@workos-inc/authkit-nextjs 2.12.2 → 2.14.0

package/src/session.spec.ts

@@ -10,12 +10,15 @@ import { jwtVerify } from 'jose';
 import { sealData } from 'iron-session';
 import { User } from '@workos-inc/node';
 
-jest.mock('jose', () => ({
-  jwtVerify: jest.fn(),
-  createRemoteJWKSet: jest.fn(),
-  SignJWT: jest.requireActual('jose').SignJWT,
-  decodeJwt: jest.requireActual('jose').decodeJwt,
-}));
+vi.mock('jose', async () => {
+  const actual = await vi.importActual<typeof import('jose')>('jose');
+  return {
+    jwtVerify: vi.fn(),
+    createRemoteJWKSet: vi.fn(),
+    SignJWT: actual.SignJWT,
+    decodeJwt: actual.decodeJwt,
+  };
+});
 
 // logging is disabled by default, flip this to true to still have logs in the console
 const DEBUG = false;
@@ -47,11 +50,11 @@ describe('session.ts', () => {
     } as User,
   };
 
-  let consoleLogSpy: jest.SpyInstance;
+  let consoleLogSpy: MockInstance;
 
   beforeEach(async () => {
     // Clear all mocks between tests
-    jest.clearAllMocks();
+    vi.clearAllMocks();
 
     // Reset the cookie store
     const nextCookies = await cookies();
@@ -63,9 +66,9 @@ describe('session.ts', () => {
     nextHeaders._reset();
     nextHeaders.set('x-workos-middleware', 'true');
 
-    (jwtVerify as jest.Mock).mockReset();
+    (jwtVerify as Mock).mockReset();
 
-    consoleLogSpy = jest.spyOn(console, 'log').mockImplementation((...args) => {
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation((...args) => {
       if (DEBUG) {
         console.info(...args);
       }
@@ -74,7 +77,7 @@ describe('session.ts', () => {
 
   afterEach(() => {
     consoleLogSpy.mockRestore();
-    jest.resetModules();
+    vi.resetModules();
   });
 
   describe('withAuth', () => {
@@ -159,7 +162,7 @@ describe('session.ts', () => {
     it('should throw an error if the redirect URI is not set', async () => {
       const originalWorkosRedirectUri = envVariables.WORKOS_REDIRECT_URI;
 
-      jest.replaceProperty(envVariables, 'WORKOS_REDIRECT_URI', '');
+      Object.defineProperty(envVariables, 'WORKOS_REDIRECT_URI', { value: '', configurable: true });
 
       await expect(async () => {
         await updateSessionMiddleware(
@@ -174,13 +177,16 @@ describe('session.ts', () => {
         );
       }).rejects.toThrow('You must provide a redirect URI in the AuthKit middleware or in the environment variables.');
 
-      jest.replaceProperty(envVariables, 'WORKOS_REDIRECT_URI', originalWorkosRedirectUri);
+      Object.defineProperty(envVariables, 'WORKOS_REDIRECT_URI', {
+        value: originalWorkosRedirectUri,
+        configurable: true,
+      });
     });
 
     it('should throw an error if the cookie password is not set', async () => {
       const originalWorkosCookiePassword = envVariables.WORKOS_COOKIE_PASSWORD;
 
-      jest.replaceProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', '');
+      Object.defineProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', { value: '', configurable: true });
 
       await expect(async () => {
         await updateSessionMiddleware(
@@ -197,13 +203,16 @@ describe('session.ts', () => {
         'You must provide a valid cookie password that is at least 32 characters in the environment variables.',
       );
 
-      jest.replaceProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', originalWorkosCookiePassword);
+      Object.defineProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', {
+        value: originalWorkosCookiePassword,
+        configurable: true,
+      });
     });
 
     it('should throw an error if the cookie password is less than 32 characters', async () => {
       const originalWorkosCookiePassword = envVariables.WORKOS_COOKIE_PASSWORD;
 
