223 lines
16 KiB
JavaScript
223 lines
16 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
import { readFileSync } from 'node:fs'
|
|
import ts from 'typescript'
|
|
import axios from 'axios'
|
|
|
|
function compile(name, dependencies = {}) {
|
|
const source = readFileSync(new URL(name, import.meta.url), 'utf8')
|
|
.replace('import.meta.env.VITE_API_BASE_URL', "'/api'")
|
|
const code = ts.transpileModule(source, {
|
|
compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022, esModuleInterop: true },
|
|
}).outputText
|
|
const exports = {}
|
|
new Function('require', 'exports', code)((id) => {
|
|
assert.ok(id in dependencies, `unexpected dependency ${id}`)
|
|
return dependencies[id]
|
|
}, exports)
|
|
return exports
|
|
}
|
|
|
|
function access(user, tenant = 1, membership = 1, nonce = 'original') {
|
|
return `test.${Buffer.from(JSON.stringify({ user_id: user, tenant_id: tenant, membership_id: membership, app_code: 'MERCHANT', nonce })).toString('base64url')}.test`
|
|
}
|
|
const oldAccess = access(1)
|
|
const newAccess = access(1, 1, 1, 'rotated')
|
|
const otherAccess = access(2, 2, 2)
|
|
|
|
function harness(adapter) {
|
|
let token = oldAccess
|
|
let refreshToken = 'old-refresh'
|
|
const http = compile('./http.ts', {
|
|
axios: { ...axios, create: (config) => axios.create({ ...config, adapter }) },
|
|
'@chongchong/shared': { parseApiJsonResponse: (data) => data },
|
|
'@/api/session': {
|
|
accessTokenIdentity: compile('./session.ts').accessTokenIdentity,
|
|
getAccessToken: () => token, getRefreshToken: () => refreshToken,
|
|
persistTokenPair: (tokens) => { token = tokens.accessToken; refreshToken = tokens.refreshToken },
|
|
clearSessionTokens: () => { token = ''; refreshToken = '' },
|
|
},
|
|
'@/api/errorDetails': compile('./errorDetails.ts'),
|
|
'@/api/types': compile('./types.ts'),
|
|
'@/api/crossTabRefresh': compile('./crossTabRefresh.ts'),
|
|
})
|
|
return { ...http, setSession: (access, refresh) => { token = access; refreshToken = refresh }, session: () => ({ token, refreshToken }) }
|
|
}
|
|
|
|
test('order and lastleg 401s share one refresh and replay the unified access token', async () => {
|
|
let refreshes = 0
|
|
const calls = []
|
|
const http = harness(async (config) => {
|
|
calls.push({ url: config.url, base: config.baseURL, token: config.headers.Authorization })
|
|
if (config.url === '/auth/refresh') {
|
|
refreshes++
|
|
await new Promise((resolve) => setTimeout(resolve, 10))
|
|
return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: newAccess, refreshToken: 'new-refresh' } } }
|
|
}
|
|
if (config.headers.Authorization === `Bearer ${oldAccess}`) {
|
|
throw new axios.AxiosError('Expired', 'ERR_BAD_REQUEST', config, null, { status: 401, data: { code: 'A0401', message: 'Expired' } })
|
|
}
|
|
return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: config.url } }
|
|
})
|
|
const urls = ['/merchant/v1/orders', '/merchant/v1/last-leg/inbound-plans']
|
|
assert.deepEqual(await Promise.all(urls.map((url) => http.apiRequest({ url }))), urls)
|
|
assert.equal(refreshes, 1)
|
|
assert.ok(calls.every((call) => call.base === '/api'))
|
|
assert.equal(calls.find((call) => call.url === '/auth/refresh').token, undefined)
|
|
assert.equal(calls.filter((call) => call.token === `Bearer ${newAccess}`).length, 2)
|
|
})
|
|
|
|
test('successful order submit with explicit null data is accepted', async () => {
|
|
const http = harness(async (config) => ({
|
|
config, status: 200, headers: {}, data: { code: '200', message: 'success', data: null },
|
|
}))
|
|
assert.equal(await http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/order-1/submit' }), null)
|
|
})
|
|
|
|
test('data-less security failures preserve diagnostics and malformed success is rejected', async () => {
|
|
for (const data of [{ code: 'A0403', message: 'Denied', traceId: 'trace-1', requestId: 'request-1' }, { code: '200', message: 'OK' }]) {
|
|
const http = harness(async (config) => ({ config, status: 200, headers: {}, data }))
|
|
await assert.rejects(http.apiRequest({ url: '/merchant/v1/last-leg/inbound-plans' }), (error) => {
|
|
assert.equal(error.code, data.code === '200' ? 'INVALID_RESPONSE' : 'A0403')
|
|
if (data.code !== '200') { assert.equal(error.traceId, 'trace-1'); assert.equal(error.requestId, 'request-1') }
