@oneuptime/common 13.0.6 → 13.0.8

package/Tests/UI/Utils/API/DashboardHost.ts

@@ -0,0 +1,12 @@
+/*
+ * The browser client builds IDENTITY_URL (where the session is refreshed) and
+ * the other service URLs from HOST once, when UI/Config is first loaded. With
+ * no HOST the refresh URL degenerates to "http://identity/refresh-token", which
+ * is not a URL any browser would call. Importing this module FIRST gives the
+ * client the host a real Dashboard runs on. Jest gives each test file its own
+ * copy of process.env, so this does not leak into other files.
+ */
+export const DASHBOARD_ORIGIN: string = "https://oneuptime.example.com";
+
+process.env["HOST"] = "oneuptime.example.com";
+process.env["HTTP_PROTOCOL"] = "https";

package/Tests/UI/Utils/API/FakeAxiosServer.ts

@@ -0,0 +1,183 @@
+import HTTPMethod from "../../../../Types/API/HTTPMethod";
+import Dictionary from "../../../../Types/Dictionary";
+import { JSONArray, JSONObject } from "../../../../Types/JSON";
+import {
+  AxiosError,
+  AxiosHeaders,
+  AxiosRequestConfig,
+  AxiosResponse,
+  InternalAxiosRequestConfig,
+} from "axios";
+
+/*
+ * A scripted stand-in for the server, sitting where axios's transport would.
+ *
+ * Common/Utils/API.ts calls `axios(config)` and relies on axios for the one
+ * behaviour everything in these tests hangs on: a 4xx/5xx REJECTS with an
+ * AxiosError carrying `response.status`, and a request that never got an answer
+ * rejects with no `response` at all. The fake reproduces exactly that, with real
+ * AxiosError instances, so `axios.isAxiosError` and the 401 branch in
+ * fetchUntraced see what they would see in a browser.
+ *
+ * Every route is scripted with the replies it gives, in order. A request the
+ * script did not expect - an extra refresh, a replay that should not have
+ * happened - is answered with a plain Error, which the client turns into a
+ * thrown APIException that fails the test naming the unexpected request.
+ */
+
+export type FakeTransport = jest.MockedFunction<
+  (config: AxiosRequestConfig) => Promise<AxiosResponse>
+>;
+
+export interface FakeReply {
+  // HTTP status to answer with. 2xx resolves; anything else rejects, as axios does.
+  status?: number | undefined;
+  data?: JSONObject | JSONArray | undefined;
+  headers?: Dictionary<string> | undefined;
+  // Fail without any response, the way a refused or dropped connection does.
+  networkErrorCode?: string | undefined;
+  // Hold the reply until this settles, to keep a request in flight on purpose.
+  gate?: Promise<void> | undefined;
+}
+
+export interface SentRequest {
+  method: string;
+  url: string;
+  data: unknown;
+  headers: Dictionary<string>;
+}
+
+export interface Gate {
+  promise: Promise<void>;
+  open: () => void;
+}
+
+export const createGate: () => Gate = (): Gate => {
+  let open: () => void = (): void => {};
+
+  const promise: Promise<void> = new Promise<void>((resolve: () => void) => {
+    open = resolve;
+  });
+
+  return { promise: promise, open: open };
+};
+
+/*
+ * Lets every promise chain that is already runnable finish. A macrotask runs
+ * only once the microtask queue is empty, so after this every request that
+ * could reach the fake without outside help has done so.
+ */
+export const settle: () => Promise<void> = async (): Promise<void> => {
+  await new Promise<void>((resolve: () => void) => {
+    setTimeout(resolve, 0);
+  });
+};
+
+export default class FakeAxiosServer {
+  public readonly sent: Array<SentRequest> = [];
+
+  // Called for every request as it arrives, before it is answered.
