odac 1.4.14 → 1.4.16

package/src/View/Image.js

@@ -3,8 +3,6 @@ const fs = require('fs')
 const fsPromises = fs.promises
 const path = require('path')
 
-const IMG_CACHE_DIR = './storage/.cache/img'
-
 /**
  * Handles on-demand image processing (resize + format conversion) for the
  * ODAC template engine's `<odac:img>` tag. Uses sharp as an optional dependency
@@ -61,6 +59,17 @@ class Image {
     return this.#sharpAvailable
   }
 
+  /**
+   * Resolves the on-disk image cache directory relative to global.__dir,
+   * consistent with how the public/ source directory is resolved elsewhere
+   * in this file. Read lazily (not cached at module scope) so it stays in
+   * sync if __dir changes, e.g. across test suites.
+   * @returns {string}
+   */
+  static #cacheDir() {
+    return path.join(global.__dir || process.cwd(), 'storage/.cache/img')
+  }
+
   /**
    * Generates a deterministic hash from the image transformation parameters.
    * Identical source + options + mtime always produce the same hash, enabling
@@ -186,7 +195,7 @@ class Image {
    * @returns {Promise<{path: string, type: string}|null>}
    */
   static async #processInternal(src, cacheKey, format, options, sourceVerified = false) {
-    const cachePath = path.join(IMG_CACHE_DIR, cacheKey)
+    const cachePath = path.join(this.#cacheDir(), cacheKey)
 
     // Disk cache hit — populate in-memory index without reprocessing
     try {
@@ -242,7 +251,7 @@ class Image {
       // Format conversion with quality setting
       pipeline = pipeline.toFormat(format, {quality})
 
-      await fsPromises.mkdir(IMG_CACHE_DIR, {recursive: true})
+      await fsPromises.mkdir(this.#cacheDir(), {recursive: true})
       await pipeline.toFile(cachePath)
 
       const result = {path: cachePath, type: `image/${format}`, cacheKey}
@@ -280,11 +289,11 @@ class Image {
    * @returns {Promise<{stream: ReadableStream, type: string, size: number}|null>}
    */
   static async serve(filename) {
-    const cachePath = path.join(IMG_CACHE_DIR, filename)
+    const cachePath = path.join(this.#cacheDir(), filename)
 
     // Prevent directory traversal in the filename
     const resolvedCache = path.resolve(cachePath)
-    const cacheDir = path.resolve(IMG_CACHE_DIR)
+    const cacheDir = path.resolve(this.#cacheDir())
     if (!resolvedCache.startsWith(cacheDir + path.sep) && resolvedCache !== cacheDir) {
       return null
     }

package/src/View.js

@@ -521,9 +521,9 @@ class View {
       })
 
       let cache = `${nodeCrypto.createHash('md5').update(file).digest('hex')}`
-      await fsPromises.mkdir(CACHE_DIR, {recursive: true})
+      await fsPromises.mkdir(`${__dir}/${CACHE_DIR}`, {recursive: true})
       await fsPromises.writeFile(
-        `${CACHE_DIR}/${cache}`,
+        `${__dir}/${CACHE_DIR}/${cache}`,
         `module.exports = async (Odac, get, __) => {\nlet html = '';\n${result}\nreturn html.trim()\n}`
       )
       delete require.cache[require.resolve(`${__dir}/${CACHE_DIR}/${cache}`)]

package/test/Auth/check.test.js

@@ -1,5 +1,9 @@
+const nodeCrypto = require('crypto')
 const Auth = require('../../src/Auth.js')
 
