create-wakii-stack 0.0.0-stage → 0.1.0

package/stack-template/app/shell/tests/login.test.tsx

@@ -0,0 +1,227 @@
+import { cleanup, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router';
+import { tokenStorage } from '@wakii/fe-shared';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { LoginPage } from '../src/pages/LoginPage';
+
+// SF-4 (VU-63): LoginPage đi qua wrapper refresh-client (auth trong src/api) — test
+// mock-fetch TẦNG fetch (timeoutFetch bind lazy nên vi.stubGlobal có hiệu lực),
+// response shape v2 {user, accessToken, refreshToken} (auth.yaml v2 — không còn
+// tokenType/expiresIn). Chain thật: form → auth.login/register → tokenStorage + bp.rt.
+
+const ENVELOPE_401 = {
+  error: { code: 'UNAUTHORIZED', message: 'bad credentials', requestId: null, details: null },
+};
+const ENVELOPE_409 = {
+  error: { code: 'CONFLICT', message: 'email already registered', requestId: null, details: null },
+};
+
+function jwt(): string {
+  const b64 = (o: object) => btoa(JSON.stringify(o)).replace(/=+$/, '');
+  return `${b64({ alg: 'HS256' })}.${b64({ sub: 'u1', email: 'alice@demo.local', roles: ['admin'], exp: Math.floor(Date.now() / 1000) + 3600 })}.sig`;
+}
+
+function session() {
+  return {
+    user: { id: 'u1', email: 'alice@demo.local', displayName: 'Alice', roles: ['admin'] },
+    accessToken: jwt(),
+    refreshToken: 'rt-1',
+  };
+}
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+
+function stubFetch(handler: (url: string, body: unknown) => Response) {
+  const fetchMock = vi.fn((input: RequestInfo | URL, init?: RequestInit) => {
+    const body = init?.body ? JSON.parse(String(init.body)) : null;
+    return Promise.resolve(handler(String(input), body));
+  });
+  vi.stubGlobal('fetch', fetchMock);
+  return fetchMock;
+}
+
+afterEach(() => {
+  cleanup();
+  // tokenStorage giữ memoryToken module-level — phải clearToken (không chỉ localStorage)
+  // nếu không test kế thừa token cũ → LoginPage early-return Navigate → render rỗng
+  tokenStorage.clearToken();
+  window.localStorage.clear();
+  vi.unstubAllGlobals();
+});
+
+function renderLogin() {
+  return render(
+    <MemoryRouter initialEntries={['/login']}>
+      <LoginPage />
+    </MemoryRouter>,
+  );
+}
+
+async function fillAndSubmit(email: string, password: string) {
+  const user = userEvent.setup();
+  await user.type(screen.getByLabelText('Email'), email);
+  await user.type(screen.getByLabelText('Mật khẩu'), password);
+  await user.click(screen.getByRole('button', { name: 'Đăng nhập' }));
+}
+
+describe('LoginPage — login (shape v2)', () => {
+  it('login thành công → lưu cặp token (bp.jwt + bp.rt), gọi đúng endpoint', async () => {
+    const fetchMock = stubFetch((url) =>
+      url === '/api/auth/login' ? jsonResponse(200, session()) : jsonResponse(404, null),
+    );
+
+    renderLogin();
+    await fillAndSubmit('alice@demo.local', 'demo-password');
+
+    await waitFor(() => {
+      expect(window.localStorage.getItem('bp.jwt')).toBe(session().accessToken);
+    });
+    expect(window.localStorage.getItem('bp.rt')).toBe('rt-1');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe('/api/auth/login');
+    expect(JSON.parse(String(init?.body))).toEqual({ email: 'alice@demo.local', password: 'demo-password' });
+  });
+
+  it('sai mật khẩu (401) → hiện lỗi, KHÔNG lưu token', async () => {
+    stubFetch(() => jsonResponse(401, ENVELOPE_401));
+
+    renderLogin();
+    await fillAndSubmit('alice@demo.local', 'wrong');
