@tinya-code/gas-admin-ui 0.2.0-alpha.13 → 0.2.0-alpha.15

package/src/lib/core/services/auth.service.spec.ts

@@ -0,0 +1,653 @@
+import { provideHttpClient } from '@angular/common/http';
+import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+import { provideRouter } from '@angular/router';
+
+import type { FieldSchema, ResourceSchema } from '../models/schema.model';
+import type { FirebaseAuthAdapter } from '../adapters/firebase-auth.adapter';
+import { API_DRIVER, API_URL, FIREBASE_AUTH_ADAPTER } from '../tokens';
+import { AuthService, SESSION_TOKEN_KEY, SESSION_USER_KEY } from './auth.service';
+import { vi } from 'vitest';
+
+
+/**
+ * R2.7 · R2.9 · R2.12 — el `AuthService` y la tabla de §4.5.
+ *
+ *  - **R2.7**: señales, `login()` / `logout()` / `restore()` y el envelope.
+ *  - **R2.9**: las CINCO filas de §4.5, probadas una a una. Se llaman a
+ *    `applyAuthCode` directamente: el puente del interceptor ya está
+ *    cubierto en `api-error.interceptor.spec.ts`, y probar las dos mitades
+ *    en el mismo sitio sólo duplicaría el mismo fallo.
+ *  - **R2.12**: el storage es `sessionStorage` y nada más — ni un byte en
+ *    `localStorage`, que D10-3 negó.
+ */
+describe('AuthService — sesión (R2.7 / R2.9 / R2.12)', () => {
+  let http: HttpTestingController;
+
+  function seed(token = 'tok-semilla', user: unknown = { id: 'u_1', role: 'admin' }) {
+    sessionStorage.setItem(SESSION_TOKEN_KEY, token);
+    if (user !== null) sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify(user));
+  }
+
+  /** Inyecta el servicio ya con la sesión sembrada (como tras un reload). */
+  function injected(): AuthService {
+    TestBed.configureTestingModule({
+      providers: [
+        provideHttpClient(),
+        provideHttpClientTesting(),
+        provideRouter([]),
+        { provide: API_URL, useValue: '/api' },
+      ],
+    });
+    http = TestBed.inject(HttpTestingController);
+    return TestBed.inject(AuthService);
+  }
+
+  beforeEach(() => sessionStorage.clear());
+  afterEach(() => {
+    http?.verify();
+    sessionStorage.clear();
+    localStorage.clear();
+  });
+
+  // ── R2.12 · storage ──────────────────────────────────────────────────────
+
+  it('arranca SIN sesión cuando el storage está vacío', () => {
+    const auth = injected();
+    expect(auth.isAuthenticated()).toBe(false);
+    expect(auth.token()).toBeNull();
+    expect(auth.user()).toBeNull();
+    expect(auth.role()).toBe('');
+  });
+
+  it('restaura la sesión desde sessionStorage (recarga de pestaña)', () => {
+    seed();
+    const auth = injected();
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.token()).toBe('tok-semilla');
+    expect(auth.role()).toBe('admin');
+  });
+
+  it('un usuario corrupto en storage no deja sesión a medias', () => {
+    sessionStorage.setItem(SESSION_TOKEN_KEY, 'tok');
+    sessionStorage.setItem(SESSION_USER_KEY, 'esto no es json');
+    const auth = injected();
+    expect(auth.isAuthenticated()).toBe(false);
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBeNull();
+  });
+
+  it('el token JAMÁS se escribe en localStorage (D10-3 lo negó)', () => {
+    seed();
+    const auth = injected();
+    // Cierra y reabre sesión: el viaje completo por el storage.