+  public onRequest: ((request: SentRequest) => void) | null = null;
+
+  private readonly routes: Map<string, Array<FakeReply>> = new Map();
+
+  private readonly transport: FakeTransport;
+
+  public constructor(transport: FakeTransport) {
+    this.transport = transport;
+
+    this.transport.mockImplementation(
+      async (config: AxiosRequestConfig): Promise<AxiosResponse> => {
+        return await this.handle(config);
+      },
+    );
+  }
+
+  public on(method: HTTPMethod, url: string, replies: Array<FakeReply>): this {
+    const key: string = FakeAxiosServer.key(method, url);
+
+    this.routes.set(key, [...(this.routes.get(key) || []), ...replies]);
+
+    return this;
+  }
+
+  public requestsTo(method: HTTPMethod, url: string): Array<SentRequest> {
+    return this.sent.filter((request: SentRequest): boolean => {
+      return (
+        request.method.toUpperCase() === method.toUpperCase() &&
+        request.url === url
+      );
+    });
+  }
+
+  private static key(method: string, url: string): string {
+    return `${method.toUpperCase()} ${url}`;
+  }
+
+  private async handle(config: AxiosRequestConfig): Promise<AxiosResponse> {
+    const request: SentRequest = {
+      method: String(config.method || ""),
+      url: String(config.url || ""),
+      data: config.data,
+      headers: { ...((config.headers || {}) as Dictionary<string>) },
+    };
+
+    this.sent.push(request);
+
+    if (this.onRequest) {
+      this.onRequest(request);
+    }
+
+    const queue: Array<FakeReply> | undefined = this.routes.get(
+      FakeAxiosServer.key(request.method, request.url),
+    );
+
+    const reply: FakeReply | undefined = queue ? queue.shift() : undefined;
+
+    if (!reply) {
+      throw new Error(
+        `Unexpected request: ${request.method.toUpperCase()} ${request.url}`,
+      );
+    }
+
+    if (reply.gate) {
+      await reply.gate;
+    }
+
+    const internalConfig: InternalAxiosRequestConfig = {
+      ...config,
+      headers: new AxiosHeaders(),
+    } as InternalAxiosRequestConfig;
+
+    if (reply.networkErrorCode) {
+      throw new AxiosError(
+        `connect ${reply.networkErrorCode}`,
+        reply.networkErrorCode,
+        internalConfig,
+        {},
+      );
+    }
+
+    const status: number = reply.status ?? 200;
+
+    const response: AxiosResponse = {
+      data: reply.data ?? {},
+      status: status,
+      statusText: "",
+      headers: reply.headers ?? {},
+      config: internalConfig,
+    };
+
+    if (status >= 200 && status < 300) {
+      return response;
+    }
+
+    throw new AxiosError(
+      `Request failed with status code ${status}`,
+      status >= 500 ? "ERR_BAD_RESPONSE" : "ERR_BAD_REQUEST",
+      internalConfig,
+      {},
+      response,
+    );
+  }
+}

package/Tests/UI/Utils/Breadcrumb/fixtures/RealBreadcrumbTrails.ts

@@ -1538,6 +1538,11 @@ const realBreadcrumbTrails: Array<BreadcrumbTrailFixture> = [
     pagePattern: "/dashboard/:projectId/on-call-duty/calendar-feeds",
     titles: ["Project", "On-Call Duty", "Calendar Feeds"],
   },
+  {
+    getter: "getOnCallDutyBreadcrumbs",
+    pagePattern: "/dashboard/:projectId/on-call-duty/schedule-timeline",
+    titles: ["Project", "On-Call Duty", "Schedule Timeline"],
+  },
   {
     getter: "getOnCallDutyBreadcrumbs",
     pagePattern: "/dashboard/:projectId/on-call-duty/execution-logs",
@@ -2778,6 +2783,11 @@ const realBreadcrumbTrails: Array<BreadcrumbTrailFixture> = [
     pagePattern: "/dashboard/:projectId/teams/:id/compliance",
     titles: ["Project", "Teams", "View Team", "Compliance"],
   },
+  {
+    getter: "getTeamsBreadcrumbs",
+    pagePattern: "/dashboard/:projectId/teams/:id/on-call-schedules",
+    titles: ["Project", "Teams", "View Team", "On-Call Schedules"],
+  },
   {
     getter: "getTeamsBreadcrumbs",
     pagePattern: "/dashboard/:projectId/teams/:id/custom-fields",

package/Tests/UI/Utils/Breadcrumb/fixtures/RealRoutePatterns.ts

@@ -580,6 +580,7 @@ const realRoutePatterns: Array<string> = [
   "/dashboard/:projectId/on-call-duty/*",
   "/dashboard/:projectId/on-call-duty/policies",
   "/dashboard/:projectId/on-call-duty/calendar-feeds",
+  "/dashboard/:projectId/on-call-duty/schedule-timeline",
   "/dashboard/:projectId/on-call-duty/schedules",
   "/dashboard/:projectId/on-call-duty/schedules/:id",
   "/dashboard/:projectId/on-call-duty/schedules/:id/delete",
@@ -684,6 +685,7 @@ const realRoutePatterns: Array<string> = [
   "/dashboard/:projectId/teams/:id/permissions",
   "/dashboard/:projectId/teams/:id/block-permissions",
   "/dashboard/:projectId/teams/:id/compliance",
+  "/dashboard/:projectId/teams/:id/on-call-schedules",
   "/dashboard/:projectId/teams/:id/custom-fields",
   "/dashboard/:projectId/teams/:id/delete",
   "/dashboard/:projectId/settings/*",

package/Tests/UI/Utils/Cookie.test.ts

@@ -0,0 +1,440 @@
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import Cookie from "../../../UI/Utils/Cookie";
+import CookieName from "../../../Types/CookieName";
+import Route from "../../../Types/API/Route";
+import Email from "../../../Types/Email";
+import URL from "../../../Types/API/URL";
+import { JSONObject, JSONValue } from "../../../Types/JSON";
+
+/*
+ * Cookie is a thin wrapper around universal-cookie, which in jsdom writes
+ * straight through to `document.cookie`. Rather than mocking the library, these
+ * tests observe the real cookie jar and, where the exact attributes matter
+ * (Path, Max-Age, HttpOnly), record every raw string assigned to
+ * `document.cookie` so the serialized header can be asserted.