+// token_y is stored as a SHA-256 hash ($sha256$<hex>) of the odac_y cookie ('old_y').
+const HASHED_OLD_Y = '$sha256$' + nodeCrypto.createHash('sha256').update('old_y').digest('hex')
+
 describe('Auth.check()', () => {
   let reqMock
   let authInstance
@@ -64,7 +68,7 @@ describe('Auth.check()', () => {
         // Getter mode: 1 argument
         return cookieStore[name] || null
       }),
-      header: jest.fn(() => 'TestBrowser'),
+      header: jest.fn(name => (name === 'user-agent' ? 'TestBrowser' : null)),
       ip: '127.0.0.1',
       res: {} // HTTP context (non-null res indicates Set-Cookie can be delivered)
     }
@@ -82,7 +86,14 @@ describe('Auth.check()', () => {
       },
       DB: {
         fn: {now: () => new Date()},
-        nanoid: () => 'nano_' + Date.now()
+        nanoid: () => 'nano_' + Date.now(),
+        // schema: used by #ensureTokenTableV2 migration (hasTable/hasColumn/alterTable)
+        schema: {
+          alterTable: jest.fn(() => Promise.resolve()),
+          createTable: jest.fn(() => Promise.resolve()),
+          hasColumn: jest.fn(() => Promise.resolve(true)),
+          hasTable: jest.fn(() => Promise.resolve(true))
+        }
       },
       Var: jest.fn(() => ({
         hash: jest.fn(() => 'hashed_value'),
@@ -105,7 +116,7 @@ describe('Auth.check()', () => {
       id: 'token_1',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -122,7 +133,8 @@ describe('Auth.check()', () => {
     const inserted = dbMock.tracker.insertCalls[0]
     expect(inserted.user).toBe('user_10')
     expect(inserted.token_x).toBeDefined()
-    expect(inserted.token_y).toBe('hashed_value')
+    // token_y is now a fast SHA-256 hash of the fresh secret
+    expect(inserted.token_y).toMatch(/^\$sha256\$[a-f0-9]{64}$/)
 
     // Verify old token was marked with Epoch Date
     expect(dbMock.tracker.updateCalls.length).toBe(1)
@@ -147,7 +159,7 @@ describe('Auth.check()', () => {
     // Simulate a rotated token where active was set to give ~60s grace period
     // and the rotation JUST happened (< 5 seconds ago)
     const maxAge = 30 * 24 * 60 * 60 * 1000
-    const rotatedActiveDate = new Date(Date.now() - maxAge + 60000) // Grace period: ~60s left
+    const rotatedActiveDate = new Date(Date.now() - maxAge + 30000) // Grace period (30s) just started
 
     const mockRecord = {
       active: rotatedActiveDate,
@@ -156,7 +168,7 @@ describe('Auth.check()', () => {
       id: 'token_2',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -177,9 +189,9 @@ describe('Auth.check()', () => {
     // Client still has old cookies -> recovery rotation should trigger
     const maxAge = 30 * 24 * 60 * 60 * 1000
     const timeSinceRotation = 10000 // 10 seconds since original rotation
-    // active was set to: rotationTime - maxAge + 60000
-    // So: inactiveAge = now - active = now - (rotationTime - maxAge + 60000) = timeSinceRotation + maxAge - 60000
-    const rotatedActiveDate = new Date(Date.now() - maxAge + 60000 - timeSinceRotation)
+    // active was set to: rotationTime - maxAge + grace (30s)
+    // So: inactiveAge = now - active = timeSinceRotation + maxAge - grace
+    const rotatedActiveDate = new Date(Date.now() - maxAge + 30000 - timeSinceRotation)
 
     const mockRecord = {
       active: rotatedActiveDate,
@@ -188,7 +200,7 @@ describe('Auth.check()', () => {
       id: 'token_recovery',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -234,7 +246,7 @@ describe('Auth.check()', () => {
       id: 'token_3',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -259,7 +271,7 @@ describe('Auth.check()', () => {
       id: 'token_4',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -284,7 +296,7 @@ describe('Auth.check()', () => {
         if (value !== undefined) return
         return {odac_x: 'old_x', odac_y: 'old_y'}[name] || null
       }),
-      header: jest.fn(() => 'TestBrowser'),
+      header: jest.fn(name => (name === 'user-agent' ? 'TestBrowser' : null)),
       ip: '127.0.0.1',
       res: null // WebSocket context: no HTTP response available
     }
@@ -298,7 +310,7 @@ describe('Auth.check()', () => {
       id: 'token_ws',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -322,14 +334,14 @@ describe('Auth.check()', () => {
   it('should skip recovery rotation for WebSocket connections (res === null)', async () => {
     const maxAge = 30 * 24 * 60 * 60 * 1000
     const timeSinceRotation = 10000 // 10 seconds since original rotation
-    const rotatedActiveDate = new Date(Date.now() - maxAge + 60000 - timeSinceRotation)
+    const rotatedActiveDate = new Date(Date.now() - maxAge + 30000 - timeSinceRotation)
 