-      jest.replaceProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', 'short');
+      Object.defineProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', { value: 'short', configurable: true });
 
       await expect(async () => {
         await updateSessionMiddleware(
@@ -220,7 +229,10 @@ describe('session.ts', () => {
         'You must provide a valid cookie password that is at least 32 characters in the environment variables.',
       );
 
-      jest.replaceProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', originalWorkosCookiePassword);
+      Object.defineProperty(envVariables, 'WORKOS_COOKIE_PASSWORD', {
+        value: originalWorkosCookiePassword,
+        configurable: true,
+      });
     });
 
     it('should return early if there is no session', async () => {
@@ -241,7 +253,7 @@ describe('session.ts', () => {
     });
 
     it('should return 200 if the session is valid', async () => {
-      jest.spyOn(console, 'log').mockImplementation(() => {});
+      vi.spyOn(console, 'log').mockImplementation(() => {});
 
       const nextCookies = await cookies();
       nextCookies.set(
@@ -249,7 +261,7 @@ describe('session.ts', () => {
         await sealData(mockSession, { password: process.env.WORKOS_COOKIE_PASSWORD as string }),
       );
 
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         return true;
       });
 
@@ -272,11 +284,11 @@ describe('session.ts', () => {
     it('should attempt to refresh the session when the access token is invalid', async () => {
       mockSession.accessToken = await generateTestToken({}, true);
 
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
         accessToken: await generateTestToken(),
         refreshToken: 'new-refresh-token',
         user: mockSession.user,
@@ -308,17 +320,15 @@ describe('session.ts', () => {
     });
 
     it('should delete the cookie when refreshing fails', async () => {
-      jest.spyOn(console, 'log').mockImplementation(() => {});
+      vi.spyOn(console, 'log').mockImplementation(() => {});
 
       mockSession.accessToken = await generateTestToken({}, true);
 
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
-      jest
-        .spyOn(workos.userManagement, 'authenticateWithRefreshToken')
-        .mockRejectedValue(new Error('Failed to refresh'));
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('Failed to refresh'));
 
       const request = new NextRequest(new URL('http://example.com'));
 
@@ -354,7 +364,7 @@ describe('session.ts', () => {
 
     describe('middleware auth', () => {
       it('should redirect unauthenticated users on protected routes', async () => {
-        jest.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'log').mockImplementation(() => {});
 
         const request = new NextRequest(new URL('http://example.com/protected'));
         const result = await updateSessionMiddleware(
@@ -374,10 +384,7 @@ describe('session.ts', () => {
         );
       });
 
-      it('should use Response if NextResponse.redirect is not available', async () => {
-        const originalRedirect = NextResponse.redirect;
-        (NextResponse as Partial<typeof NextResponse>).redirect = undefined;
-
+      it('should return a redirect response when middlewareAuth is enabled and user is not authenticated', async () => {
         const request = new NextRequest(new URL('http://example.com/protected'));
         const result = await updateSessionMiddleware(
           request,
@@ -390,10 +397,9 @@ describe('session.ts', () => {
           [],
         );
 
-        expect(result).toBeInstanceOf(Response);
-
-        // Restore the original redirect method
-        (NextResponse as Partial<typeof NextResponse>).redirect = originalRedirect;
+        expect(result).toBeInstanceOf(NextResponse);
+        expect(result.status).toBe(307);
+        expect(result.headers.get('Location')).toContain('workos.com');
       });
 
       it('should automatically add the redirect URI to unauthenticatedPaths when middleware is enabled', async () => {
@@ -429,7 +435,7 @@ describe('session.ts', () => {
         expect(result.headers.get('Location')).toContain('screen_hint=sign-up');
       });
 
-      it('should set the sign up paths in the headers', async () => {
+      it('should not leak sign-up paths header to the browser', async () => {
         const request = new NextRequest(new URL('http://example.com/protected-signup'));
         const result = await updateSessionMiddleware(
           request,
@@ -442,7 +448,8 @@ describe('session.ts', () => {
           ['/protected-signup'],
         );
 
