create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/middleware/__tests__/auth.optional-cookie.test.ts

@@ -1,140 +0,0 @@
-/**
- * @file auth.optional-cookie.test.ts
- *
- * The non-rejecting cookie resolver `resolveOptionalCookieUser` (#6866 D2).
- *
- * Asserts each `none` reason (A1–A6), a `user` for a valid same-origin cookie
- * (A7), and that the resolver never writes a reply and never throws.
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; mirrors auth.cookie-path.test.ts
-jest.mock("../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: { findUnique: jest.fn(), update: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../lib/prisma.js";
-import { resolveOptionalCookieUser } from "../auth.js";
-
-const FRONTEND = "https://app.example.com";
-const COOKIE = "better-auth.session_token=sess_tok_abc.signature";
-
-/** Echoes the resolver's result; the reply is only ever written here. */
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.post("/resolve", async (req) =>
-    resolveOptionalCookieUser(req, { trustedOrigins: [FRONTEND] }),
-  );
-  return app;
-}
-
-function validSession(overrides: Record<string, unknown> = {}) {
-  return {
-    id: "ses_1",
-    userId: "usr_buyer",
-    expiresAt: new Date(Date.now() + 60_000),
-    activeOrganizationId: null,
-    activeWorkspaceId: null,
-    ...overrides,
-  };
-}
-
-describe("resolveOptionalCookieUser (#6866 D2)", () => {
-  const originalDatabaseUrl = process.env.DATABASE_URL;
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = originalDatabaseUrl;
-  });
-
-  async function resolve(headers: Record<string, string>) {
-    const res = await app.inject({ method: "POST", url: "/resolve", headers });
-    // The route's own handler wrote the only reply — the resolver wrote none.
-    expect(res.statusCode).toBe(200);
-    return JSON.parse(res.body) as unknown;
-  }
-
-  it("A1: no cookie → none/no_cookie, with no database read", async () => {
-    expect(await resolve({ origin: FRONTEND })).toEqual({
-      kind: "none",
-      reason: "no_cookie",
-    });
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("A1b: a bearer header alone is ignored — none/no_cookie, apiToken never read (F8)", async () => {
-    expect(
-      await resolve({ origin: FRONTEND, authorization: "Bearer tok_valid" }),
-    ).toEqual({ kind: "none", reason: "no_cookie" });
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("A2: DATABASE_URL unset with a cookie → none/no_database", async () => {
-    delete process.env.DATABASE_URL;
-    expect(await resolve({ origin: FRONTEND, cookie: COOKIE })).toEqual({
-      kind: "none",
-      reason: "no_database",
-    });
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("A3: unknown token → none/unknown_session", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(null);
-    expect(await resolve({ origin: FRONTEND, cookie: COOKIE })).toEqual({
-      kind: "none",
-      reason: "unknown_session",
-    });
-  });
-
-  it("A4: expired session → none/expired", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(
-      validSession({ expiresAt: new Date(Date.now() - 1_000) }),
-    );
-    expect(await resolve({ origin: FRONTEND, cookie: COOKIE })).toEqual({
-      kind: "none",
-      reason: "expired",
-    });
-  });
-
-  it("A5: POST with a foreign Origin → none/cross_origin", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(validSession());
-    expect(
-      await resolve({ origin: "https://evil.example.com", cookie: COOKIE }),
-    ).toEqual({ kind: "none", reason: "cross_origin" });
-  });
-
-  it("A6: the session lookup rejects → none/lookup_failed, never a throw", async () => {
-    (prisma.session.findUnique as jest.Mock).mockRejectedValue(
-      new Error("db down"),
-    );
-    expect(await resolve({ origin: FRONTEND, cookie: COOKIE })).toEqual({
-      kind: "none",
-      reason: "lookup_failed",
-    });
-  });
-
-  it("A7: a valid same-origin cookie → user, looked up by the unsigned token", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(validSession());
-    expect(await resolve({ origin: FRONTEND, cookie: COOKIE })).toEqual({
-      kind: "user",
-      userId: "usr_buyer",
-    });
-    expect(prisma.session.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { token: "sess_tok_abc" } }),
-    );
-  });
-});