+    auth.applyRenewedToken('tok-renovado');
+    expect(localStorage.length).toBe(0);
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBe('tok-renovado');
+  });
+
+  // ── R2.7 · login / logout / restore ──────────────────────────────────────
+
+  it('login() pide /auth/login con el envelope y abre la sesión', () => {
+    const auth = injected();
+    let body: unknown;
+    auth.login('ana@x.com', 'secreta').subscribe();
+
+    const req = http.expectOne('/api');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.headers.get('Content-Type')).toBe('text/plain');
+    body = req.request.body;
+    expect(body).toEqual({
+      token: null,
+      method: 'POST',
+      path: '/auth/login',
+      payload: { email: 'ana@x.com', password: 'secreta' },
+    });
+    req.flush({ token: 'tok-nuevo', user: { id: 'u_1', role: 'admin', active: true } });
+
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.token()).toBe('tok-nuevo');
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBe('tok-nuevo');
+    expect(sessionStorage.getItem(SESSION_USER_KEY)).toContain('u_1');
+  });
+
+  it('logout() borra la sesión local AUNQUE la petición falle', () => {
+    seed();
+    const auth = injected();
+    auth.logout().subscribe({ error: () => undefined });
+
+    http.expectOne('/api').error(new ErrorEvent('error'));
+
+    expect(auth.isAuthenticated()).toBe(false);
+    expect(auth.token()).toBeNull();
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBeNull();
+    expect(sessionStorage.getItem(SESSION_USER_KEY)).toBeNull();
+  });
+
+  it('restore() sin token no hace NINGÚN viaje', () => {
+    const auth = injected();
+    auth.restore().subscribe();
+    http.expectNone('/api');
+    expect(auth.isAuthenticated()).toBe(false);
+  });
+
+  it('restore() con token revalida contra /auth/me y trae el usuario', () => {
+    seed('tok-semilla', null); // token huérfano: usuario borrado a mano
+    const auth = injected();
+    auth.restore().subscribe();
+
+    const req = http.expectOne('/api');
+    expect((req.request.body as { path: string }).path).toBe('/auth/me');
+    req.flush({ user: { id: 'u_1', role: 'admin', active: true } });
+
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.role()).toBe('admin');
+  });
+
+  it('applyRenewedToken sólo cambia la firma: el usuario no se mueve', () => {
+    seed();
+    const auth = injected();
+    const antes = auth.user();
+    auth.applyRenewedToken('tok-renovado');
+    expect(auth.token()).toBe('tok-renovado');
+    expect(auth.user()).toBe(antes);
+  });
+
+  it('applyRenewedToken con la sesión caída no resucita nada', () => {
+    const auth = injected();
+    auth.applyRenewedToken('tok-fantasma');
+    expect(auth.isAuthenticated()).toBe(false);
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBeNull();
+  });
+
+  // ── R2.9 · la tabla de §4.5, fila por fila ───────────────────────────────
+
+  describe('applyAuthCode — la tabla de §4.5', () => {
+    it('AUTH_REQUIRED ⇒ limpia sesión', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('AUTH_REQUIRED');
+      expect(auth.isAuthenticated()).toBe(false);
+      expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBeNull();
+    });
+
+    it('AUTH_INVALID ⇒ limpia sesión', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('AUTH_INVALID');
+      expect(auth.isAuthenticated()).toBe(false);
+      expect(sessionStorage.getItem(SESSION_USER_KEY)).toBeNull();
+    });
+
+    it('AUTH_EXPIRED ⇒ guarda la ruta previa ANTES de limpiar', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('AUTH_EXPIRED');
+      expect(auth.isAuthenticated()).toBe(false);
+      // La ruta previa se conserva para volver tras el relogin.
