@strivacity/sdk-angular 4.0.0-beta.0 → 4.0.0-beta.2

package/testing/tests/native-login.service.spec.ts

@@ -108,7 +108,7 @@ describe('StrivacityNativeLoginService', () => {
 		});
 
 		test('calls onLogin and leaves the tracked state untouched when the sdk already has a session', async () => {
-			const session = { access_token: 'access-token' } as unknown as SessionData;
+			const session = { access_token: 'access-token', expires_at: Math.floor(Date.now() / 1000) + 3600 } as unknown as SessionData;
 			const flow = createMockFlow<NativeFlow>({ session });
 			vi.mocked(flow.startSession).mockResolvedValue({ screen: 'identifier' });
 			const onLogin = vi.fn();
@@ -149,19 +149,17 @@ describe('StrivacityNativeLoginService', () => {
 			expect(login.loading()).toBe(true);
 		});
 
-		test('propagates a rejection from sdk.init() as-is, since only the startSession() call is guarded by the try/catch', async () => {
-			// the AbortError short-circuit in start()'s own catch guards `this.startSession(...)`, not `await this.sdk.init()`
-			// above it - startSession() also swallows every error itself (including AbortError) and reports it through onError,
-			// so that branch is unreachable via a mocked flow; a rejecting init() is the one thing genuinely uncaught here.
+		test('reports a rejection from sdk.init() to onError and stops loading, without starting a session', async () => {
 			const flow = createMockFlow<NativeFlow>();
-			const abortError = new DOMException('The operation was aborted', 'AbortError');
-			vi.mocked(flow.init).mockRejectedValue(abortError);
+			const error = new Error('init failed');
+			vi.mocked(flow.init).mockRejectedValue(error);
 			const onError = vi.fn();
 			const login = configure(flow);
 
-			await expect(login.start({ onError })).rejects.toBe(abortError);
+			await login.start({ onError });
 
-			expect(onError).not.toHaveBeenCalled();
+			expect(onError).toHaveBeenCalledWith(error);
+			expect(login.loading()).toBe(false);
 			expect(flow.startSession).not.toHaveBeenCalled();
 		});
 	});
@@ -293,19 +291,17 @@ describe('StrivacityNativeLoginService', () => {
 		expect(flow.logging!.debug).toHaveBeenCalledWith('Triggering close');
 	});
 
-	test('aborts the in-flight abort controller when the owning injector is destroyed', () => {
+	test('stops tracking the flow state when the owning injector is destroyed', () => {
 		const flow = createMockFlow<NativeFlow>();
 		vi.mocked(initFlow).mockReturnValue(flow);
 		TestBed.configureTestingModule({ providers: [{ provide: STRIVACITY_SDK, useValue: createOptions({ mode: 'native' }) }, StrivacityAuthService] });
 
-		const abortSpy = vi.spyOn(AbortController.prototype, 'abort');
-
 		// both services must live on the component's own injector for fixture.destroy() to fire their DestroyRef callbacks
-		const { destroy } = mountWithProviders([StrivacityAuthService, StrivacityNativeLoginService], () => inject(StrivacityNativeLoginService));
+		const { value: login, destroy } = mountWithProviders([StrivacityAuthService, StrivacityNativeLoginService], () => inject(StrivacityNativeLoginService));
 
 		destroy();
+		login.setFormValue('form1', 'email', 'a@b.c');
 
-		expect(abortSpy).toHaveBeenCalledTimes(1);
-		abortSpy.mockRestore();
+		expect(login.forms()).toEqual({});
 	});
 });

package/testing/tests/server/sdk.spec.ts

@@ -101,7 +101,7 @@ describe('createServerSDK', () => {
 	});
 
 	test.each([
-		['getSession', [{} as never], null],
+		['getSession', [{} as never, { autoRefresh: false }], null],
 		['updateSession', [{ access_token: 'a' } as never, {} as never], undefined],
 		['refreshSession', [{} as never], { access_token: 'refreshed' }],
 		['revokeSession', [{} as never], undefined],

package/testing/tests/server/session.spec.ts

@@ -1,12 +1,13 @@
 import type { AngularServerSDK } from '../../../src/server/types';
-import { ApplicationInitStatus, REQUEST, TransferState } from '@angular/core';
+import { ApplicationInitStatus, REQUEST, RESPONSE_INIT, TransferState } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
 import { describe, test, expect, vi } from 'vitest';
+import { pushSetCookie } from '@strivacity/sdk-core/utils';
 import { SESSION_TRANSFER_KEY, provideStrivacityServerSession } from '../../../src/server/session';
 