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent('Email hoặc mật khẩu không đúng.');
+    });
+    expect(window.localStorage.getItem('bp.jwt')).toBeNull();
+    expect(window.localStorage.getItem('bp.rt')).toBeNull();
+  });
+
+  it('lỗi server khác (500) → hiện message từ error envelope', async () => {
+    stubFetch(() =>
+      jsonResponse(500, {
+        error: { code: 'INTERNAL', message: 'Máy chủ bận.', requestId: null, details: null },
+      }),
+    );
+
+    renderLogin();
+    await fillAndSubmit('alice@demo.local', 'demo-password');
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent('Máy chủ bận.');
+    });
+  });
+
+  it('lỗi mạng → thông báo không kết nối được', async () => {
+    stubFetch(() => {
+      throw new TypeError('Failed to fetch');
+    });
+
+    renderLogin();
+    await fillAndSubmit('alice@demo.local', 'demo-password');
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent('Không kết nối được máy chủ đăng nhập.');
+    });
+  });
+});
+
+describe('LoginPage — tab Đăng ký (SF-4)', () => {
+  it('register thành công → POST /api/auth/register đủ 3 trường + lưu cặp token', async () => {
+    const fetchMock = stubFetch((url) =>
+      url === '/api/auth/register'
+        ? jsonResponse(201, {
+            user: { id: 'u2', email: 'new@demo.local', displayName: 'Nguyen Van A', roles: ['user'] },
+            accessToken: jwt(),
+            refreshToken: 'rt-new',
+          })
+        : jsonResponse(404, null),
+    );
+
+    renderLogin();
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('tab', { name: 'Đăng ký' }));
+
+    await user.type(screen.getByLabelText('Email'), 'new@demo.local');
+    await user.type(screen.getByLabelText('Mật khẩu'), 'sup-secret-1');
+    await user.type(screen.getByLabelText('Tên hiển thị'), 'Nguyen Van A');
+    await user.click(screen.getByRole('button', { name: 'Đăng ký' }));
+
+    await waitFor(() => {
+      expect(window.localStorage.getItem('bp.jwt')).toBeTruthy();
+    });
+    expect(window.localStorage.getItem('bp.rt')).toBe('rt-new');
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe('/api/auth/register');
+    expect(JSON.parse(String(init?.body))).toEqual({
+      email: 'new@demo.local',
+      password: 'sup-secret-1',
+      displayName: 'Nguyen Van A',
+    });
+  });
+
+  it('email trùng (409) → hiện lỗi đã đăng ký, KHÔNG lưu token', async () => {
+    stubFetch(() => jsonResponse(409, ENVELOPE_409));
+
+    renderLogin();
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('tab', { name: 'Đăng ký' }));
+    await user.type(screen.getByLabelText('Email'), 'alice@demo.local');
+    await user.type(screen.getByLabelText('Mật khẩu'), 'demo-password');
+    await user.type(screen.getByLabelText('Tên hiển thị'), 'Alice');
+    await user.click(screen.getByRole('button', { name: 'Đăng ký' }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent('Email này đã được đăng ký.');
+    });
+    expect(window.localStorage.getItem('bp.jwt')).toBeNull();
+  });
+
+  it('password ngắn hơn 8 ký tự → chặn ở FE (Mật khẩu cần 8–72 ký tự), không gọi mạng', async () => {
+    const fetchMock = stubFetch(() => jsonResponse(201, session()));
+
+    renderLogin();
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('tab', { name: 'Đăng ký' }));
+    await user.type(screen.getByLabelText('Email'), 'new@demo.local');
+    await user.type(screen.getByLabelText('Mật khẩu'), 'short');
+    await user.type(screen.getByLabelText('Tên hiển thị'), 'A');
+    await user.click(screen.getByRole('button', { name: 'Đăng ký' }));