+      expect(typeof auth.returnUrl()).toBe('string');
+      expect(auth.returnUrl()).not.toBe('');
+    });
+
+    it('FORBIDDEN ⇒ NO cierra sesión', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('FORBIDDEN');
+      expect(auth.isAuthenticated()).toBe(true);
+      expect(auth.token()).toBe('tok-semilla');
+      expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBe('tok-semilla');
+    });
+
+    it('RATE_LIMITED ⇒ NO cierra sesión (lo espera el formulario)', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('RATE_LIMITED');
+      expect(auth.isAuthenticated()).toBe(true);
+    });
+
+    it('un código desconocido no toca nada', () => {
+      seed();
+      const auth = injected();
+      auth.applyAuthCode('VALIDATION_ERROR');
+      auth.applyAuthCode(undefined);
+      expect(auth.isAuthenticated()).toBe(true);
+    });
+  });
+
+  // ── hasRole (R2.10, mínima) ──────────────────────────────────────────────
+
+  describe('hasRole — mínimo del vocabulario §4.4', () => {
+    it('admin cubre cualquier rol pedido', () => {
+      seed();
+      const auth = injected();
+      expect(auth.hasRole('admin')).toBe(true);
+      expect(auth.hasRole('staff')).toBe(true);
+      expect(auth.hasRole('session')).toBe(true);
+      expect(auth.hasRole('')).toBe(true);
+    });
+
+    it('sin sesión no cubre nada que no sea «público»', () => {
+      const auth = injected();
+      expect(auth.hasRole('admin')).toBe(false);
+      expect(auth.hasRole('session')).toBe(false);
+      expect(auth.hasRole('')).toBe(false);
+    });
+  });
+
+  // ── canAccess — §5.3 / §4.4 ─────────────────────────────────────────────
+
+  describe('canAccess — visibilidad de recurso (§5.3)', () => {
+    it('sin declaración y con sesión ⇒ se ve', () => {
+      seed();
+      expect(injected().canAccess(undefined)).toBe(true);
+    });
+
+    it('sin declaración y sin sesión ⇒ NO se ve', () => {
+      expect(injected().canAccess(undefined)).toBe(false);
+    });
+
+    it('`requires: public` se ve sin sesión', () => {
+      expect(injected().canAccess({ requires: 'public' })).toBe(true);
+    });
+
+    it('un `admin` cumple cualquier `roles` (rango más alto de §4.4)', () => {
+      seed();
+      const auth = injected();
+      expect(auth.canAccess({ roles: ['soporte'] })).toBe(true);
+      expect(auth.canAccess({ requires: 'role:soporte' })).toBe(true);
+    });
+
+    it('una sesión menor NO cumple un rol que no tiene', () => {
+      sessionStorage.setItem(SESSION_TOKEN_KEY, 'tok');
+      sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify({ id: 'u_2', role: 'staff' }));
+      const auth = injected();
+      expect(auth.canAccess({ roles: ['admin'] })).toBe(false);
+      expect(auth.canAccess({ requires: 'role:admin' })).toBe(false);
+      expect(auth.canAccess({ roles: ['staff'] })).toBe(true);
+      expect(auth.canAccess({ requires: 'session' })).toBe(true);
+    });
+
+    it('una sesión menor NO ve un recurso `public`… sí: `public` no pide nada', () => {
+      expect(injected().canAccess({ requires: 'public' })).toBe(true);
+    });
+  });
+
+  // ── R7.5 · políticas en UI (F10) ──────────────────────────────────────────────
+
+  describe('canDoOperation — políticas por operación (R7.5)', () => {
+    const schemaWithPolicies: ResourceSchema = {
+      id: 'test',
+      label: 'Test',
+      labelPlural: 'Tests',
+      kind: 'collection',
+      keyField: 'id',
+      titleField: 'name',
+      listColumns: [],
+      fields: [],
+      endpoint: {},
+      policies: {
+        access: {
+          read: 'role:staff',
+          write: 'role:admin',
+          operations: {
+            // Override más estricto que el umbral del grupo (read: role:staff) —
+            // el back lo admite; staff lista, pero no hace get: demuestra precedencia.