-        expect(result.headers.get('x-sign-up-paths')).toBe('/protected-signup');
+        // x-sign-up-paths is an internal header that should not leak to the browser
+        expect(result.headers.get('x-sign-up-paths')).toBeNull();
       });
 
       it('should allow logged out users on unauthenticated paths', async () => {
@@ -479,11 +486,11 @@ describe('session.ts', () => {
 
       it('should throw an error if the provided regex is invalid and a non-Error object is thrown', async () => {
         // Reset modules to ensure clean import state
-        jest.resetModules();
+        vi.resetModules();
 
         // Import first, then spy
         const pathToRegexp = await import('path-to-regexp');
-        const parseSpy = jest.spyOn(pathToRegexp, 'parse').mockImplementation(() => {
+        const parseSpy = vi.spyOn(pathToRegexp, 'parse').mockImplementation(() => {
           throw 'invalid regex';
         });
 
@@ -507,6 +514,9 @@ describe('session.ts', () => {
 
         // Verify the mock was called
         expect(parseSpy).toHaveBeenCalled();
+
+        // Restore the spy to prevent leaking to subsequent tests
+        parseSpy.mockRestore();
       });
 
       it('should default to the WORKOS_REDIRECT_URI environment variable if no redirect URI is provided', async () => {
@@ -526,17 +536,17 @@ describe('session.ts', () => {
       });
 
       it('should delete the cookie and redirect when refreshing fails', async () => {
-        jest.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'log').mockImplementation(() => {});
 
         mockSession.accessToken = await generateTestToken({}, true);
 
-        (jwtVerify as jest.Mock).mockImplementation(() => {
+        (jwtVerify as Mock).mockImplementation(() => {
           throw new Error('Invalid token');
         });
 
-        jest
-          .spyOn(workos.userManagement, 'authenticateWithRefreshToken')
-          .mockRejectedValue(new Error('Failed to refresh'));
+        vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(
+          new Error('Failed to refresh'),
+        );
 
         const request = new NextRequest(new URL('http://example.com'));
 
@@ -637,12 +647,12 @@ describe('session.ts', () => {
       mockSession.accessToken = await generateTestToken({}, true);
 
       // Mock token verification to fail
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
       // Mock successful refresh
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
         accessToken: await generateTestToken(),
         refreshToken: 'new-refresh-token',
         user: mockSession.user,
@@ -670,12 +680,12 @@ describe('session.ts', () => {
       mockSession.accessToken = await generateTestToken({}, true);
 
       // Mock token verification to fail
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
       // Mock refresh failure
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('Refresh failed'));
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('Refresh failed'));
 
       const request = new NextRequest(new URL('http://example.com/protected'));
       request.cookies.set(
@@ -697,15 +707,15 @@ describe('session.ts', () => {
       mockSession.accessToken = await generateTestToken({}, true);
 
       // Mock token verification to fail
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
       const newAccessToken = await generateTestToken();
-      const mockSuccessCallback = jest.fn();
+      const mockSuccessCallback = vi.fn();
 
       // Mock successful refresh
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
         accessToken: newAccessToken,
         refreshToken: 'new-refresh-token',
         user: mockSession.user,
@@ -736,15 +746,15 @@ describe('session.ts', () => {
       mockSession.accessToken = await generateTestToken({}, true);
 
       // Mock token verification to fail
-      (jwtVerify as jest.Mock).mockImplementation(() => {
+      (jwtVerify as Mock).mockImplementation(() => {
         throw new Error('Invalid token');
       });
 
       const mockError = new Error('Refresh failed');
-      const mockErrorCallback = jest.fn();
+      const mockErrorCallback = vi.fn();
 
       // Mock refresh failure
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(mockError);
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(mockError);
 
       const request = new NextRequest(new URL('http://example.com/protected'));
       request.cookies.set(
@@ -767,15 +777,15 @@ describe('session.ts', () => {
 
   describe('refreshSession', () => {
     it('should refresh session successfully', async () => {
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
         accessToken: await generateTestToken(),
         refreshToken: 'new-refresh-token',
         user: mockSession.user,
       });
 
