@strivacity/sdk-angular 4.0.0-beta.1 → 4.0.0-beta.2

package/testing/tests/server/sdk.spec.ts

@@ -101,7 +101,7 @@ describe('createServerSDK', () => {
 	});
 
 	test.each([
-		['getSession', [{} as never], null],
+		['getSession', [{} as never, { autoRefresh: false }], null],
 		['updateSession', [{ access_token: 'a' } as never, {} as never], undefined],
 		['refreshSession', [{} as never], { access_token: 'refreshed' }],
 		['revokeSession', [{} as never], undefined],

package/testing/tests/server/session.spec.ts

@@ -1,12 +1,13 @@
 import type { AngularServerSDK } from '../../../src/server/types';
-import { ApplicationInitStatus, REQUEST, TransferState } from '@angular/core';
+import { ApplicationInitStatus, REQUEST, RESPONSE_INIT, TransferState } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
 import { describe, test, expect, vi } from 'vitest';
+import { pushSetCookie } from '@strivacity/sdk-core/utils';
 import { SESSION_TRANSFER_KEY, provideStrivacityServerSession } from '../../../src/server/session';
 
-function configure(request: Request | undefined, serverSdk: AngularServerSDK | undefined) {
+function configure(request: Request | undefined, serverSdk: AngularServerSDK | undefined, responseInit?: ResponseInit) {
 	TestBed.configureTestingModule({
-		providers: [{ provide: REQUEST, useValue: request }, provideStrivacityServerSession(serverSdk)],
+		providers: [{ provide: REQUEST, useValue: request }, { provide: RESPONSE_INIT, useValue: responseInit ?? null }, provideStrivacityServerSession(serverSdk)],
 	});
 
 	return TestBed.inject(ApplicationInitStatus).donePromise;
@@ -18,17 +19,61 @@ describe('provideStrivacityServerSession', () => {
 		const session = { access_token: 'access-token' };
 		const getSession = vi.fn().mockResolvedValue(session);
 
-		await configure(request, { getSession } as unknown as AngularServerSDK);
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(getSession).toHaveBeenCalledWith(request);
 		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual(session);
 	});
 
+	test('never transfers the refresh token or the ID token to the client', async () => {
+		const request = new Request('https://brandtegrity.io');
+		const session = { access_token: 'access-token', refresh_token: 'refresh-token', id_token: 'id-token', expires_at: 9999999999, claims: { sub: 'user' } };
+		const getSession = vi.fn().mockResolvedValue(session);
+
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
+
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual({
+			access_token: 'access-token',
+			expires_at: 9999999999,
+			claims: { sub: 'user' },
+		});
+	});
+
+	test('refreshes a near-expiry session on the server and writes the rotated cookie to the rendered response', async () => {
+		const request = new Request('https://brandtegrity.io/profile');
+		const rotated = { access_token: 'new', refresh_token: 'refresh-2', id_token: 'id-2', expires_at: 9999999999, claims: { sub: 'user' } };
+		const getSession = vi.fn().mockImplementation((req: Request) => {
+			pushSetCookie(req, 'sty.session=rotated; Path=/');
+			return Promise.resolve(rotated);
+		});
+		const responseInit: ResponseInit = { headers: { 'x-existing': '1' } };
+
+		await configure(request, { getSession } as unknown as AngularServerSDK, responseInit);
+
+		expect(getSession).toHaveBeenCalledWith(request);
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toEqual({
+			access_token: 'new',
+			expires_at: 9999999999,
+			claims: { sub: 'user' },
+		});
+		const headers = responseInit.headers as Headers;
+		expect(headers.getSetCookie()).toEqual(['sty.session=rotated; Path=/']);
+		expect(headers.get('x-existing')).toBe('1');
+	});
+
+	test('transfers null when the server-side refresh fails', async () => {
+		const request = new Request('https://brandtegrity.io/profile');
+
+		await configure(request, { getSession: vi.fn().mockResolvedValue(null) } as unknown as AngularServerSDK, {});
+
+		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toBeNull();
+	});
+
 	test('transfers null when the server sdk finds no session for the request', async () => {
 		const request = new Request('https://brandtegrity.io');
 		const getSession = vi.fn().mockResolvedValue(null);
 
-		await configure(request, { getSession } as unknown as AngularServerSDK);
+		await configure(request, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(TestBed.inject(TransferState).get(SESSION_TRANSFER_KEY, undefined)).toBeNull();
 	});
@@ -36,7 +81,7 @@ describe('provideStrivacityServerSession', () => {
 	test('is a no-op when there is no incoming request (e.g. not running under SSR)', async () => {
 		const getSession = vi.fn().mockResolvedValue({ access_token: 'access-token' });
 
-		await configure(undefined, { getSession } as unknown as AngularServerSDK);
+		await configure(undefined, { getSession: getSession } as unknown as AngularServerSDK);
 
 		expect(getSession).not.toHaveBeenCalled();
 		expect(TestBed.inject(TransferState).hasKey(SESSION_TRANSFER_KEY)).toBe(false);