opensoma 0.5.0 → 0.6.0

package/src/credential-manager.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, test } from 'bun:test'
+import { afterEach, describe, expect, it } from 'bun:test'
 import { mkdtemp, readFile, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -15,7 +15,7 @@ afterEach(async () => {
 })
 
 describe('CredentialManager', () => {
-  test('loads empty config when file does not exist', async () => {
+  it('loads an empty config when the credentials file does not exist', async () => {
     const dir = await makeTempDir()
     const manager = new CredentialManager(dir)
 
@@ -23,7 +23,7 @@ describe('CredentialManager', () => {
     await expect(manager.getCredentials()).resolves.toBeNull()
   })
 
-  test('saves and loads credentials with secure permissions', async () => {
+  it('saves and loads credentials with secure file permissions', async () => {
     const dir = await makeTempDir()
     const manager = new CredentialManager(dir)
 
@@ -53,7 +53,7 @@ describe('CredentialManager', () => {
     expect(keyFileStat.mode & 0o777).toBe(0o600)
   })
 
-  test('removes credentials file', async () => {
+  it('removes the credentials file', async () => {
     const dir = await makeTempDir()
     const manager = new CredentialManager(dir)
 
@@ -66,7 +66,51 @@ describe('CredentialManager', () => {
     await expect(manager.getCredentials()).resolves.toBeNull()
   })
 
-  test('preserves session credentials when the encryption key is missing', async () => {
+  it('clearSessionState preserves username and password but wipes session fields', async () => {
+    const dir = await makeTempDir()
+    const manager = new CredentialManager(dir)
+
+    await manager.setCredentials({
+      sessionCookie: 'session-value',
+      csrfToken: 'csrf-value',
+      username: 'mentor@example.com',
+      password: 'secret-password',
+      loggedInAt: '2026-04-09T00:00:00.000Z',
+    })
+
+    await manager.clearSessionState()
+
+    await expect(manager.getCredentials()).resolves.toEqual({
+      sessionCookie: '',
+      csrfToken: '',
+      username: 'mentor@example.com',
+      password: 'secret-password',
+    })
+  })
+
+  it('clearSessionState removes the file when no recovery material is stored', async () => {
+    const dir = await makeTempDir()
+    const manager = new CredentialManager(dir)
+
+    await manager.setCredentials({
+      sessionCookie: 'session-value',
+      csrfToken: 'csrf-value',
+    })
+
+    await manager.clearSessionState()
+
+    await expect(manager.getCredentials()).resolves.toBeNull()
+  })
+
+  it('clearSessionState is a no-op when no credentials file exists', async () => {
+    const dir = await makeTempDir()
+    const manager = new CredentialManager(dir)
+
+    await expect(manager.clearSessionState()).resolves.toBeUndefined()
+    await expect(manager.getCredentials()).resolves.toBeNull()
+  })
+
+  it('preserves session credentials but drops the password when the encryption key is missing', async () => {
     const dir = await makeTempDir()
     const manager = new CredentialManager(dir)
 

package/src/credential-manager.ts

@@ -76,6 +76,33 @@ export class CredentialManager {
     await rm(this.encryptionKeyPath, { force: true })
   }
 
+  /**
+   * Wipe ephemeral session fields (sessionCookie, csrfToken, loggedInAt) while
+   * preserving long-term re-login material (username, password). Used when the
+   * server-side session expired but we still want automatic recovery on the
+   * next run via `recoverSession()`.
+   *
+   * No-op when no credentials file exists or no recovery material is stored.
+   */
+  async clearSessionState(): Promise<void> {
+    const current = await this.getCredentials()
+    if (!current) {
+      return
+    }
+
+    if (!current.username && !current.password) {
+      await this.remove()
+      return
+    }
+
+    await this.setCredentials({
+      sessionCookie: '',
+      csrfToken: '',
+      username: current.username,
+      password: current.password,
+    })
+  }
+
   private async hydrateCredentials(credentials: StoredCredentials): Promise<Credentials> {
     if (!credentials.encryptedPassword) {
       return credentials