     const wsReqMock = {
       cookie: jest.fn((name, value) => {
         if (value !== undefined) return
         return {odac_x: 'old_x', odac_y: 'old_y'}[name] || null
       }),
-      header: jest.fn(() => 'TestBrowser'),
+      header: jest.fn(name => (name === 'user-agent' ? 'TestBrowser' : null)),
       ip: '127.0.0.1',
       res: null // WebSocket context
     }
@@ -343,7 +355,7 @@ describe('Auth.check()', () => {
       id: 'token_ws_recovery',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -373,7 +385,7 @@ describe('Auth.check()', () => {
       id: 'token_5',
       ip: '127.0.0.1',
       token_x: 'old_x',
-      token_y: 'hashed_old_y',
+      token_y: HASHED_OLD_Y,
       user: 'user_10'
     }
 
@@ -393,4 +405,193 @@ describe('Auth.check()', () => {
     // Should NOT have Epoch marker
     expect(updatePayload.date).toBeUndefined()
   })
+
+  // ─── SESSION ANOMALY DETECTION ────────────────────────────────────────────
+
+  const CHROME_WIN = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
+  const FIREFOX_WIN = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0'
+  const CHROME_MAC = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
+  const CHROME_WIN_OLD = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36'
+
+  // Builds a request whose headers/ip/cookies can differ from the stored token.
+  const buildReq = ({ua = CHROME_WIN, lang = 'en-US', ip = '127.0.0.1', y = 'old_y'} = {}) => {
+    const store = {odac_x: 'old_x', odac_y: y}
+    return {
+      cookie: jest.fn((name, value) => {
+        if (value !== undefined) {
+          store[name] = value
+          return
+        }
+        return store[name] || null
+      }),
+      header: jest.fn(name => (name === 'user-agent' ? ua : name === 'accept-language' ? lang : null)),
+      ip,
+      res: {}
+    }
+  }
+
+  // Fresh, non-rotating token record (recent active + date) so only the anomaly
+  // path is exercised.
+  const freshRecord = (overrides = {}) => ({
+    accept_language: 'en-US',
+    active: new Date(),
+    browser: CHROME_WIN,
+    date: new Date(),
+    id: 'tok_anomaly',
+    ip: '127.0.0.1',
+    token_x: 'old_x',
+    token_y: HASHED_OLD_Y,
+    user: 'user_10',
+    ...overrides
+  })
+
+  it('deletes the token and fails when the browser family changes', async () => {
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ua: FIREFOX_WIN})).check()
+
+    expect(result).toBe(false)
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+    expect(dbMock.insert).not.toHaveBeenCalled()
+  })
+
+  it('deletes the token and fails when the OS family changes', async () => {
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ua: CHROME_MAC})).check()
+
+    expect(result).toBe(false)
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+  })
+
+  it('deletes the token and fails on a browser version downgrade', async () => {
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ua: CHROME_WIN_OLD})).check()
+
+    expect(result).toBe(false)
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+  })
+
+  it('deletes the token when the IP moves and Accept-Language differs', async () => {
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ip: '8.8.8.8', lang: 'fr-FR'})).check()
+
+    expect(result).toBe(false)
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+  })
+
+  it('allows an IP change alone when UA and language are unchanged', async () => {
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ip: '8.8.8.8'})).check()
+
+    expect(result).toBe(true)
+    expect(dbMock.tracker.deleteCalls.length).toBe(0)
+  })
+
+  it('skips the language rule and backfills when a legacy row has no accept_language baseline', async () => {
+    // Pre-migration row: accept_language is NULL. An IP move with a differing
+    // language must NOT kill the session; instead the baseline is backfilled.
+    const dbMock = createDbMock([freshRecord({accept_language: null})])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ip: '8.8.8.8', lang: 'fr-FR'})).check()
+
+    expect(result).toBe(true)
+    expect(dbMock.tracker.deleteCalls.length).toBe(0)
+    // Backfill update stores the current language as the new baseline
+    const backfill = dbMock.tracker.updateCalls.find(p => p.accept_language === 'fr-FR')
+    expect(backfill).toBeDefined()
+  })
+
+  it('refreshes the UA baseline during activity updates so legitimate drift does not accumulate', async () => {
+    const CHROME_WIN_121 = CHROME_WIN.replace('Chrome/120', 'Chrome/121')
+    // inactiveAge > updateAge (24h) triggers the activity update; date recent
+    // enough to stay under rotationAge is impossible here, so disable rotation
+    // to exercise the non-rotating fallback path.
+    global.Odac.Config.auth.rotation = false
+
+    const dbMock = createDbMock([
+      freshRecord({
+        active: new Date(Date.now() - 25 * 60 * 60 * 1000), // 25h ago -> exceeds updateAge
+        date: new Date(Date.now() - 40 * 24 * 60 * 60 * 1000) // old token, rotation disabled
+      })
+    ])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    // Same family/OS, +1 major version: legitimate drift, not an anomaly
+    const result = await new Auth(buildReq({ua: CHROME_WIN_121})).check()
+
+    expect(result).toBe(true)
+    expect(dbMock.tracker.deleteCalls.length).toBe(0)
+    // Activity update must carry the new UA as the refreshed baseline
+    const refresh = dbMock.tracker.updateCalls.find(p => p.browser === CHROME_WIN_121)
+    expect(refresh).toBeDefined()
+    expect(refresh.active).toBeInstanceOf(Date)
+  })
+
+  it('classifies iOS browser variants (CriOS) consistently with their desktop family', async () => {
+    const CHROME_IOS =
+      'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/120.0.6099.119 Mobile/15E148 Safari/604.1'
+    const SAFARI_IOS =
+      'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1'
+
+    // Stored: Chrome on iOS. Presented: Safari on iOS -> browser family change -> delete.
+    const dbMock = createDbMock([freshRecord({browser: CHROME_IOS})])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq({ua: SAFARI_IOS})).check()
+
+    expect(result).toBe(false)
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+  })
+
+  it('sweeps expired tokens from the request path, not only on login', async () => {
+    // Force the throttle window open (static #lastTokenSweep starts at process
+    // start, so default-interval tests never sweep)
+    global.Odac.Config.auth.sweepInterval = -1
+
+    const dbMock = createDbMock([freshRecord()])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq()).check()
+
+    expect(result).toBe(true)
+    // The only delete in this healthy-session scenario is the range sweep
+    expect(dbMock.tracker.deleteCalls.length).toBe(1)
+  })
+
+  it('accepts a legacy scrypt-hashed token for backward compatibility', async () => {
+    // #verifyToken routes $scrypt$ tokens through Odac.Var().hashCheck() (mocked true).
+    const dbMock = createDbMock([freshRecord({token_y: '$scrypt$deadbeef$cafe'})])
+    global.Odac.DB.user_tokens = dbMock
+    global.Odac.DB.users = dbMock
+
+    const result = await new Auth(buildReq()).check()
+
+    expect(result).toBe(true)
+    expect(dbMock.tracker.deleteCalls.length).toBe(0)
+
+    // In-place upgrade: the same secret must be rehashed to SHA-256 so the
+    // scrypt hash disappears after the first successful verification
+    const upgrade = dbMock.tracker.updateCalls.find(p => p.token_y)
+    expect(upgrade).toBeDefined()
+    expect(upgrade.token_y).toBe(HASHED_OLD_Y)
+  })
 })