-      jest
-        .spyOn(workos.userManagement, 'getJwksUrl')
-        .mockReturnValue('https://api.workos.com/sso/jwks/client_1234567890');
+      vi.spyOn(workos.userManagement, 'getJwksUrl').mockReturnValue(
+        'https://api.workos.com/sso/jwks/client_1234567890',
+      );
 
       const nextCookies = await cookies();
       nextCookies.set(
@@ -811,15 +821,15 @@ describe('session.ts', () => {
         await sealData(mockSession, { password: process.env.WORKOS_COOKIE_PASSWORD as string }),
       );
 
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
         accessToken: await generateTestToken({ org_id: 'org_456' }),
         refreshToken: 'new-refresh-token',
         user: mockSession.user,
       });
 
-      jest
-        .spyOn(workos.userManagement, 'getJwksUrl')
-        .mockReturnValue('https://api.workos.com/sso/jwks/client_1234567890');
+      vi.spyOn(workos.userManagement, 'getJwksUrl').mockReturnValue(
+        'https://api.workos.com/sso/jwks/client_1234567890',
+      );
 
       const result = await refreshSession({ organizationId: 'org_456' });
 
@@ -838,8 +848,8 @@ describe('session.ts', () => {
         'wos-session',
         await sealData(mockSessionWithValidJWT, { password: process.env.WORKOS_COOKIE_PASSWORD as string }),
       );
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue('fail');
-      expect(refreshSession({ ensureSignedIn: false })).rejects.toThrow('Failed to refresh session: fail');
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue('fail');
+      await expect(refreshSession({ ensureSignedIn: false })).rejects.toThrow('Failed to refresh session: fail');
     });
 
     it('throws if authenticateWithRefreshToken fails with error', async () => {
@@ -853,7 +863,7 @@ describe('session.ts', () => {
         'wos-session',
         await sealData(mockSessionWithValidJWT, { password: process.env.WORKOS_COOKIE_PASSWORD as string }),
       );
-      jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('error'));
+      vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('error'));
       await expect(refreshSession()).rejects.toThrow('Failed to refresh session: error');
     });
   });
@@ -863,7 +873,7 @@ describe('session.ts', () => {
       const nextCookies = await cookies();
       // @ts-expect-error - _reset is part of the mock
       nextCookies._reset();
-      jest.clearAllMocks();
+      vi.clearAllMocks();
     });
 
     it('should return all token claims when accessToken is provided', async () => {
@@ -957,7 +967,7 @@ describe('session.ts', () => {
 
   describe('eager auth functionality', () => {
     beforeEach(() => {
-      jest.clearAllMocks();
+      vi.clearAllMocks();
     });
 
     describe('isInitialDocumentRequest', () => {
@@ -1051,12 +1061,12 @@ describe('session.ts', () => {
         // Setup invalid session that needs refresh
         mockSession.accessToken = await generateTestToken({}, true);
 
-        (jwtVerify as jest.Mock).mockImplementation(() => {
+        (jwtVerify as Mock).mockImplementation(() => {
           throw new Error('Invalid token');
         });
 
         const newAccessToken = await generateTestToken();
-        jest.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
+        vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockResolvedValue({
           accessToken: newAccessToken,
           refreshToken: 'new-refresh-token',
           user: mockSession.user,
@@ -1082,13 +1092,11 @@ describe('session.ts', () => {
         // Setup invalid session
         mockSession.accessToken = await generateTestToken({}, true);
 
-        (jwtVerify as jest.Mock).mockImplementation(() => {
+        (jwtVerify as Mock).mockImplementation(() => {
           throw new Error('Invalid token');
         });
 
