@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/aurabase/tests/rt-alias-public-e2e.test.ts

@@ -1,235 +0,0 @@
-// ---------------------------------------------------------------------------
-// E2E réel (stack live) — Lot realtime / correctif `rt-alias-public-rls`.
-// Réf. : docs/superpowers/specs/2026-07-13-rt-alias-public-rls-design.md
-//
-// PROUVE la correction du bug backend : un client abonné via l'ALIAS PUBLIC
-// `db:public.{table}` (le canal auquel s'abonnent réellement Studio et le SDK)
-// reçoit bien les events postgres_changes.
-//
-// AVANT le fix : le CDC ne collectait `allowed_sub_ids` que sur le canal
-// GÉNÉRIQUE (schéma physique `project_<uuid>`) ; un abonné via l'alias public
-// n'y figurait jamais → branche fail-closed déclenchée MÊME SANS policy RLS →
-// 0 INSERT/UPDATE reçu. C'est d'ailleurs pourquoi le test frère
-// `realtime-filter-e2e.test.ts` s'abonne, lui, au canal générique pour
-// contourner ce bug (cf. son commentaire l.142-147).
-//
-// APRÈS le fix (cdc/postgres.rs → get_subscribers_for_channels sur les 3
-// formes) : l'abonné via l'alias public est inclus dans le calcul RLS et reçoit
-// les events autorisés. Ce test s'abonne DONC volontairement à `db:public.*`.
-//
-// Mécanisme d'activation realtime + auth WS : identiques au test frère
-// (PUT /v1/db/{project}/schema/tables/{table}/realtime, JWT via signUp/signIn).
-// Gaté par RUN_E2E + credentials ; skip gracieux sur infra transitoire.
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { createClient, createAdminClient } from '../src/index'
-import type { AuraResponse, RealtimeEvent, RealtimeSubscribeStatus } from '../src/index'
-
-const URL = process.env.AURA_E2E_URL
-const PROJECT = process.env.AURA_E2E_PROJECT
-const ANON = process.env.AURA_E2E_ANON_KEY
-const SERVICE = process.env.AURA_E2E_SERVICE_KEY
-const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
-
-const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
-
-async function retryTransient<T>(fn: () => Promise<AuraResponse<T>>): Promise<AuraResponse<T>> {
-  let res = await fn()
-  for (let i = 0; i < 10 && res.error && TRANSIENT_STATUS.has(res.error.status); i++) {
-    await new Promise((r) => setTimeout(r, 1000))
-    res = await fn()
-  }
-  return res
-}
-
-async function retryFetchTransient(fn: () => Promise<Response>): Promise<Response> {
-  let res = await fn()
-  for (let i = 0; i < 10 && TRANSIENT_STATUS.has(res.status); i++) {
-    await new Promise((r) => setTimeout(r, 1000))
-    res = await fn()
-  }
-  return res
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((r) => setTimeout(r, ms))
-}
-
-type CdcRecord = Record<string, unknown>
-interface CdcPayload {
-  schema: string
-  table: string
-  type: 'INSERT' | 'UPDATE' | 'DELETE'
-  record: CdcRecord
-  old_record: CdcRecord | null
-}
-
-function waitForSubscribeStatus(
-  doSubscribe: (cb: (status: RealtimeSubscribeStatus, err?: Error) => void) => void,
-  timeoutMs: number,
-): Promise<{ status: RealtimeSubscribeStatus; err?: Error } | 'timeout'> {
-  return new Promise((resolve) => {
-    let done = false
-    const timer = setTimeout(() => {
-      if (!done) {
-        done = true
-        resolve('timeout')
-      }
-    }, timeoutMs)
-    doSubscribe((status, err) => {
-      if (done) return
-      done = true
-      clearTimeout(timer)
-      resolve({ status, err })
-    })
-  })
-}
-
-describe.runIf(RUN)('realtime alias public E2E réel — un abonné à db:public.{table} reçoit les events', () => {
-  it(
-    "l'alias public db:public.{table} délivre bien l'INSERT (régression du bug allowed_sub_ids)",
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const anon = createClient(URL!, PROJECT!, ANON!)