+ */
+
+const cookieDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(
+  Document.prototype,
+  "cookie",
+) as PropertyDescriptor;
+
+let cookieWrites: Array<string> = [];
+
+const installCookieWriteRecorder: () => void = (): void => {
+  Object.defineProperty(document, "cookie", {
+    configurable: true,
+    get: (): string => {
+      return cookieDescriptor.get!.call(document) as string;
+    },
+    set: (value: string): void => {
+      cookieWrites.push(value);
+      cookieDescriptor.set!.call(document, value);
+    },
+  });
+};
+
+const uninstallCookieWriteRecorder: () => void = (): void => {
+  // Remove the own-property override so the prototype accessor is used again.
+  delete (document as unknown as { cookie?: string }).cookie;
+};
+
+const readRawJar: () => { [key: string]: string } = (): {
+  [key: string]: string;
+} => {
+  const jar: { [key: string]: string } = {};
+  const raw: string = document.cookie;
+
+  if (!raw) {
+    return jar;
+  }
+
+  for (const part of raw.split(";")) {
+    const index: number = part.indexOf("=");
+    const name: string = part.slice(0, index).trim();
+    const value: string = part.slice(index + 1).trim();
+    jar[name] = decodeURIComponent(value);
+  }
+
+  return jar;
+};
+
+const expireEverything: () => void = (): void => {
+  const paths: Array<string> = ["/", "/dashboard", "/dashboard/project"];
+
+  for (const name of Object.keys(readRawJar())) {
+    for (const path of paths) {
+      document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=${path}`;
+    }
+  }
+};
+
+const lastWriteFor: (name: string) => string = (name: string): string => {
+  const writes: Array<string> = cookieWrites.filter((write: string) => {
+    return write.startsWith(`${name}=`);
+  });
+
+  expect(writes.length).toBeGreaterThan(0);
+  return writes[writes.length - 1] as string;
+};
+
+describe("UI Cookie util", () => {
+  beforeEach(() => {
+    window.history.replaceState({}, "", "/");
+    expireEverything();
+    cookieWrites = [];
+    installCookieWriteRecorder();
+  });
+
+  afterEach(() => {
+    uninstallCookieWriteRecorder();
+    window.history.replaceState({}, "", "/");
+    expireEverything();
+  });
+
+  describe("setItem", () => {
+    it("stores a plain string value unchanged at the root path by default", () => {
+      Cookie.setItem(CookieName.UserID, "user-123");
+
+      expect(readRawJar()[CookieName.UserID]).toBe("user-123");
+
+      const write: string = lastWriteFor(CookieName.UserID);
+      expect(write).toContain("Path=/");
+      expect(write).not.toContain("HttpOnly");
+      expect(write).not.toContain("Max-Age");
+    });
+
+    it("URL-encodes characters that are not legal in a cookie value", () => {
+      const value: string = "Jane Doe; admin=true, héllo";
+
+      Cookie.setItem(CookieName.Name, value);
+
+      const write: string = lastWriteFor(CookieName.Name);
+      /*
+       * The raw header must not contain the separator characters verbatim,
+       * otherwise "; admin=true" would be read as a cookie attribute.