+
+    expect(screen.getByRole('alert')).toHaveTextContent('Mật khẩu cần 8–72 ký tự.');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('đổi tab qua lại giữ các tab aria-selected đúng (tablist a11y)', async () => {
+    renderLogin();
+    const user = userEvent.setup();
+    const loginTab = screen.getByRole('tab', { name: 'Đăng nhập' });
+    const registerTab = screen.getByRole('tab', { name: 'Đăng ký' });
+
+    expect(loginTab).toHaveAttribute('aria-selected', 'true');
+    await user.click(registerTab);
+    expect(registerTab).toHaveAttribute('aria-selected', 'true');
+    expect(loginTab).toHaveAttribute('aria-selected', 'false');
+    // form register hiện (label Tên hiển thị), form login ẩn
+    expect(screen.getByLabelText('Tên hiển thị')).toBeInTheDocument();
+    await user.click(loginTab);
+    expect(screen.queryByLabelText('Tên hiển thị')).not.toBeInTheDocument();
+  });
+});
+
+describe('LoginPage — render + redirect', () => {
+  it('render login card: wordmark Boilerplate + heading Đăng nhập + hint demo', () => {
+    renderLogin();
+    expect(screen.getByText('Boilerplate')).toBeInTheDocument();
+    expect(screen.getByRole('heading', { name: 'Đăng nhập' })).toBeInTheDocument();
+    expect(screen.getByText(/alice@demo\.local/)).toBeInTheDocument();
+  });
+
+  it('đã có token hợp lệ → redirect về trang chủ, không render form', () => {
+    window.localStorage.setItem('bp.jwt', jwt());
+    renderLogin();
+    expect(screen.queryByLabelText('Email')).not.toBeInTheDocument();
+  });
+});

package/stack-template/app/shell/tests/mf-retry.test.ts

@@ -0,0 +1,76 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+// BUG-2 (sf-5b): "Thử lại" không ăn khi remote sống lại — sticky rejection trong MF
+// runtime layer. Mini-model FAITHFUL với runtime 0.21.6 (đọc từ source cài đặt
+// @module-federation/runtime-core/dist/index.esm.js):
+//   1. getRemoteEntry() memoize load-promise remoteEntry trong `globalLoading`
+//      (window.__GLOBAL_LOADING_REMOTE_ENTRY__, key = name+entry) — promise REJECTED
+//      không bao giờ được clear → mọi loadRemote sau trả lại rejection cũ TỨC THÌ,
+//      0 network request mới (đúng evidence bug report).
+//   2. registerRemotes(remotes, {force:true}) → registerRemote force → removeRemote
+//      xoá globalLoading + manifestCache + moduleCache + container global → loadRemote
+//      sau đó fetch lại remoteEntry thật (đường sanctioned duy nhất trong runtime).
+// Model chỉ giữ đúng 2 contract này — khẳng định hành vi đầu-cầu của lớp runtime.
+const runtime = vi.hoisted(() => ({
+  globalLoading: new Map<string, Promise<unknown>>(),
+  fetchCount: 0,
+  remoteUp: false,
+}));
+
+vi.mock('@module-federation/enhanced/runtime', () => ({
+  loadRemote: (id: string) => {
+    if (!runtime.globalLoading.has(id)) {
+      runtime.fetchCount += 1;
+      runtime.globalLoading.set(
+        id,
+        runtime.remoteUp
+          ? Promise.resolve({ default: { sentinel: 'LOADED' } })
+          : Promise.reject(new Error('RUNTIME-008: remoteEntry load fail')),
+      );
+    }
+    return runtime.globalLoading.get(id);
+  },
+  registerRemotes: (remotes: Array<Record<string, unknown>>, options?: { force?: boolean }) => {
+    if (options?.force) {
+      // Contract với registration gốc của webpack runtime: remote entry = type 'global'.
+      // Def lệch type (vd 'module') làm runtime fetch xong rồi chết ở RUNTIME_002
+      // (init undefined trên module namespace) — bắt được ở browser E2E, chặn tại đây.