-function configure(request: Request | undefined, serverSdk: AngularServerSDK | undefined) {
+function configure(request: Request | undefined, serverSdk: AngularServerSDK | undefined, responseInit?: ResponseInit) {
 	TestBed.configureTestingModule({
-		providers: [{ provide: REQUEST, useValue: request }, provideStrivacityServerSession(serverSdk)],
+		providers: [{ provide: REQUEST, useValue: request }, { provide: RESPONSE_INIT, useValue: responseInit ?? null }, provideStrivacityServerSession(serverSdk)],
 	});
 
 	return TestBed.inject(ApplicationInitStatus).donePromise;
@@ -18,17 +19,61 @@ describe('provideStrivacityServerSession', () => {
 		const session = { access_token: 'access-token' };
 		const getSession = vi.fn().mockResolvedValue(session);
 
-		await configure(request, { getSession } as unknown as AngularServerSDK);
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(getSession).toHaveBeenCalledWith(request);
 		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual(session);
 	});
 
+	test('never transfers the refresh token or the ID token to the client', async () => {
+		const request = new Request('https://brandtegrity.io');
+		const session = { access_token: 'access-token', refresh_token: 'refresh-token', id_token: 'id-token', expires_at: 9999999999, claims: { sub: 'user' } };
+		const getSession = vi.fn().mockResolvedValue(session);
+
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
+
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual({
+			access_token: 'access-token',
+			expires_at: 9999999999,
+			claims: { sub: 'user' },
+		});
+	});
+
+	test('refreshes a near-expiry session on the server and writes the rotated cookie to the rendered response', async () => {
+		const request = new Request('https://brandtegrity.io/profile');
+		const rotated = { access_token: 'new', refresh_token: 'refresh-2', id_token: 'id-2', expires_at: 9999999999, claims: { sub: 'user' } };
+		const getSession = vi.fn().mockImplementation((req: Request) => {
+			pushSetCookie(req, 'sty.session=rotated; Path=/');
+			return Promise.resolve(rotated);
+		});
+		const responseInit: ResponseInit = { headers: { 'x-existing': '1' } };
+
+		await configure(request, { getSession } as unknown as AngularServerSDK, responseInit);
+
+		expect(getSession).toHaveBeenCalledWith(request);
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual({
+			access_token: 'new',
+			expires_at: 9999999999,
+			claims: { sub: 'user' },
+		});
+		const headers = responseInit.headers as Headers;
+		expect(headers.getSetCookie()).toEqual(['sty.session=rotated; Path=/']);
+		expect(headers.get('x-existing')).toBe('1');
+	});
+
+	test('transfers null when the server-side refresh fails', async () => {
+		const request = new Request('https://brandtegrity.io/profile');
+
+		await configure(request, { getSession: vi.fn().mockResolvedValue(null) } as unknown as AngularServerSDK, {});
+
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toBeNull();
+	});
+
 	test('transfers null when the server sdk finds no session for the request', async () => {
 		const request = new Request('https://brandtegrity.io');
 		const getSession = vi.fn().mockResolvedValue(null);
 
-		await configure(request, { getSession } as unknown as AngularServerSDK);
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toBeNull();
 	});
@@ -36,7 +81,7 @@ describe('provideStrivacityServerSession', () => {
 	test('is a no-op when there is no incoming request (e.g. not running under SSR)', async () => {
 		const getSession = vi.fn().mockResolvedValue({ access_token: 'access-token' });
 
-		await configure(undefined, { getSession } as unknown as AngularServerSDK);
+		await configure(undefined, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(getSession).not.toHaveBeenCalled();
 		expect(TestBed.inject(TransferState).hasKey(SESSION_TRANSFER_KEY)).toBe(false);