package/test/Auth/verifyMagicLink.test.js

@@ -102,7 +102,14 @@ describe('Auth.verifyMagicLink()', () => {
       },
       DB: {
         fn: {now: () => new Date()},
-        nanoid: () => 'nano_' + Date.now()
+        nanoid: () => 'nano_' + Date.now(),
+        // schema: used by #ensureTokenTableV2 migration (hasTable/hasColumn/alterTable)
+        schema: {
+          alterTable: jest.fn(() => Promise.resolve()),
+          createTable: jest.fn(() => Promise.resolve()),
+          hasColumn: jest.fn(() => Promise.resolve(true)),
+          hasTable: jest.fn(() => Promise.resolve(true))
+        }
       },
       Var: jest.fn(() => ({
         hash: jest.fn(() => 'hashed_value'),

package/test/Odac/cache.test.js

@@ -2,6 +2,7 @@ const Odac = require('../../src/Odac')
 
 describe('Odac.cache()', () => {
   let mockOdac
+  let ctx
 
   beforeEach(() => {
     mockOdac = {
@@ -14,6 +15,8 @@ describe('Odac.cache()', () => {
   })
 
   afterEach(() => {
+    ctx?.Request.clearTimeout()
+    ctx = null
     delete global.Odac
     delete global.__dir
   })
@@ -28,7 +31,7 @@ describe('Odac.cache()', () => {
     }
     const mockRes = {on: jest.fn(), writeHead: jest.fn(), end: jest.fn()}
 