+      for (const r of remotes) {
+        if (r.type !== 'global') {
+          throw new Error(`retry def phải type 'global', nhận: ${String(r.type)}`);
+        }
+      }
+      runtime.globalLoading.clear();
+    }
+  },
+}));
+
+import { loadRemoteModule } from '@wakii/fe-shared';
+
+afterEach(() => {
+  runtime.globalLoading.clear();
+  runtime.fetchCount = 0;
+  runtime.remoteUp = false;
+});
+
+const REMOTE = { name: 'tasks' as const, url: 'http://localhost:4001/remoteEntry.js' };
+
+describe('loadRemoteModule retry (BUG-2 sticky rejection)', () => {
+  it('retry sau khi remote sống lại phải fetch LẠI remoteEntry (force reset sticky layer)', async () => {
+    await expect(loadRemoteModule(REMOTE, './TasksPage')).rejects.toThrow(/tasks/);
+    expect(runtime.fetchCount).toBe(1);
+
+    runtime.remoteUp = true; // remote sống lại (như acceptance #5)
+    await expect(
+      loadRemoteModule(REMOTE, './TasksPage', { retry: true }),
+    ).resolves.toMatchObject({ default: { sentinel: 'LOADED' } });
+    // RED pre-fix: fetchCount vẫn 1 — runtime trả rejection sticky, không fetch mới
+    expect(runtime.fetchCount).toBe(2);
+  });
+
+  it('không có cờ retry → giữ nguyên hành vi (không reset cache khi remote chưa sống lại)', async () => {
+    await expect(loadRemoteModule(REMOTE, './TasksPage')).rejects.toThrow(/tasks/);
+    await expect(loadRemoteModule(REMOTE, './TasksPage')).rejects.toThrow(/tasks/);
+    expect(runtime.fetchCount).toBe(1);
+  });
+});

package/stack-template/app/shell/tests/refresh-client.test.ts

@@ -0,0 +1,301 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  ApiClient,
+  ApiError,
+  REFRESH_STORAGE_KEY,
+  createAuthClient,
+  tokenStorage,
+  type AuthSession,
+} from '@wakii/fe-shared';
+
+// SF-4 (VU-63) — wrapper refresh-client (file MỚI, token-storage READ-LOCKED nguyên vẹn).
+// Contract: auth.yaml v2 + token-contract.md v2 — response {user, accessToken, refreshToken},
+// refresh lưu localStorage['bp.rt'], 401 → refresh single-flight đúng 1 lần → retry.
+
+const ENVELOPE_401 = {
+  error: { code: 'UNAUTHORIZED', message: 'unauthorized', requestId: null, details: null },
+};
+const ENVELOPE_409 = {
+  error: { code: 'CONFLICT', message: 'email exists', requestId: null, details: null },
+};
+
+const PATH = {
+  login: '/api/auth/login',
+  register: '/api/auth/register',
+  refresh: '/api/auth/refresh',
+  logout: '/api/auth/logout',
+};
+
+/** JWT fake đủ 3 segment (readClaims decode được) — test-only, không qua BE. */
+function jwt(sub = 'u1', email = 'alice@demo.local'): string {
+  const b64 = (o: object) => btoa(JSON.stringify(o)).replace(/=+$/, '');
+  return `${b64({ alg: 'HS256' })}.${b64({ sub, email, roles: ['admin'], exp: Math.floor(Date.now() / 1000) + 3600 })}.sig`;
+}
+
+function session(over: Partial<AuthSession> = {}): AuthSession {
+  return {
+    user: { id: 'u1', email: 'alice@demo.local', displayName: 'Alice', roles: ['admin'] },
+    accessToken: jwt(),
+    refreshToken: 'rt-1',
+    ...over,
+  };
+}
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+
+function makeClient() {
+  const fetchMock = vi.fn();
+  const api = new ApiClient({ baseUrl: '', tokenStorage, fetchImpl: fetchMock as unknown as typeof fetch });
+  return { client: createAuthClient(api), fetchMock };
+}
+
+function unauthorized(): ApiError {
+  return new ApiError(401, ENVELOPE_401);
+}
+
+beforeEach(() => {
+  window.localStorage.clear();
+  tokenStorage.clearToken();
+});
+
+describe('auth.login/register — lưu cặp token (shape v2)', () => {
+  it('login → POST /api/auth/login + lưu access → bp.jwt, refresh → bp.rt', async () => {
+    const { client, fetchMock } = makeClient();
+    const s = session({ refreshToken: 'rt-login' });
+    fetchMock.mockResolvedValue(jsonResponse(200, s));
+
+    const out = await client.login('alice@demo.local', 'demo-password');
+
+    expect(out).toEqual(s);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe(PATH.login);
+    expect(JSON.parse(String(init?.body))).toEqual({ email: 'alice@demo.local', password: 'demo-password' });
+    expect(tokenStorage.getToken()).toBe(s.accessToken);