+            get: 'role:admin',
+          },
+        },
+      },
+    };
+
+    const schemaWithPermissions: ResourceSchema = {
+      id: 'test',
+      label: 'test',
+      labelPlural: 'tests',
+      kind: 'collection',
+      keyField: 'id',
+      titleField: 'name',
+      listColumns: [],
+      fields: [],
+      endpoint: {},
+      permissions: {
+        create: false,
+        update: true,
+        remove: false,
+      },
+    };
+
+    it('con policies y override de operación, usa el override', () => {
+      seed();
+      // admin cumple el override más estricto (get: role:admin)
+      expect(injected().canDoOperation(schemaWithPolicies, 'get')).toBe(true);
+    });
+
+    it('override más estricto que el umbral: staff lista pero no hace get', () => {
+      sessionStorage.setItem(SESSION_TOKEN_KEY, 'tok');
+      sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify({ id: 'u_2', role: 'staff' }));
+      const auth = injected();
+      expect(auth.canDoOperation(schemaWithPolicies, 'list')).toBe(true); // umbral read: role:staff
+      expect(auth.canDoOperation(schemaWithPolicies, 'get')).toBe(false); // override: role:admin
+    });
+
+    it('con policies sin override, usa el umbral del grupo', () => {
+      seed();
+      const auth = injected();
+      // admin puede crear (write: admin)
+      expect(auth.canDoOperation(schemaWithPolicies, 'create')).toBe(true);
+    });
+
+    it('con policies y staff: puede leer pero no escribir', () => {
+      sessionStorage.setItem(SESSION_TOKEN_KEY, 'tok');
+      sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify({ id: 'u_2', role: 'staff' }));
+      const auth = injected();
+      expect(auth.canDoOperation(schemaWithPolicies, 'list')).toBe(true);
+      expect(auth.canDoOperation(schemaWithPolicies, 'create')).toBe(false);
+    });
+
+    it('sin policies, fallback a permissions (legacy)', () => {
+      seed();
+      const auth = injected();
+      expect(auth.canDoOperation(schemaWithPermissions, 'create')).toBe(false);
+      expect(auth.canDoOperation(schemaWithPermissions, 'update')).toBe(true);
+      expect(auth.canDoOperation(schemaWithPermissions, 'remove')).toBe(false);
+    });
+
+    it('sin policies ni permissions: UX optimista legacy (§5.3), el back decide', () => {
+      seed();
+      const auth = injected();
+      const bareSchema: ResourceSchema = {
+        id: 'test',
+        label: 'test',
+        labelPlural: 'tests',
+        kind: 'collection',
+        keyField: 'id',
+        titleField: 'name',
+        listColumns: [],
+        fields: [],
+        endpoint: {},
+      };
+      expect(auth.canDoOperation(bareSchema, 'create')).toBe(true);
+    });
+
+    it('sin sesión, fail-closed', () => {
+      const auth = injected();
+      expect(auth.canDoOperation(schemaWithPolicies, 'list')).toBe(false);
+    });
+  });
+
+  describe('canReadField / canWriteField — políticas por campo (R7.5)', () => {
+    const fieldWithAccess: FieldSchema = {
+      key: 'secret',
+      label: 'Secreto',
+      type: 'text',
+      access: {
+        read: 'role:admin',
+        write: 'role:admin',
+      },
+    };
+
+    const fieldWithoutAccess: FieldSchema = {
+      key: 'public',
+      label: 'Público',
+      type: 'text',
+    };
+
+    it('campo sin access ⇒ siempre visible y editable', () => {
+      seed();
+      const auth = injected();
+      expect(auth.canReadField(fieldWithoutAccess)).toBe(true);
+      expect(auth.canWriteField(fieldWithoutAccess)).toBe(true);
+    });
+
+    it('campo con access: admin lo ve y edita', () => {
+      seed();
+      const auth = injected();
+      expect(auth.canReadField(fieldWithAccess)).toBe(true);
+      expect(auth.canWriteField(fieldWithAccess)).toBe(true);
+    });
+
+    it('campo con access: staff NO lo ve ni edita', () => {
+      sessionStorage.setItem(SESSION_TOKEN_KEY, 'tok');
+      sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify({ id: 'u_2', role: 'staff' }));
+      const auth = injected();
+      expect(auth.canReadField(fieldWithAccess)).toBe(false);
+      expect(auth.canWriteField(fieldWithAccess)).toBe(false);
+    });
+
+    it('campo con access: sin sesión ⇒ fail-closed', () => {
