sdyl405w4: Remove the sign-out feature and the Minnect revoke call

tests/session.test.ts

@@ -1,26 +1,17 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { NextRequest } from "next/server";
-import { DELETE, GET, POST } from "@/app/api/session/route";
+import { GET, POST } from "@/app/api/session/route";
 import { SESSION_COOKIE } from "@/lib/cookie";
 import { getSession } from "@/lib/session-store";
 
 // A fetch stub that walks the Minnect calls. `overrides` lets a test force a
-// non-200 or a weird body at any step. `revoke` covers the sign-out call.
+// non-200 or a weird body at any step.
 function makeFetchStub(
-  overrides: Partial<Record<"login" | "me" | "feed" | "revoke", Response>> = {},
+  overrides: Partial<Record<"login" | "me" | "feed", Response>> = {},
 ) {
   return vi.fn(async (input: RequestInfo | URL): Promise<Response> => {
     const url = typeof input === "string" ? input : input.toString();
 
-    if (url.endsWith("/api/v4/auth/revoke-token")) {
-      return (
-        overrides.revoke ??
-        new Response(JSON.stringify({ data: { success: true } }), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        })
-      );
-    }
     if (url.endsWith("/api/v4/auth/login")) {
       return (
         overrides.login ??
@@ -193,70 +184,3 @@ describe("GET /api/session", () => {
   });
 });
 
-function requestWithCookie(method: string, id: string): NextRequest {
-  return new NextRequest("http://localhost/api/session", {
-    method,
-    headers: { cookie: `${SESSION_COOKIE}=${id}` },
-  });
-}
-
-describe("DELETE /api/session", () => {
-  it("revokes, deletes the session, clears the cookie; next GET is 401", async () => {
-    const fetchStub = makeFetchStub();
-    vi.stubGlobal("fetch", fetchStub);
-
-    const postRes = await POST(postRequest({ email: "person@example.com", password: "right" }));
-    const id = postRes.cookies.get(SESSION_COOKIE)!.value;
-    expect(getSession(id)).not.toBeNull();
-
-    const delRes = await DELETE(requestWithCookie("DELETE", id));
-    expect(delRes.status).toBe(200);
-
-    // The revoke-token call was made.
-    expect(
-      fetchStub.mock.calls.some(([u]) => String(u).endsWith("/api/v4/auth/revoke-token")),
-    ).toBe(true);
-
-    // Cookie is cleared (empty value, immediate expiry).
-    const cookie = delRes.cookies.get(SESSION_COOKIE);
-    expect(cookie?.value).toBe("");
-    expect(cookie?.maxAge).toBe(0);
-
-    // Session is gone.
-    expect(getSession(id)).toBeNull();
-
-    // The next token-requiring call (GET) returns 401 sign_in.
-    const getRes = await GET(requestWithCookie("GET", id));
-    expect(getRes.status).toBe(401);
-    expect(await getRes.json()).toEqual({ error: "sign_in" });
-  });
-
-  it("still succeeds when revoke returns an error", async () => {
-    vi.stubGlobal("fetch", makeFetchStub());
-    const postRes = await POST(postRequest({ email: "person@example.com", password: "right" }));
-    const id = postRes.cookies.get(SESSION_COOKIE)!.value;
-
-    // Now make revoke fail.
-    vi.stubGlobal(
-      "fetch",
-      makeFetchStub({
-        revoke: new Response(JSON.stringify({ data: null }), {
-          status: 500,
-          headers: { "content-type": "application/json" },
-        }),
-      }),
-    );
-
-    const delRes = await DELETE(requestWithCookie("DELETE", id));
-    expect(delRes.status).toBe(200);
-    expect(delRes.cookies.get(SESSION_COOKIE)?.value).toBe("");
-    expect(getSession(id)).toBeNull();
-  });
-
-  it("no cookie: still 200 and clears the cookie", async () => {
-    vi.stubGlobal("fetch", makeFetchStub());
-    const delRes = await DELETE(new NextRequest("http://localhost/api/session", { method: "DELETE" }));
-    expect(delRes.status).toBe(200);
-    expect(delRes.cookies.get(SESSION_COOKIE)?.value).toBe("");
-  });
-});