+       */
+      expect(write.split(";")[0]).not.toContain(" ");
+      expect(write.split(";")[0]).not.toContain(",");
+      expect(write).not.toContain("admin=true");
+
+      expect(readRawJar()[CookieName.Name]).toBe(value);
+      expect(Cookie.getItem(CookieName.Name)).toBe(value);
+    });
+
+    it("uses the supplied Route as the cookie path", () => {
+      Cookie.setItem(CookieName.Timezone, "UTC", {
+        path: new Route("/dashboard"),
+      });
+
+      expect(lastWriteFor(CookieName.Timezone)).toContain("Path=/dashboard");
+
+      // A cookie scoped to /dashboard is not visible from the root.
+      expect(readRawJar()[CookieName.Timezone]).toBeUndefined();
+
+      window.history.replaceState({}, "", "/dashboard/home");
+      expect(readRawJar()[CookieName.Timezone]).toBe("UTC");
+    });
+
+    it("does not set Max-Age when maxAgeInDays is omitted or zero", () => {
+      Cookie.setItem(CookieName.UserID, "a", {
+        path: new Route("/"),
+      });
+      expect(lastWriteFor(CookieName.UserID)).not.toContain("Max-Age");
+
+      Cookie.setItem(CookieName.UserID, "b", {
+        path: new Route("/"),
+        maxAgeInDays: 0,
+      });
+      expect(lastWriteFor(CookieName.UserID)).not.toContain("Max-Age");
+      expect(readRawJar()[CookieName.UserID]).toBe("b");
+    });
+
+    it("sets a Max-Age attribute when maxAgeInDays is provided", () => {
+      Cookie.setItem(CookieName.UserID, "persistent", {
+        path: new Route("/"),
+        maxAgeInDays: 30,
+      });
+
+      const write: string = lastWriteFor(CookieName.UserID);
+      const match: RegExpMatchArray | null = write.match(/Max-Age=(\d+)/);
+
+      expect(match).not.toBeNull();
+      // At minimum the cookie must live for the requested 30 days.
+      expect(Number(match![1])).toBeGreaterThanOrEqual(30 * 24 * 60 * 60);
+      expect(readRawJar()[CookieName.UserID]).toBe("persistent");
+    });
+
+    /*
+     * universal-cookie (and the Set-Cookie spec) interpret maxAge in SECONDS,
+     * but Cookie.setItem passes OneUptimeDate.getMillisecondsInDays(), so a
+     * 1-day cookie is written with Max-Age=86400000 (~1000 days). This test
+     * documents the expected behaviour and is marked `failing` until the
+     * source is fixed; when it starts passing, drop the `.failing`.
+     */
+    it.failing(
+      "writes Max-Age in seconds (1 day => 86400) [known bug: uses milliseconds]",
+      () => {
+        Cookie.setItem(CookieName.UserID, "one-day", {
+          path: new Route("/"),
+          maxAgeInDays: 1,
+        });
+
+        expect(lastWriteFor(CookieName.UserID)).toContain("Max-Age=86400;");
+      },
+    );
+
+    it("currently writes Max-Age in milliseconds (1 day => 86400000)", () => {
+      Cookie.setItem(CookieName.UserID, "one-day", {
+        path: new Route("/"),
+        maxAgeInDays: 1,
+      });
+
+      expect(lastWriteFor(CookieName.UserID)).toContain("Max-Age=86400000");
+    });
+
+    it("adds the HttpOnly attribute when requested, which browsers then refuse to store from script", () => {
+      Cookie.setItem(CookieName.Token, "secret", {
+        path: new Route("/"),
+        httpOnly: true,
+      });
+
+      expect(lastWriteFor(CookieName.Token)).toContain("HttpOnly");
+      // document.cookie cannot create HttpOnly cookies, so nothing is stored.