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBe('rt-login');
+  });
+
+  it('register → POST /api/auth/register {email,password,displayName} + lưu cặp', async () => {
+    const { client, fetchMock } = makeClient();
+    const s = session({
+      user: { id: 'u2', email: 'new@demo.local', displayName: 'New User', roles: ['user'] },
+      accessToken: jwt('u2', 'new@demo.local'),
+      refreshToken: 'rt-reg',
+    });
+    fetchMock.mockResolvedValue(jsonResponse(201, s));
+
+    const out = await client.register('new@demo.local', 'sup-secret-1', 'New User');
+
+    expect(out).toEqual(s);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe(PATH.register);
+    expect(JSON.parse(String(init?.body))).toEqual({
+      email: 'new@demo.local',
+      password: 'sup-secret-1',
+      displayName: 'New User',
+    });
+    expect(tokenStorage.getToken()).toBe(s.accessToken);
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBe('rt-reg');
+  });
+});
+
+describe('withRefresh — 401 → refresh single-flight → retry', () => {
+  it('fn 401 → refresh ĐÚNG 1 LẦN với rt đã lưu → retry với token MỚI → kết quả trả về', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockResolvedValue(jsonResponse(200, { accessToken: 'new-access', refreshToken: 'rt-2' }));
+
+    const tokens: string[] = [];
+    const fn = vi.fn(async (token: string) => {
+      tokens.push(token);
+      if (tokens.length === 1) throw unauthorized();
+      return 'result';
+    });
+
+    const result = await client.withRefresh(fn);
+
+    expect(result).toBe('result');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe(PATH.refresh);
+    expect(JSON.parse(String(init?.body))).toEqual({ refreshToken: 'rt-1' });
+    // retry nhận ĐÚNG token mới, không phải token cũ
+    expect(tokens).toEqual(['old-access', 'new-access']);
+    // cặp mới được lưu lại cả 2 key
+    expect(tokenStorage.getToken()).toBe('new-access');
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBe('rt-2');
+  });
+
+  it('refresh cũng 401 → clear CẢ 2 key + ném ApiError UNAUTHORIZED, không retry', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockResolvedValue(jsonResponse(401, ENVELOPE_401));
+    const fn = vi.fn(async () => {
+      throw unauthorized();
+    });
+
+    await expect(client.withRefresh(fn)).rejects.toMatchObject({ status: 401, code: 'UNAUTHORIZED' });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1); // refresh đúng 1 lần, không lặp
+    expect(fn).toHaveBeenCalledTimes(1); // refresh chết → không retry
+    expect(tokenStorage.getToken()).toBeNull();
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBeNull();
+  });
+
+  it('401 nhưng KHÔNG có refresh token → clear access + 401, không gọi /refresh', async () => {
+    tokenStorage.setToken('old-access');
+    const { client, fetchMock } = makeClient();
+    const fn = async () => {
+      throw unauthorized();
+    };
+
+    await expect(client.withRefresh(fn)).rejects.toMatchObject({ status: 401 });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(tokenStorage.getToken()).toBeNull();
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBeNull();
+  });
+
+  it('2 withRefresh 401 đồng thời → /refresh chỉ gọi 1 LẦN, cả 2 retry đều dùng token mới', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    // refresh chậm 1 tick — cả 2 caller 401 kịp share cùng promise lock
+    fetchMock.mockImplementation(
+      () =>
+        new Promise((resolve) =>
+          setTimeout(() => resolve(jsonResponse(200, { accessToken: 'new-access', refreshToken: 'rt-2' })), 0),
+        ),
+    );
+    const makeFn = () => {
+      let first = true;
+      return async (token: string) => {
+        if (first) {
+          first = false;
+          throw unauthorized();
+        }
+        return `ok:${token}`;
+      };
+    };
+
+    const [a, b] = await Promise.all([client.withRefresh(makeFn()), client.withRefresh(makeFn())]);
+
+    expect(a).toBe('ok:new-access');
+    expect(b).toBe('ok:new-access');
+    const refreshCalls = fetchMock.mock.calls.filter(([url]) => String(url) === PATH.refresh);
+    expect(refreshCalls).toHaveLength(1);