-      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
-      const table = `rt_pub_${suffix}`
-      // On s'abonne à l'ALIAS PUBLIC (et NON au canal générique physique) :
-      // c'est précisément le chemin qui donnait 0 event avant le correctif.
-      const channelName = `db:public.${table}`
-      const email = `rt-alias-public-e2e-${suffix}@aurabase.dev`
-      const password = 'EndUserPassword123!'
-
-      let tableCreated = false
-      let userId: string | null = null
-
-      try {
-        // -- 1. Setup service_role : table jetable + GRANT + reload PostgREST ----
-        await admin.db.sql(`DROP TABLE IF EXISTS ${table}`)
-        const createRes = await admin.db.sql(
-          `CREATE TABLE ${table} (
-             id serial PRIMARY KEY,
-             body text NOT NULL DEFAULT ''
-           )`,
-        )
-        if (createRes.error) {
-          // eslint-disable-next-line no-console
-          console.warn(
-            `[rt-alias-public-e2e] SKIP (infra: CREATE TABLE a échoué — ${createRes.error.status} ` +
-              `${createRes.error.message ?? ''}).`,
-          )
-          return
-        }
-        tableCreated = true
-        await admin.db.sql(`GRANT ALL ON ${table} TO PUBLIC`)
-        await admin.db.sql(`SELECT pg_notify('pgrst', 'reload schema')`)
-
-        // -- 2. Activer le realtime CDC pour cette table (service_role) ---------
-        //     (aucune policy RLS n'est créée : le bug se déclenchait MÊME sans RLS)
-        const enableRes = await retryFetchTransient(() =>
-          fetch(`${admin.baseUrl}/v1/db/${admin.projectId}/schema/tables/${table}/realtime`, {
-            method: 'PUT',
-            headers: { apikey: SERVICE!, 'content-type': 'application/json' },
-            body: JSON.stringify({ enabled: true }),
-          }),
-        )
-        if (!enableRes.ok) {
-          // eslint-disable-next-line no-console
-          console.warn(
-            `[rt-alias-public-e2e] SKIP (infra: PUT .../schema/tables/${table}/realtime → ` +
-              `${enableRes.status}).`,
-          )
-          return
-        }
-
-        // -- 3. Utilisateur jetable (anon key) — le WS exige un vrai JWT --------
-        const signUpRes = await retryTransient(() => anon.auth.signUp({ email, password }))
-        if (signUpRes.error && TRANSIENT_STATUS.has(signUpRes.error.status)) {
-          // eslint-disable-next-line no-console
-          console.warn(`[rt-alias-public-e2e] SKIP (infra: signUp — ${signUpRes.error.status}).`)
-          return
-        }
-        expect(signUpRes.error).toBeNull()
-
-        const loginRes = await retryTransient(() => anon.auth.signInWithPassword({ email, password }))
-        if (loginRes.error && TRANSIENT_STATUS.has(loginRes.error.status)) {
-          // eslint-disable-next-line no-console
-          console.warn(`[rt-alias-public-e2e] SKIP (infra: signIn — ${loginRes.error.status}).`)
-          return
-        }
-        expect(loginRes.error).toBeNull()
-        const loginData = loginRes.data as { user: { id: string } } | null
-        userId = loginData?.user.id ?? null
-
-        // -- 4. Laisser le filtre CDC se rafraîchir (add-tables, ~3s) -----------
-        await sleep(4000)
-
-        // -- 5. Connexion WS + abonnement à l'ALIAS PUBLIC ----------------------
-        anon.realtime.connect()
-        const received: RealtimeEvent<CdcPayload>[] = []
-        const channel = anon.channel(channelName)
-        channel.on(
-          'postgres_changes',
-          // `schema` omis (le payload porte le schéma physique) — on isole la
-          // livraison via l'alias public, table filtrée par nom.