+      const auth = injected();
+      expect(auth.canReadField(fieldWithAccess)).toBe(false);
+      expect(auth.canWriteField(fieldWithAccess)).toBe(false);
+    });
+  });
+
+  // ── Firebase methods ─────────────────────────────────────────────────────
+
+  describe('Firebase methods', () => {
+    function injectedWithAdapter(adapter?: FirebaseAuthAdapter): AuthService {
+      TestBed.resetTestingModule();
+      TestBed.configureTestingModule({
+        providers: [
+          provideHttpClient(),
+          provideHttpClientTesting(),
+          provideRouter([]),
+          { provide: API_URL, useValue: '/api' },
+          ...(adapter ? [{ provide: FIREBASE_AUTH_ADAPTER, useValue: adapter }] : []),
+        ],
+      });
+      http = TestBed.inject(HttpTestingController);
+      return TestBed.inject(AuthService);
+    }
+
+    it('loginWithGoogle() sin adapter falla con mensaje claro [gas-admin-ui]', () => {
+      const auth = injectedWithAdapter();
+      let error: Error | undefined;
+      auth.loginWithGoogle().subscribe({
+        error: (err: Error) => {
+          error = err;
+        },
+      });
+      expect(error?.message).toContain('[gas-admin-ui] FIREBASE_AUTH_ADAPTER is not provided.');
+    });
+
+    it('loginWithGoogle() con adapter pide token y canjea con /auth/firebase', async () => {
+      const mockAdapter: FirebaseAuthAdapter = {
+        signInWithGoogle: vi.fn().mockResolvedValue('fake-google-id-token'),
+        signInWithEmailAndPassword: vi.fn(),
+        signOut: vi.fn(),
+      };
+      const auth = injectedWithAdapter(mockAdapter);
+
+      let userResult: unknown;
+      auth.loginWithGoogle().subscribe((u) => {
+        userResult = u;
+      });
+
+      await Promise.resolve();
+
+      const req = http.expectOne('/api');
+      expect(req.request.method).toBe('POST');
+      expect(req.request.body).toEqual({
+        token: null,
+        method: 'POST',
+        path: '/auth/firebase',
+        payload: { idToken: 'fake-google-id-token' },
+      });
+
+      req.flush({
+        token: 'app-jwt-token',
+        user: { id: 'u_fb', email: 'user@google.com', role: 'admin' },
+      });
+
+      expect(mockAdapter.signInWithGoogle).toHaveBeenCalled();
+      expect(auth.isAuthenticated()).toBe(true);
+      expect(auth.token()).toBe('app-jwt-token');
+      expect(auth.user()?.email).toBe('user@google.com');
+      expect(userResult).toEqual({ id: 'u_fb', email: 'user@google.com', role: 'admin' });
+    });
+
+    it('loginWithFirebasePassword() con adapter autentica y canjea con /auth/firebase', async () => {
+      const mockAdapter: FirebaseAuthAdapter = {
+        signInWithGoogle: vi.fn(),
+        signInWithEmailAndPassword: vi.fn().mockResolvedValue('fake-pw-id-token'),
+        signOut: vi.fn(),
+      };
+      const auth = injectedWithAdapter(mockAdapter);
+
+      let userResult: unknown;
+      auth.loginWithFirebasePassword('ana@test.com', 'secret123').subscribe((u) => {
+        userResult = u;
+      });
+
+      await Promise.resolve();
+
+      const req = http.expectOne('/api');
+      expect(req.request.body.payload).toEqual({ idToken: 'fake-pw-id-token' });
+
+      req.flush({
+        token: 'app-jwt-pw',
+        user: { id: 'u_pw', email: 'ana@test.com', role: 'staff' },
+      });
+
+      expect(mockAdapter.signInWithEmailAndPassword).toHaveBeenCalledWith(
+        'ana@test.com',
+        'secret123',
+      );
+      expect(auth.isAuthenticated()).toBe(true);
+      expect(auth.token()).toBe('app-jwt-pw');
+    });
+
+    it('logout() con adapter llama a signOut() best-effort incluso si la API falla', () => {
+      seed();
+      const mockAdapter: FirebaseAuthAdapter = {
+        signInWithGoogle: vi.fn(),
+        signInWithEmailAndPassword: vi.fn(),
+        signOut: vi.fn().mockResolvedValue(undefined),
+      };
+      const auth = injectedWithAdapter(mockAdapter);
+
+      auth.logout().subscribe({ error: () => undefined });
+
+      const req = http.expectOne('/api');
+      req.error(new ProgressEvent('Network error'));
+
+      expect(mockAdapter.signOut).toHaveBeenCalled();
+      expect(auth.isAuthenticated()).toBe(false);