+    // single-flight xong lock nhả — 401 SAU đó vẫn refresh được (không khoá vĩnh viễn)
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-2');
+    fetchMock.mockResolvedValue(jsonResponse(200, { accessToken: 'again', refreshToken: 'rt-3' }));
+    const fnLater = vi.fn(async (token: string) => {
+      if (token === 'old-access') throw unauthorized();
+      return 'later';
+    });
+    await expect(client.withRefresh(fnLater)).resolves.toBe('later');
+    expect(fetchMock.mock.calls.filter(([url]) => String(url) === PATH.refresh)).toHaveLength(2);
+  });
+
+  it('retry với token mới VẪN 401 → clear 2 key + ném 401, không refresh lần 2', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockResolvedValue(jsonResponse(200, { accessToken: 'new-access', refreshToken: 'rt-2' }));
+    const fn = vi.fn(async () => {
+      throw unauthorized();
+    });
+
+    await expect(client.withRefresh(fn)).rejects.toMatchObject({ status: 401 });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(tokenStorage.getToken()).toBeNull();
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBeNull();
+  });
+
+  it('fn lỗi KHÔNG phải 401 (409) → ném thẳng, không refresh, giữ nguyên session', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    const fn = async () => {
+      throw new ApiError(409, ENVELOPE_409);
+    };
+
+    await expect(client.withRefresh(fn)).rejects.toMatchObject({ status: 409 });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(tokenStorage.getToken()).toBe('old-access');
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBe('rt-1');
+  });
+
+  it('retry thành công nhưng văng lỗi KHÔNG phải 401 → giữ nguyên session mới (chỉ 401 mới clear)', async () => {
+    tokenStorage.setToken('old-access');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockResolvedValue(jsonResponse(200, { accessToken: 'new-access', refreshToken: 'rt-2' }));
+    const fn = vi.fn(async (token: string) => {
+      if (token === 'old-access') throw unauthorized();
+      // token mới hợp lệ nhưng request business văng 409 (vd trùng dữ liệu) — không phải hết phiên
+      throw new ApiError(409, ENVELOPE_409);
+    });
+
+    await expect(client.withRefresh(fn)).rejects.toMatchObject({ status: 409 });
+
+    // refresh vẫn diễn ra đúng 1 lần; lỗi retry non-401 KHÔNG được xoá session
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(tokenStorage.getToken()).toBe('new-access');
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBe('rt-2');
+  });
+
+  it('fn thành công ngay → không đụng refresh, kết quả truyền thẳng', async () => {
+    tokenStorage.setToken('old-access');
+    const { client, fetchMock } = makeClient();
+    const out = await client.withRefresh(async () => 42);
+    expect(out).toBe(42);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('logout — revoke + clear sạch', () => {
+  it('logout → POST /api/auth/logout với rt đã lưu + clear CẢ 2 key', async () => {
+    tokenStorage.setToken('access-1');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockResolvedValue(new Response(null, { status: 204 }));
+
+    await client.logout();
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe(PATH.logout);
+    expect(JSON.parse(String(init?.body))).toEqual({ refreshToken: 'rt-1' });
+    expect(tokenStorage.getToken()).toBeNull();
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBeNull();
+  });
+
+  it('logout khi mạng chết → VẪN clear 2 key, không ném lỗi (intent đăng xuất thắng)', async () => {
+    tokenStorage.setToken('access-1');
+    window.localStorage.setItem(REFRESH_STORAGE_KEY, 'rt-1');
+    const { client, fetchMock } = makeClient();
+    fetchMock.mockRejectedValue(new TypeError('Failed to fetch'));
+
+    await expect(client.logout()).resolves.toBeUndefined();
+
+    expect(tokenStorage.getToken()).toBeNull();
+    expect(window.localStorage.getItem(REFRESH_STORAGE_KEY)).toBeNull();
+  });
+
+  it('logout không có refresh token → không gọi mạng, vẫn clear', async () => {
+    tokenStorage.setToken('access-1');
+    const { client, fetchMock } = makeClient();
+
+    await client.logout();
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(tokenStorage.getToken()).toBeNull();
+  });
+});