-          { event: '*', table },
-          (payload) => received.push(payload as RealtimeEvent<CdcPayload>),
-        )
-
-        const result = await waitForSubscribeStatus((cb) => channel.subscribe(cb), 15_000)
-        if (result === 'timeout' || result.status !== 'SUBSCRIBED') {
-          // eslint-disable-next-line no-console
-          console.warn(
-            `[rt-alias-public-e2e] SKIP (WS/CDC pas prêt — ` +
-              `${result === 'timeout' ? 'timeout SUBSCRIBED' : `statut ${result.status}`}).`,
-          )
-          return
-        }
-
-        // -- 6. INSERT une ligne via service_role -------------------------------
-        const marker = `hello-${suffix}`
-        const ins = await admin.db.sql(`INSERT INTO ${table} (body) VALUES ($1)`, [marker])
-        expect(ins.error).toBeNull()
-
-        // -- 7. Fenêtre de collecte CDC (poll WAL + pub/sub) --------------------
-        await sleep(8_000)
-
-        // -- 8. ASSERTION : l'event a bien été livré via l'alias public ---------
-        const gotInsert = received.some(
-          (e) => e.payload?.type === 'INSERT' && e.payload?.record?.body === marker,
-        )
-        expect(
-          gotInsert,
-          `aucun INSERT reçu via l'alias public ${channelName} — le bug allowed_sub_ids n'est PAS corrigé ` +
-            `(events reçus: ${received.length})`,
-        ).toBe(true)
-      } finally {
-        try {
-          anon.realtime.removeAllChannels()
-        } catch {
-          /* best-effort */
-        }
-        try {
-          anon.realtime.disconnect()
-        } catch {
-          /* best-effort */
-        }
-        if (userId) {
-          try {
-            await admin.authAdmin.deleteUser(userId)
-          } catch {
-            /* best-effort */
-          }
-        }
-        if (tableCreated) {
-          try {
-            await admin.db.sql(`DROP TABLE IF EXISTS ${table}`)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    120_000,
-  )
-})

package/packages/aurabase/tests/rt-http-broadcast-e2e.test.ts

@@ -1,124 +0,0 @@
-// ---------------------------------------------------------------------------
-// E2E réel (stack live) — Lot sdk-realtime / correctif `rt-http-broadcast`.
-// Réf. : docs/superpowers/specs/2026-07-13-rt-http-broadcast-design.md
-//
-// PROUVE que `realtime.httpBroadcast(channel, event, payload)` (envoi REST hors
-// WebSocket, POST /v1/realtime/{project}/broadcast) est bien distribué à un
-// abonné connecté en WebSocket sur le même canal broadcast. Valide le contrat
-// backend { channel (préfixé projet), payload:{ event, ... } } de bout en bout.
-//
-// Gaté par RUN_E2E + credentials ; skip gracieux sur infra transitoire.
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { createClient } from '../src/index'
-import type { RealtimeSubscribeStatus } from '../src/index'
-
-const URL = process.env.AURA_E2E_URL
-const PROJECT = process.env.AURA_E2E_PROJECT
-const ANON = process.env.AURA_E2E_ANON_KEY
-const SERVICE = process.env.AURA_E2E_SERVICE_KEY
-const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
-
-const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
-const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms))
-
-function waitForSubscribeStatus(
-  doSubscribe: (cb: (status: RealtimeSubscribeStatus, err?: Error) => void) => void,
-  timeoutMs: number,
-): Promise<{ status: RealtimeSubscribeStatus } | 'timeout'> {
-  return new Promise((resolve) => {
-    let done = false
-    const timer = setTimeout(() => {
-      if (!done) {
-        done = true
-        resolve('timeout')
-      }
-    }, timeoutMs)
-    doSubscribe((status) => {
-      if (done) return
-      done = true
-      clearTimeout(timer)
-      resolve({ status })
-    })
-  })
-}
-
-describe.runIf(RUN)('realtime httpBroadcast E2E réel — REST → WebSocket', () => {
-  it(
-    'un broadcast émis via httpBroadcast (REST) est livré à un abonné WebSocket du même canal',
-    async () => {
-      const anon = createClient(URL!, PROJECT!, ANON!)