+      expect(auth.token()).toBeNull();
+    });
+  });
+});
+
+describe('AuthService — REST driver', () => {
+  let http: HttpTestingController;
+
+  function seed(token = 'tok-semilla', user: unknown = { id: 'u_1', role: 'admin' }) {
+    sessionStorage.setItem(SESSION_TOKEN_KEY, token);
+    if (user !== null) sessionStorage.setItem(SESSION_USER_KEY, JSON.stringify(user));
+  }
+
+  function injectedRest(adapter?: FirebaseAuthAdapter): AuthService {
+    TestBed.configureTestingModule({
+      providers: [
+        provideHttpClient(),
+        provideHttpClientTesting(),
+        provideRouter([]),
+        { provide: API_URL, useValue: '/api' },
+        { provide: API_DRIVER, useValue: 'rest' },
+        ...(adapter ? [{ provide: FIREBASE_AUTH_ADAPTER, useValue: adapter }] : []),
+      ],
+    });
+    http = TestBed.inject(HttpTestingController);
+    return TestBed.inject(AuthService);
+  }
+
+  beforeEach(() => sessionStorage.clear());
+  afterEach(() => {
+    http?.verify();
+    sessionStorage.clear();
+    localStorage.clear();
+  });
+
+  it('login() pide POST /api/auth/login con JSON plano y Content-Type application/json', () => {
+    const auth = injectedRest();
+    auth.login('ana@x.com', 'secreta').subscribe();
+
+    const req = http.expectOne('/api/auth/login');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.headers.get('Content-Type')).toBe('application/json');
+    expect(req.request.body).toEqual({ email: 'ana@x.com', password: 'secreta' });
+
+    req.flush({ token: 'tok-rest-nuevo', user: { id: 'u_1', role: 'admin', active: true } });
+
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.token()).toBe('tok-rest-nuevo');
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBe('tok-rest-nuevo');
+    expect(sessionStorage.getItem(SESSION_USER_KEY)).toContain('u_1');
+  });
+
+  it('restore() con token ejecuta GET /api/auth/me con cabecera Authorization: Bearer', () => {
+    seed('tok-rest-me', null);
+    const auth = injectedRest();
+    auth.restore().subscribe();
+
+    const req = http.expectOne('/api/auth/me');
+    expect(req.request.method).toBe('GET');
+    expect(req.request.headers.get('Authorization')).toBe('Bearer tok-rest-me');
+    req.flush({ user: { id: 'u_1', role: 'admin', active: true } });
+
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.role()).toBe('admin');
+  });
+
+  it('restore() sin token no realiza ninguna llamada HTTP', () => {
+    const auth = injectedRest();
+    auth.restore().subscribe();
+    http.expectNone('/api/auth/me');
+    expect(auth.isAuthenticated()).toBe(false);
+  });
+
+  it('loginWithGoogle() con adapter canjea token en /api/auth/firebase sin envelope', async () => {
+    const mockAdapter: FirebaseAuthAdapter = {
+      signInWithGoogle: vi.fn().mockResolvedValue('fake-google-id-token'),
+      signInWithEmailAndPassword: vi.fn(),
+      signOut: vi.fn(),
+    };
+    const auth = injectedRest(mockAdapter);
+
+    let userResult: unknown;
+    auth.loginWithGoogle().subscribe((u) => {
+      userResult = u;
+    });
+
+    await Promise.resolve();
+
+    const req = http.expectOne('/api/auth/firebase');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.headers.get('Content-Type')).toBe('application/json');
+    expect(req.request.body).toEqual({ idToken: 'fake-google-id-token' });
+
+    req.flush({
+      token: 'app-jwt-token',
+      user: { id: 'u_fb', email: 'user@google.com', role: 'admin' },
+    });
+
+    expect(mockAdapter.signInWithGoogle).toHaveBeenCalled();
+    expect(auth.isAuthenticated()).toBe(true);
+    expect(auth.token()).toBe('app-jwt-token');
+    expect(userResult).toEqual({ id: 'u_fb', email: 'user@google.com', role: 'admin' });
+  });
+
+  it('logout() ejecuta POST /api/auth/logout con cabecera Authorization: Bearer', () => {
+    seed('tok-logout');
+    const auth = injectedRest();
+    auth.logout().subscribe();
+
+    const req = http.expectOne('/api/auth/logout');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.headers.get('Authorization')).toBe('Bearer tok-logout');
+    req.flush({ loggedOut: true });
+
+    expect(auth.isAuthenticated()).toBe(false);
+    expect(sessionStorage.getItem(SESSION_TOKEN_KEY)).toBeNull();
+  });
+});
+