-        jest
-          .spyOn(workos.userManagement, 'authenticateWithRefreshToken')
-          .mockRejectedValue(new Error('Refresh failed'));
+        vi.spyOn(workos.userManagement, 'authenticateWithRefreshToken').mockRejectedValue(new Error('Refresh failed'));
 
         const request = new NextRequest(new URL('http://example.com/page'));
         request.headers.set('accept', 'text/html');

package/src/session.ts

@@ -4,9 +4,10 @@ import { sealData, unsealData } from 'iron-session';
 import { JWTPayload, createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
 import { cookies, headers } from 'next/headers';
 import { redirect } from 'next/navigation';
-import { NextRequest, NextResponse } from 'next/server';
+import { NextRequest } from 'next/server';
 import { getCookieOptions, getJwtCookie } from './cookie.js';
 import { WORKOS_CLIENT_ID, WORKOS_COOKIE_NAME, WORKOS_COOKIE_PASSWORD, WORKOS_REDIRECT_URI } from './env-variables.js';
+import { TokenRefreshError, getSessionErrorContext } from './errors.js';
 import { getAuthorizationUrl } from './get-authorization-url.js';
 import {
   AccessToken,
@@ -21,7 +22,8 @@ import { getWorkOS } from './workos.js';
 
 import type { AuthenticationResponse } from '@workos-inc/node';
 import { parse, tokensToRegexp } from 'path-to-regexp';
-import { lazy, redirectWithFallback, setCachePreventionHeaders } from './utils.js';
+import { handleAuthkitHeaders } from './middleware-helpers.js';
+import { lazy, setCachePreventionHeaders } from './utils.js';
 
 const sessionHeaderName = 'x-workos-session';
 const middlewareHeaderName = 'x-workos-middleware';
@@ -149,15 +151,6 @@ async function updateSessionMiddleware(
     eagerAuth,
   });
 
-  // If the user is logged out and this path isn't on the allowlist for logged out paths, redirect to AuthKit.
-  if (middlewareAuth.enabled && matchedPaths.length === 0 && !session.user) {
-    if (debug) {
-      console.log(`Unauthenticated user on protected route ${request.url}, redirecting to AuthKit`);
-    }
-
-    return redirectWithFallback(authorizationUrl as string, headers);
-  }
-
   // Record the sign up paths so we can use them later
   if (signUpPaths.length > 0) {
     headers.set(signUpPathsHeaderName, signUpPaths.join(','));
@@ -165,33 +158,16 @@ async function updateSessionMiddleware(
 
   applyCacheSecurityHeaders(headers, request, session);
 
-  // Create a new request with modified headers (for page handlers)
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.set(middlewareHeaderName, headers.get(middlewareHeaderName)!);
-  requestHeaders.set('x-url', headers.get('x-url')!);
-  if (headers.has('x-redirect-uri')) {
-    requestHeaders.set('x-redirect-uri', headers.get('x-redirect-uri')!);
-  }
-  if (headers.has(signUpPathsHeaderName)) {
-    requestHeaders.set(signUpPathsHeaderName, headers.get(signUpPathsHeaderName)!);
-  }
+  // If the user is logged out and this path isn't on the allowlist for logged out paths, redirect to AuthKit.
+  if (middlewareAuth.enabled && matchedPaths.length === 0 && !session.user) {
+    if (debug) {
+      console.log(`Unauthenticated user on protected route ${request.url}, redirecting to AuthKit`);
+    }
 
-  // Pass session to page handlers via request header
-  // This ensures handlers see refreshed sessions immediately (before Set-Cookie reaches browser)
-  const sessionHeader = headers.get(sessionHeaderName);
-  if (sessionHeader) {
-    requestHeaders.set(sessionHeaderName, sessionHeader);
+    return handleAuthkitHeaders(request, headers, { redirect: authorizationUrl as string });
   }
 
-  // Remove session header from response headers to prevent leakage
-  headers.delete(sessionHeaderName);
-
-  return NextResponse.next({
-    request: {
-      headers: requestHeaders,
-    },
-    headers,
-  });
+  return handleAuthkitHeaders(request, headers);
 }
 
 async function updateSession(
@@ -406,9 +382,11 @@ async function refreshSession({
       organizationId: nextOrganizationId ?? organizationIdFromAccessToken,
     });
   } catch (error) {
-    throw new Error(`Failed to refresh session: ${error instanceof Error ? error.message : String(error)}`, {
-      cause: error,
-    });
+    throw new TokenRefreshError(
+      `Failed to refresh session: ${error instanceof Error ? error.message : String(error)}`,
+      error,
+      getSessionErrorContext(session),
+    );
   }
 