+      expect(readRawJar()[CookieName.Token]).toBeUndefined();
+      expect(Cookie.exists(CookieName.Token)).toBe(false);
+    });
+
+    it("JSON-serializes plain objects and getItem returns an equal object", () => {
+      const value: JSONObject = { a: 1, nested: { b: "two" }, list: [1, 2] };
+
+      Cookie.setItem(CookieName.UserID, value);
+
+      expect(JSON.parse(readRawJar()[CookieName.UserID] as string)).toEqual(
+        value,
+      );
+      expect(Cookie.getItem(CookieName.UserID)).toEqual(value);
+    });
+
+    it("serializes an Email value object into its typed JSON form", () => {
+      Cookie.setItem(CookieName.Email, new Email("jane@example.com"));
+
+      const stored: JSONObject = JSON.parse(
+        readRawJar()[CookieName.Email] as string,
+      ) as JSONObject;
+
+      expect(stored["_type"]).toBe("Email");
+      expect(stored["value"]).toBe("jane@example.com");
+    });
+
+    it("serializes a URL value object into its typed JSON form", () => {
+      Cookie.setItem(
+        CookieName.UserID,
+        URL.fromString("https://oneuptime.com/dashboard"),
+      );
+
+      const stored: JSONObject = JSON.parse(
+        readRawJar()[CookieName.UserID] as string,
+      ) as JSONObject;
+
+      expect(stored["_type"]).toBe("URL");
+      expect(stored["value"]).toBe("https://oneuptime.com/dashboard");
+    });
+
+    it("accepts arbitrary string keys as well as CookieName members", () => {
+      Cookie.setItem("custom-cookie", "custom-value");
+
+      expect(readRawJar()["custom-cookie"]).toBe("custom-value");
+    });
+
+    it("overwrites a previous value for the same key and path", () => {
+      Cookie.setItem(CookieName.UserID, "first");
+      Cookie.setItem(CookieName.UserID, "second");
+
+      expect(readRawJar()[CookieName.UserID]).toBe("second");
+      expect(Cookie.getItem(CookieName.UserID)).toBe("second");
+    });
+  });
+
+  describe("getItem", () => {
+    it("returns undefined for a cookie that does not exist", () => {
+      expect(Cookie.getItem(CookieName.UserID)).toBeUndefined();
+    });
+
+    it("returns non-JSON strings as-is", () => {
+      document.cookie = `${CookieName.UserID}=plain-text; path=/`;
+
+      expect(Cookie.getItem(CookieName.UserID)).toBe("plain-text");
+    });
+
+    it("parses JSON primitives stored in the cookie", () => {
+      document.cookie = `${CookieName.IsMasterAdmin}=true; path=/`;
+      document.cookie = `${CookieName.ProfilePicID}=42; path=/`;
+
+      expect(Cookie.getItem(CookieName.IsMasterAdmin)).toBe(true);
+      expect(Cookie.getItem(CookieName.ProfilePicID)).toBe(42);
+    });
+
+    it("returns falsy parsed values without attempting to deserialize them", () => {
+      document.cookie = `${CookieName.IsMasterAdmin}=false; path=/`;
+      document.cookie = `${CookieName.ProfilePicID}=0; path=/`;
+
+      expect(Cookie.getItem(CookieName.IsMasterAdmin)).toBe(false);
+      expect(Cookie.getItem(CookieName.ProfilePicID)).toBe(0);
+    });
+
+    it("decodes percent-encoded cookie values written by the server", () => {
+      document.cookie = `${CookieName.Email}=${encodeURIComponent(
+        "jane+test@example.com",
+      )}; path=/`;
+
+      expect(Cookie.getItem(CookieName.Email)).toBe("jane+test@example.com");
+    });
+
+    it("strips the express 'j:' prefix from JSON cookies", () => {
+      document.cookie = `${CookieName.UserID}=${encodeURIComponent(
+        'j:{"id":"abc"}',
+      )}; path=/`;
+
+      expect(Cookie.getItem(CookieName.UserID)).toEqual({ id: "abc" });
+    });
+
+    it("returns the typed JSON (not a rehydrated instance) for a stored Email", () => {
+      Cookie.setItem(CookieName.Email, new Email("jane@example.com"));
+
+      const value: JSONValue = Cookie.getItem(CookieName.Email);
+
+      /*
+       * universal-cookie already JSON.parses the value, so getItem's own
+       * JSON5 parse of `value.toString()` ("[object Object]") throws and the
+       * raw object is returned without deserializeValue being applied.
