fix(auth): revoke captured client sessions safely on logout

2026-10-05 17:13:46 +08:00
parent e139c5c87b
commit 3703d0a677
8 changed files with 175 additions and 28 deletions
@@ -102,7 +102,8 @@ test('opens complete service and privacy documents from registration', () => {
 test('uses real auth endpoints and single-flight refresh handling', () => {
  assert.match(authApiSource, /\/auth\/login/)
  assert.match(authApiSource, /\/auth\/register/)
-  assert.match(authApiSource, /\/auth\/logout/)
+  assert.match(authApiSource, /revokeCapturedSession\(accessToken, refreshToken\)/)
+  assert.match(httpSource, /\/auth\/logout/)
  assert.match(httpSource, /refreshPromise/)
  assert.match(httpSource, /\/auth\/refresh/)
  assert.match(httpSource, /persistTokenPair\(tokens\)/)