   const headersList = await headers();

package/src/utils.spec.ts

@@ -3,23 +3,21 @@ import { redirectWithFallback, errorResponseWithFallback } from './utils.js';
 
 describe('utils', () => {
   afterEach(() => {
-    jest.resetModules();
+    vi.resetModules();
+    vi.restoreAllMocks();
   });
 
   describe('redirectWithFallback', () => {
     it('uses NextResponse.redirect when available', () => {
       const redirectUrl = 'https://example.com';
-      const mockRedirect = jest.fn().mockReturnValue('redirected');
-      const originalRedirect = NextResponse.redirect;
+      const mockRedirect = vi.fn().mockReturnValue('redirected');
 
-      NextResponse.redirect = mockRedirect;
+      vi.spyOn(NextResponse, 'redirect').mockImplementation(mockRedirect);
 
       const result = redirectWithFallback(redirectUrl);
 
       expect(mockRedirect).toHaveBeenCalledWith(redirectUrl, { headers: undefined });
       expect(result).toBe('redirected');
-
-      NextResponse.redirect = originalRedirect;
     });
 
     it('uses headers when provided', () => {
@@ -35,9 +33,9 @@ describe('utils', () => {
     it('falls back to standard Response when NextResponse exists but redirect is undefined', async () => {
       const redirectUrl = 'https://example.com';
 
-      jest.resetModules();
+      vi.resetModules();
 
-      jest.mock('next/server', () => ({
+      vi.doMock('next/server', () => ({
         NextResponse: {
           // exists but has no redirect method
         },
@@ -55,10 +53,10 @@ describe('utils', () => {
     it('falls back to standard Response when NextResponse is undefined', async () => {
       const redirectUrl = 'https://example.com';
 
-      jest.resetModules();
+      vi.resetModules();
 
       // Mock with undefined NextResponse
-      jest.mock('next/server', () => ({
+      vi.doMock('next/server', () => ({
         NextResponse: undefined,
       }));
 
@@ -81,8 +79,8 @@ describe('utils', () => {
     };
 
     it('uses NextResponse.json when available', () => {
-      const mockJson = jest.fn().mockReturnValue('error json response');
-      NextResponse.json = mockJson;
+      const mockJson = vi.fn().mockReturnValue('error json response');
+      vi.spyOn(NextResponse, 'json').mockImplementation(mockJson);
 
       const result = errorResponseWithFallback(errorBody);
 
@@ -90,25 +88,10 @@ describe('utils', () => {
       expect(result).toBe('error json response');
     });
 
-    it('falls back to standard Response when NextResponse is not available', () => {
-      const originalJson = NextResponse.json;
-
-      // @ts-expect-error - This is to test the fallback
-      delete NextResponse.json;
-
-      const result = errorResponseWithFallback(errorBody);
-
-      expect(result).toBeInstanceOf(Response);
-      expect(result.status).toBe(500);
-      expect(result.headers.get('Content-Type')).toBe('application/json');
-
-      NextResponse.json = originalJson;
-    });
-
     it('falls back to standard Response when NextResponse exists but json is undefined', async () => {
-      jest.resetModules();
+      vi.resetModules();
 
-      jest.mock('next/server', () => ({
+      vi.doMock('next/server', () => ({
         NextResponse: {
           // exists but has no json method
         },
@@ -124,9 +107,9 @@ describe('utils', () => {
     });
 
     it('falls back to standard Response when NextResponse is undefined', async () => {
-      jest.resetModules();
+      vi.resetModules();
 
-      jest.mock('next/server', () => ({
+      vi.doMock('next/server', () => ({
         NextResponse: undefined,
       }));
 

package/src/utils.ts

@@ -6,8 +6,6 @@ import { NextResponse } from 'next/server';
  */
 export function setCachePreventionHeaders(headers: Headers): void {
   headers.set('Cache-Control', 'private, no-cache, no-store, must-revalidate, max-age=0');
-  headers.set('Pragma', 'no-cache');
-  headers.set('Expires', '0');
   headers.set('x-middleware-cache', 'no-cache');
 }