-      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
-      const channelName = `httpbcast-${suffix}`
-      const evt = 'ping'
-      const marker = `hello-${suffix}`
-      const email = `rt-httpbcast-e2e-${suffix}@aurabase.dev`
-      const password = 'EndUserPassword123!'
-
-      let userId: string | null = null
-      const received: unknown[] = []
-
-      try {
-        // Le WS exige un vrai JWT → utilisateur jetable via la clé anon.
-        const signUp = await anon.auth.signUp({ email, password })
-        if (signUp.error && TRANSIENT_STATUS.has(signUp.error.status)) {
-          console.warn(`[rt-http-broadcast-e2e] SKIP (signUp ${signUp.error.status}).`)
-          return
-        }
-        const login = await anon.auth.signInWithPassword({ email, password })
-        if (login.error && TRANSIENT_STATUS.has(login.error.status)) {
-          console.warn(`[rt-http-broadcast-e2e] SKIP (signIn ${login.error.status}).`)
-          return
-        }
-        expect(login.error).toBeNull()
-        userId = (login.data as { user?: { id: string } } | null)?.user?.id ?? null
-
-        anon.realtime.connect()
-        const channel = anon.channel(channelName)
-        channel.on('broadcast', { event: evt }, (payload) => received.push(payload))
-
-        const res = await waitForSubscribeStatus((cb) => channel.subscribe(cb), 15_000)
-        if (res === 'timeout' || res.status !== 'SUBSCRIBED') {
-          console.warn(
-            `[rt-http-broadcast-e2e] SKIP (WS pas prêt — ${res === 'timeout' ? 'timeout' : res.status}).`,
-          )
-          return
-        }
-
-        // Émission REST (hors WS) — le cœur du correctif.
-        const bcast = await anon.realtime.httpBroadcast(channelName, evt, { msg: marker })
-        if (bcast.error && TRANSIENT_STATUS.has(bcast.error.status)) {
-          console.warn(`[rt-http-broadcast-e2e] SKIP (httpBroadcast ${bcast.error.status}).`)
-          return
-        }
-        expect(bcast.error, `httpBroadcast a échoué: ${JSON.stringify(bcast.error)}`).toBeNull()
-
-        // Fenêtre de livraison WS.
-        await sleep(6_000)
-
-        const got = received.some((r) => JSON.stringify(r).includes(marker))
-        expect(
-          got,
-          `le broadcast REST n'a pas été livré à l'abonné WS (reçus: ${JSON.stringify(received)})`,
-        ).toBe(true)
-      } finally {
-        try {
-          anon.realtime.removeAllChannels()
-          anon.realtime.disconnect()
-        } catch {
-          /* best-effort */
-        }
-        if (userId) {
-          try {
-            const admin = createClient(URL!, PROJECT!, SERVICE!)
-            await admin.authAdmin?.deleteUser?.(userId)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    90_000,
-  )
-})

package/packages/aurabase/tests/service-role-guard.test.ts

@@ -1,99 +0,0 @@
-import { describe, it, expect, afterEach, vi } from 'vitest'
-import { createClient, createAdminClient, AuraClient } from '../src/index'
-
-const BASE = 'http://guard.local'
-const PROJECT = 'proj-guard'
-
-afterEach(() => {
-  delete (globalThis as unknown as { window?: unknown }).window
-  delete (globalThis as unknown as { DedicatedWorkerGlobalScope?: unknown }).DedicatedWorkerGlobalScope
-  delete (globalThis as unknown as { SharedWorkerGlobalScope?: unknown }).SharedWorkerGlobalScope
-  vi.restoreAllMocks()
-})
-
-describe('Garde service_role — authAdmin getter (I3, durci)', () => {
-  it('THROW en contexte navigateur (window défini) au lieu de warn', () => {
-    // Client construit hors navigateur (pas de window) : OK.