+       */
+      expect(value).toEqual({ _type: "Email", value: "jane@example.com" });
+      expect(value).not.toBeInstanceOf(Email);
+    });
+  });
+
+  describe("exists", () => {
+    it("is false for a missing cookie and true once set", () => {
+      expect(Cookie.exists(CookieName.UserID)).toBe(false);
+
+      Cookie.setItem(CookieName.UserID, "abc");
+
+      expect(Cookie.exists(CookieName.UserID)).toBe(true);
+    });
+
+    it("treats a cookie whose parsed value is falsy as not existing", () => {
+      document.cookie = `${CookieName.IsMasterAdmin}=false; path=/`;
+      document.cookie = `${CookieName.ProfilePicID}=0; path=/`;
+      document.cookie = `${CookieName.Name}=; path=/`;
+
+      expect(readRawJar()[CookieName.IsMasterAdmin]).toBe("false");
+      expect(Cookie.exists(CookieName.IsMasterAdmin)).toBe(false);
+      expect(Cookie.exists(CookieName.ProfilePicID)).toBe(false);
+      expect(Cookie.exists(CookieName.Name)).toBe(false);
+    });
+  });
+
+  describe("removeItem", () => {
+    it("removes a root-path cookie when called from the root", () => {
+      Cookie.setItem(CookieName.UserID, "abc");
+      expect(Cookie.exists(CookieName.UserID)).toBe(true);
+
+      Cookie.removeItem(CookieName.UserID);
+
+      expect(Cookie.exists(CookieName.UserID)).toBe(false);
+      expect(readRawJar()[CookieName.UserID]).toBeUndefined();
+
+      const write: string = lastWriteFor(CookieName.UserID);
+      expect(write).toContain("Max-Age=0");
+      expect(write).toContain("Expires=");
+    });
+
+    it("is a no-op for a cookie that does not exist", () => {
+      expect(() => {
+        Cookie.removeItem(CookieName.UserID);
+      }).not.toThrow();
+      expect(Cookie.exists(CookieName.UserID)).toBe(false);
+    });
+
+    it("does not send a Path attribute, so it misses root cookies when the page is on a nested route", () => {
+      Cookie.setItem(CookieName.UserID, "abc", { path: new Route("/") });
+
+      window.history.replaceState({}, "", "/dashboard/project/overview");
+      Cookie.removeItem(CookieName.UserID);
+
+      expect(lastWriteFor(CookieName.UserID)).not.toContain("Path=");
+      /*
+       * Without a Path the browser defaults to the current directory
+       * (/dashboard/project), which does not match the "/" cookie, so it
+       * survives. Documented here as current behaviour.
+       */
+      expect(readRawJar()[CookieName.UserID]).toBe("abc");
+    });
+
+    it("leaves other cookies intact", () => {
+      Cookie.setItem(CookieName.UserID, "abc");
+      Cookie.setItem(CookieName.Name, "Jane");
+
+      Cookie.removeItem(CookieName.UserID);
+
+      expect(Cookie.exists(CookieName.UserID)).toBe(false);
+      expect(Cookie.getItem(CookieName.Name)).toBe("Jane");
+    });
+  });
+
+  describe("clearAllCookies", () => {
+    it("removes every cookie named in the CookieName enum", () => {
+      for (const name of Object.values(CookieName)) {
+        Cookie.setItem(name, `value-${name}`);
+      }
+
+      for (const name of Object.values(CookieName)) {
+        expect(Cookie.exists(name)).toBe(true);
+      }
+
+      Cookie.clearAllCookies();
+
+      for (const name of Object.values(CookieName)) {
+        expect(Cookie.exists(name)).toBe(false);
+      }
+      expect(readRawJar()).toEqual({});
+    });
+
+    it("clears root-path cookies even when invoked from a nested route", () => {
+      Cookie.setItem(CookieName.Token, "t");
+      Cookie.setItem(CookieName.RefreshToken, "r");
+
+      window.history.replaceState({}, "", "/dashboard/project/overview");
+      Cookie.clearAllCookies();
+
+      expect(readRawJar()[CookieName.Token]).toBeUndefined();
+      expect(readRawJar()[CookieName.RefreshToken]).toBeUndefined();
+
+      for (const name of Object.values(CookieName)) {
+        expect(lastWriteFor(name)).toContain("Path=/");
+      }
+    });
+
+    it("does not remove cookies outside the CookieName enum", () => {
+      Cookie.setItem("third-party-cookie", "keep-me");
+      Cookie.setItem(CookieName.UserID, "abc");
+
+      Cookie.clearAllCookies();
+
+      expect(readRawJar()["third-party-cookie"]).toBe("keep-me");
+      expect(Cookie.exists(CookieName.UserID)).toBe(false);
+    });
+
+    it("does not remove enum cookies scoped to a non-root path", () => {
+      Cookie.setItem(CookieName.Timezone, "UTC", {
+        path: new Route("/dashboard"),
+      });
+
+      Cookie.clearAllCookies();
+
+      window.history.replaceState({}, "", "/dashboard/home");
+      expect(readRawJar()[CookieName.Timezone]).toBe("UTC");
+    });
+  });
+});