yarm6mesq: Refresh expired tokens and revoke on sign-out

tests/session.test.ts

@@ -1,15 +1,26 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { NextRequest } from "next/server";
-import { GET, POST } from "@/app/api/session/route";
+import { DELETE, GET, POST } from "@/app/api/session/route";
 import { SESSION_COOKIE } from "@/lib/cookie";
 import { getSession } from "@/lib/session-store";
 
-// A fetch stub that walks the three Minnect calls. `overrides` lets a test
-// force a non-200 or a weird body at any step.
-function makeFetchStub(overrides: Partial<Record<"login" | "me" | "feed", Response>> = {}) {
+// A fetch stub that walks the Minnect calls. `overrides` lets a test force a
+// non-200 or a weird body at any step. `revoke` covers the sign-out call.
+function makeFetchStub(
+  overrides: Partial<Record<"login" | "me" | "feed" | "revoke", Response>> = {},
+) {
   return vi.fn(async (input: RequestInfo | URL): Promise<Response> => {
     const url = typeof input === "string" ? input : input.toString();
 
+    if (url.endsWith("/api/v4/auth/revoke-token")) {
+      return (
+        overrides.revoke ??
+        new Response(JSON.stringify({ data: { success: true } }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        })
+      );
+    }
     if (url.endsWith("/api/v4/auth/login")) {
       return (
         overrides.login ??
@@ -181,3 +192,71 @@ describe("GET /api/session", () => {
     expect(json.email).toBe("person@example.com");
   });
 });
+
+function requestWithCookie(method: string, id: string): NextRequest {
+  return new NextRequest("http://localhost/api/session", {
+    method,
+    headers: { cookie: `${SESSION_COOKIE}=${id}` },
+  });
+}
+
+describe("DELETE /api/session", () => {
+  it("revokes, deletes the session, clears the cookie; next GET is 401", async () => {
+    const fetchStub = makeFetchStub();
+    vi.stubGlobal("fetch", fetchStub);
+
+    const postRes = await POST(postRequest({ email: "person@example.com", password: "right" }));
+    const id = postRes.cookies.get(SESSION_COOKIE)!.value;
+    expect(getSession(id)).not.toBeNull();
+
+    const delRes = await DELETE(requestWithCookie("DELETE", id));
+    expect(delRes.status).toBe(200);
+
+    // The revoke-token call was made.
+    expect(
+      fetchStub.mock.calls.some(([u]) => String(u).endsWith("/api/v4/auth/revoke-token")),
+    ).toBe(true);
+
+    // Cookie is cleared (empty value, immediate expiry).
+    const cookie = delRes.cookies.get(SESSION_COOKIE);
+    expect(cookie?.value).toBe("");
+    expect(cookie?.maxAge).toBe(0);
+
+    // Session is gone.
+    expect(getSession(id)).toBeNull();
+
+    // The next token-requiring call (GET) returns 401 sign_in.
+    const getRes = await GET(requestWithCookie("GET", id));
+    expect(getRes.status).toBe(401);
+    expect(await getRes.json()).toEqual({ error: "sign_in" });
+  });
+
+  it("still succeeds when revoke returns an error", async () => {
+    vi.stubGlobal("fetch", makeFetchStub());
+    const postRes = await POST(postRequest({ email: "person@example.com", password: "right" }));
+    const id = postRes.cookies.get(SESSION_COOKIE)!.value;
+
+    // Now make revoke fail.
+    vi.stubGlobal(
+      "fetch",
+      makeFetchStub({
+        revoke: new Response(JSON.stringify({ data: null }), {
+          status: 500,
+          headers: { "content-type": "application/json" },
+        }),
+      }),
+    );
+
+    const delRes = await DELETE(requestWithCookie("DELETE", id));
+    expect(delRes.status).toBe(200);
+    expect(delRes.cookies.get(SESSION_COOKIE)?.value).toBe("");
+    expect(getSession(id)).toBeNull();
+  });
+
+  it("no cookie: still 200 and clears the cookie", async () => {
+    vi.stubGlobal("fetch", makeFetchStub());
+    const delRes = await DELETE(new NextRequest("http://localhost/api/session", { method: "DELETE" }));
+    expect(delRes.status).toBe(200);
+    expect(delRes.cookies.get(SESSION_COOKIE)?.value).toBe("");
+  });
+});