.ts

@@ -1,165 +0,0 @@
-/**
- * Tests for the session storage factory (cookie shape, backdoor port, guards).
- * セッションストレージファクトリのテスト (cookie 形状・バックドアポート・ガード)。
- */
-import type { SessionProfile } from "@aiquants/auth-core"
-import { describe, expect, it } from "vitest"
-import type { MockUserPort } from "./ports"
-import { createAuthSessionStorage } from "./session"
-
-const SECRET = "test-secret"
-
-const profile: SessionProfile = {
-    id: "107791905418691074770",
-    displayName: "宏治",
-    name: { familyName: "Mock", givenName: "User" },
-    emails: [{ value: "mock@example.com" }],
-    accessToken: "at",
-    refreshToken: "rt",
-    expirationDateMs: 1750000000000,
-    provider: "google",
-}
-
-const request = (cookie?: string) => new Request("http://localhost/", cookie ? { headers: { Cookie: cookie } } : undefined)
-
-describe("createAuthSessionStorage", () => {
-    it("throws when secrets are missing (fail-closed)", () => {
-        expect(() => createAuthSessionStorage({ secrets: [] })).toThrow("REMIX_SESSION_SECRET must be set")
-        expect(() => createAuthSessionStorage({ secrets: [""] })).toThrow("REMIX_SESSION_SECRET must be set")
-    })
-
-    it("commits a byte-compatible __session cookie (httpOnly/lax/30d)", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        const cookie = await storage.saveSession(request(), profile)
-
-        expect(cookie.startsWith("__session=")).toBe(true)
-        expect(cookie).toContain("HttpOnly")
-        expect(cookie).toContain("SameSite=Lax")
-        expect(cookie).toContain(`Max-Age=${60 * 60 * 24 * 30}`)
-        expect(cookie).toContain("Path=/")
-    })
-
-    it("roundtrips the session user under the 'user' key without extra fields", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        const cookie = await storage.saveSession(request(), profile)
-        const user = await storage.getSessionUser(request(cookie))
-
-        expect(user).toEqual(profile)
-        // photo/_json/photos を含まない byte 互換形状
-        expect(user && "photo" in user).toBe(false)
-    })
-
-    it("returns undefined without a session cookie", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        expect(await storage.getSessionUser(request())).toBeUndefined()
-    })
-
-    it("uses the injected mockUser port when enabled", async () => {
-        const mockUser: MockUserPort = {
-            enabled: (req) => req.headers.get("Cookie")?.includes("mock_user=true") ?? false,
-            resolve: () => ({ ...profile, displayName: "太郎" }),
-        }
-        const storage = createAuthSessionStorage({ secrets: [SECRET] }, { mockUser })
-
-        const mocked = await storage.getSessionUser(request("mock_user=true"))
-        expect(mocked?.displayName).toBe("太郎")
-        // バックドア条件を満たさないリクエストは通常経路 (cookie 無し → undefined)
-        expect(await storage.getSessionUser(request())).toBeUndefined()
-    })
-
-    it("is backdoor-disabled by default (no port injected)", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        expect(await storage.getSessionUser(request("mock_user=true; mock_user_id=8"))).toBeUndefined()
-    })
-
-    it("requireUser redirects to the login path when unauthenticated", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        try {
-            await storage.requireUser(request())
-            expect.unreachable("should have thrown a redirect")
-        } catch (error) {
-            expect(error).toBeInstanceOf(Response)
-            expect((error as Response).headers.get("Location")).toBe("/auth/login")
-        }
-    })
-
-    it("requireAdminUser redirects non-admin users to the root", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        const cookie = await storage.saveSession(request(), profile)
-        try {
-            await storage.requireAdminUser(request(cookie))
-            expect.unreachable("should have thrown a redirect")
-        } catch (error) {
-            expect(error).toBeInstanceOf(Response)
-            expect((error as Response).headers.get("Location")).toBe("/")
-        }
-    })
-
-    it("requireAdminUser passes admin users through", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        const cookie = await storage.saveSession(request(), { ...profile, role: "admin" })
-        const user = await storage.requireAdminUser(request(cookie))
-        expect(user.role).toBe("admin")
-    })
-
-    it("logout destroys the session cookie", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        const cookie = await storage.saveSession(request(), profile)
-        const destroyed = await storage.logout(request(cookie))
-        // 破棄 cookie は即時失効する
-        expect(destroyed).toContain("__session=")
-        expect(destroyed).toContain("Expires=Thu, 01 Jan 1970")
-    })
-})
-
-/**
- * 無効化済みアカウントの即時失効。
- * `getSessionUser` は `requireUser` と `authenticateInLoader` の双方が通る唯一の絞り込み点であり、
- * ここで弾くことで既存セッション Cookie を持っていても全ルートで未認証扱いになる。
- */
-describe("createAuthSessionStorage — isUserActive による無効化の即時反映", () => {
-    const profile = { id: "sub-1", displayName: "U", name: { familyName: "U", givenName: "U" }, emails: [{ value: "u@example.com" }] } as never
-
-    /** セッション Cookie を持つリクエストを組み立てる。 */
-    const requestWithSession = async (storage: ReturnType<typeof createAuthSessionStorage>) => {
-        const cookie = await storage.saveSession(new Request("http://x/"), profile)
-        return new Request("http://x/", { headers: { Cookie: cookie.split(";")[0] } })
-    }
-
-    it("有効なアカウントはこれまでどおりセッションから解決される", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] }, { isUserActive: () => true })
-        expect(await storage.getSessionUser(await requestWithSession(storage))).toMatchObject({ id: "sub-1" })
-    })
-
-    it("無効化済みアカウントは有効な Cookie を持っていても未認証として扱われる", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] }, { isUserActive: () => false })
-        expect(await storage.getSessionUser(await requestWithSession(storage))).toBeUndefined()
-    })
-
-    it("無効化済みなら requireUser はログインへリダイレクトする", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] }, { isUserActive: async () => false })
-        const request = await requestWithSession(storage)
-        await expect(storage.requireUser(request)).rejects.toBeInstanceOf(Response)
-    })
-
-    it("ポート未指定なら従来どおり (既存構成の挙動を変えない)", async () => {
-        const storage = createAuthSessionStorage({ secrets: [SECRET] })
-        expect(await storage.getSessionUser(await requestWithSession(storage))).toMatchObject({ id: "sub-1" })
-    })
-
-    it("ポートには解決したプロファイルが渡される", async () => {
-        const seen: unknown[] = []
-        const storage = createAuthSessionStorage(
-            { secrets: [SECRET] },
-            {
-                isUserActive: (p) => {
-                    seen.push(p)
-                    return true
-                },
-            },
-        )
-        await storage.getSessionUser(await requestWithSession(storage))
-        expect(seen).toHaveLength(1)
-        expect(seen[0]).toMatchObject({ id: "sub-1" })
-    })
-})