-    const client = createClient(BASE, PROJECT, 'aura_anon_x', {
-      auth: { autoRefresh: false, persistSession: false },
-    })
-    // Simule un navigateur.
-    ;(globalThis as unknown as { window: unknown }).window = {}
-    expect(() => client.authAdmin).toThrow(/navigateur/)
-  })
-
-  it('accessible en contexte serveur (pas de window)', () => {
-    const client = createClient(BASE, PROJECT, 'aura_anon_x', {
-      auth: { autoRefresh: false, persistSession: false },
-    })
-    // Ne throw pas hors navigateur.
-    expect(() => client.authAdmin).not.toThrow()
-  })
-})
-
-describe('Garde service_role — createClient côté navigateur (SEC-F5, throw par défaut)', () => {
-  it('clé aura_sk_ (service_role) en navigateur → THROW par défaut (refuseServiceRoleInBrowser)', () => {
-    ;(globalThis as unknown as { window: unknown }).window = {}
-
-    expect(() =>
-      createClient(BASE, PROJECT, 'aura_sk_secret', {
-        auth: { autoRefresh: false, persistSession: false },
-      }),
-    ).toThrow(/service_role/)
-  })
-
-  it('clé aura_sk_ en navigateur avec refuseServiceRoleInBrowser:false → warn seulement (échappatoire)', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    ;(globalThis as unknown as { window: unknown }).window = {}
-
-    expect(() =>
-      createClient(BASE, PROJECT, 'aura_sk_secret', {
-        auth: { autoRefresh: false, persistSession: false },
-        refuseServiceRoleInBrowser: false,
-      }),
-    ).not.toThrow()
-
-    const warned = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
-    expect(warned).toBe(true)
-  })
-
-  it('clé anon (aura_anon_) en navigateur → PAS de throw ni warning service_role (usage légitime)', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    ;(globalThis as unknown as { window: unknown }).window = {}
-
-    createClient(BASE, PROJECT, 'aura_anon_public', {
-      auth: { autoRefresh: false, persistSession: false },
-    })
-
-    const warnedSrole = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
-    expect(warnedSrole).toBe(false)
-  })
-
-  it('clé aura_sk_ hors navigateur (serveur) → PAS de warning', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    createClient(BASE, PROJECT, 'aura_sk_secret', {
-      auth: { autoRefresh: false, persistSession: false },
-    })
-    const warnedSrole = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
-    expect(warnedSrole).toBe(false)
-  })
-})
-
-describe('Garde service_role — createAdminClient (E21, étendue aux workers navigateur)', () => {
-  it('THROW en contexte navigateur (window)', () => {
-    ;(globalThis as unknown as { window: unknown }).window = {}
-    expect(() => createAdminClient(BASE, PROJECT, 'aura_sk_x')).toThrow(/navigateur/)
-  })
-
-  it('THROW dans un Web Worker navigateur (DedicatedWorkerGlobalScope, sans window)', () => {
-    ;(globalThis as unknown as { DedicatedWorkerGlobalScope: unknown }).DedicatedWorkerGlobalScope =
-      function () {}
-    expect(() => createAdminClient(BASE, PROJECT, 'aura_sk_x')).toThrow(/navigateur/)
-  })
-
-  it('OK en contexte serveur (ni window ni worker navigateur)', () => {
-    const admin = createAdminClient(BASE, PROJECT, 'aura_sk_x')
-    expect(admin).toBeInstanceOf(AuraClient)
-    expect(admin.apiKey).toBe('aura_sk_x')
-  })
-})

package/packages/aurabase/tests/ssr.test.ts

@@ -1,91 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { createServerClient } from '../src/ssr'
-import type { User } from '@aurabase/core'
-
-function b64url(o: unknown) { return btoa(JSON.stringify(o)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') }