-    const ctx = Odac.instance('id', mockReq, mockRes)
+    ctx = Odac.instance('id', mockReq, mockRes)
 
     expect(typeof ctx.cache).toBe('function')
   })
@@ -43,7 +46,7 @@ describe('Odac.cache()', () => {
     }
     const mockRes = {on: jest.fn(), writeHead: jest.fn(), end: jest.fn(), finished: false}
 
-    const ctx = Odac.instance('id', mockReq, mockRes)
+    ctx = Odac.instance('id', mockReq, mockRes)
     ctx.cache(3600)
 
     ctx.Request.print()

package/test/Odac/image.test.js

@@ -2,6 +2,7 @@ const Odac = require('../../src/Odac')
 
 describe('Odac.image()', () => {
   let mockOdac
+  let ctx
 
   beforeEach(() => {
     mockOdac = {
@@ -19,12 +20,14 @@ describe('Odac.image()', () => {
   })
 
   afterEach(() => {
+    ctx?.Request?.clearTimeout()
+    ctx = null
     delete global.Odac
     delete global.__dir
   })
 
   test('should be available on instance without req/res (cron context)', () => {
-    const ctx = Odac.instance(null, 'cron')
+    ctx = Odac.instance(null, 'cron')
     expect(typeof ctx.image).toBe('function')
   })
 
@@ -37,25 +40,25 @@ describe('Odac.image()', () => {
       on: jest.fn()
     }
     const mockRes = {on: jest.fn()}
-    const ctx = Odac.instance('id', mockReq, mockRes)
+    ctx = Odac.instance('id', mockReq, mockRes)
     expect(typeof ctx.image).toBe('function')
   })
 
   test('should return a promise', () => {
-    const ctx = Odac.instance(null, 'cron')
+    ctx = Odac.instance(null, 'cron')
     const result = ctx.image('/images/test.jpg', {width: 300})
     expect(result).toBeInstanceOf(Promise)
   })
 
   test('should return original src when sharp is unavailable', async () => {
-    const ctx = Odac.instance(null, 'cron')
+    ctx = Odac.instance(null, 'cron')
     const result = await ctx.image('/images/test.jpg')
     // sharp not installed in test env → returns original src
     expect(result).toBe('/images/test.jpg')
   })
 
   test('should return empty string for empty src', async () => {
-    const ctx = Odac.instance(null, 'cron')
+    ctx = Odac.instance(null, 'cron')
     expect(await ctx.image('')).toBe('')
   })
 })

package/test/Odac/instance.test.js

@@ -2,6 +2,7 @@ const Odac = require('../../src/Odac')
 
 describe('Odac.instance()', () => {
   let mockOdac
+  let ctx
 
   beforeEach(() => {
     mockOdac = {
@@ -20,6 +21,8 @@ describe('Odac.instance()', () => {
   })
 
   afterEach(() => {
+    ctx?.Request.clearTimeout()
+    ctx = null
     delete global.Odac
     delete global.__dir
   })
@@ -34,7 +37,7 @@ describe('Odac.instance()', () => {
     }
     const mockRes = {on: jest.fn(), writeHead: jest.fn(), end: jest.fn()}
 
-    const ctx = Odac.instance('id', mockReq, mockRes)
+    ctx = Odac.instance('id', mockReq, mockRes)
 
     expect(ctx.Request).toBeDefined()
     expect(ctx.Request.id).toBe('id')
@@ -49,7 +52,7 @@ describe('Odac.instance()', () => {
       on: jest.fn()
     }
     const mockRes = {on: jest.fn()}
-    const ctx = Odac.instance('id', mockReq, mockRes)
+    ctx = Odac.instance('id', mockReq, mockRes)
 
     expect(typeof ctx.abort).toBe('function')
     expect(typeof ctx.cookie).toBe('function')

package/test/Request/cache.test.js

@@ -29,6 +29,7 @@ describe('Request.cache()', () => {
   })
 
   afterEach(() => {
+    request.clearTimeout()
     delete global.Odac
     delete global.__dir
   })