-function validJwt() { return `${b64url({ alg: 'HS256' })}.${b64url({ sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 })}.s` }
-function user(metaSize = 0): User {
-  return {
-    id: 'u1', email: 't@e.com', role: 'authenticated', email_verified: true,
-    is_banned: false, is_anonymous: false, mfa_enabled: false,
-    user_metadata: metaSize ? { blob: 'x'.repeat(metaSize) } : {},
-    app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-/** Faux magasin de cookies : setAll écrit / expire (maxAge 0), getAll relit. */
-function jar(initial: Array<{ name: string; value: string }> = []) {
-  const store = new Map(initial.map((c) => [c.name, c.value]))
-  return {
-    getAll: () => [...store].map(([name, value]) => ({ name, value })),
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    setAll: (cs: Array<{ name: string; value: string; options: any }>) =>
-      cs.forEach(({ name, value, options }) => {
-        if (options?.maxAge === 0) store.delete(name)
-        else store.set(name, value)
-      }),
-    store,
-  }
-}
-
-describe('createServerClient — cookies SSR', () => {
-  it('secure calé sur le protocole : false en http (dev), true en https', () => {
-    const httpCalls: Array<{ options: { secure?: boolean } }> = []
-    const http = createServerClient('http://localhost:8080', 'p', {
-      apiKey: 'k',
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      cookies: { getAll: () => [], setAll: (cs: any) => httpCalls.push(...cs) },
-    })
-    http.authStore.save(validJwt(), 'rt', user())
-    expect(httpCalls[0].options.secure).toBe(false)
-
-    const httpsCalls: Array<{ options: { secure?: boolean } }> = []
-    const https = createServerClient('https://api.example.com', 'p', {
-      apiKey: 'k',
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      cookies: { getAll: () => [], setAll: (cs: any) => httpsCalls.push(...cs) },
-    })
-    https.authStore.save(validJwt(), 'rt', user())
-    expect(httpsCalls[0].options.secure).toBe(true)
-  })
-
-  it('session normale → un seul cookie ; round-trip write→read restaure la session', () => {
-    const j = jar()
-    const tok = validJwt()
-    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    c1.authStore.save(tok, 'rt', user())
-    // un seul cookie, pas de chunk
-    expect([...j.store.keys()]).toEqual(['aura-p-auth'])
-
-    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    expect(c2.authStore.token).toBe(tok)
-    expect(c2.authStore.user?.id).toBe('u1')
-  })
-
-  it('session volumineuse → fragmentée en chunks .0/.1… ; round-trip la reconstitue', () => {
-    const j = jar()
-    const tok = validJwt()
-    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    c1.authStore.save(tok, 'rt', user(5000)) // > MAX_CHUNK_SIZE → chunks
-    const names = [...j.store.keys()]
-    expect(names).toContain('aura-p-auth.0')
-    expect(names).toContain('aura-p-auth.1')
-    expect(names).not.toContain('aura-p-auth') // pas de cookie unique quand chunké
-
-    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    expect(c2.authStore.token).toBe(tok)
-    expect(c2.authStore.user?.user_metadata?.blob).toBe('x'.repeat(5000))
-  })
-
-  it('signout (clear) expire les cookies auth présents', () => {
-    const j = jar()
-    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    c1.authStore.save(validJwt(), 'rt', user())
-    expect(j.store.size).toBe(1)
-
-    // Nouveau client qui charge le cookie, puis signout.
-    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
-    c2.authStore.clear()
-    expect(j.store.size).toBe(0) // cookie expiré/supprimé
-  })
-})