|
|
return true
|
|
})
|
|
}
|
|
})
|
|
|
|
test('late refresh response cannot overwrite a session changed in another tab', async () => {
|
|
let complete, started
|
|
const ready = new Promise(resolve => { started = resolve })
|
|
const response = new Promise(resolve => { complete = resolve })
|
|
const http = harness(async config => { started(); await response; return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: oldAccess, refreshToken: 'stale-refresh' } } } })
|
|
const pending = http.refreshAuthenticatedSession()
|
|
await ready
|
|
http.setSession(otherAccess, 'other-refresh')
|
|
complete()
|
|
await pending.catch(error => assert.equal(error.code, 'SESSION_CHANGED'))
|
|
assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'other-refresh' })
|
|
})
|
|
|
|
function deferred() { let resolve; const promise = new Promise(yes => { resolve = yes }); return { promise, resolve } }
|
|
|
|
function unauthorized(config) {
|
|
return new axios.AxiosError('Expired', 'ERR_BAD_REQUEST', config, null, { status: 401, data: { code: 'A0401', message: 'Expired' } })
|
|
}
|
|
|
|
test('late A write 401 after user, customer or membership switch never refreshes or replays under B', async () => {
|
|
for (const next of [access(2), access(1, 2), access(1, 1, 2)]) {
|
|
const sent = deferred(), release = deferred(), calls = []
|
|
const http = harness(async config => {
|
|
calls.push(config.url); sent.resolve(); await release.promise
|
|
throw unauthorized(config)
|
|
})
|
|
const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit', data: { expectedVersion: 1 } })
|
|
const rejected = assert.rejects(pending, error => error.code === 'SESSION_CHANGED')
|
|
await sent.promise; http.setSession(next, 'refresh-b'); release.resolve(); await rejected
|
|
assert.deepEqual(calls, ['/merchant/v1/orders/first-leg/one/submit'])
|
|
assert.deepEqual(http.session(), { token: next, refreshToken: 'refresh-b' })
|
|
}
|
|
})
|
|
|
|
test('switch during in-flight refresh cannot reuse B token to replay an A write', async () => {
|
|
const refreshing = deferred(), release = deferred(), calls = []
|
|
const http = harness(async config => {
|
|
calls.push(config.url)
|
|
if (config.url === '/auth/refresh') {
|
|
refreshing.resolve(); await release.promise
|
|
return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: newAccess, refreshToken: 'new-refresh' } } }
|
|
}
|
|
throw unauthorized(config)
|
|
})
|
|
const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit' })
|
|
const rejected = assert.rejects(pending, error => error.code === 'SESSION_CHANGED')
|
|
await refreshing.promise; http.setSession(otherAccess, 'refresh-b'); release.resolve(); await rejected
|
|
assert.deepEqual(calls, ['/merchant/v1/orders/first-leg/one/submit', '/auth/refresh'])
|
|
assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'refresh-b' })
|
|
})
|
|
|
|
test('refresh lock wait reuses same-identity rotation but rejects changed-identity reuse', async t => {
|
|
const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, 'navigator')
|
|
t.after(() => { if (originalNavigator) Object.defineProperty(globalThis, 'navigator', originalNavigator); else delete globalThis.navigator })
|
|
for (const next of [newAccess, otherAccess]) {
|
|
const waiting = deferred(), release = deferred(), calls = []
|
|
Object.defineProperty(globalThis, 'navigator', { configurable: true, value: { locks: { request: async (_name, _options, run) => {
|
|
waiting.resolve(); await release.promise; return run()
|
|
} } } })
|
|
const http = harness(async config => {
|
|
calls.push({ url: config.url, authorization: config.headers.Authorization })
|
|
if (config.headers.Authorization === `Bearer ${oldAccess}`) throw unauthorized(config)
|
|
return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: null } }
|
|
})
|
|
const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit' })
|
|
const outcome = next === otherAccess ? assert.rejects(pending, error => error.code === 'SESSION_CHANGED') : pending
|
|
await waiting.promise; http.setSession(next, 'rotated-refresh'); release.resolve(); await outcome
|
|
assert.equal(calls.some(call => call.url === '/auth/refresh'), false)
|
|
assert.equal(calls.length, next === otherAccess ? 1 : 2)
|
|
assert.deepEqual(http.session(), { token: next, refreshToken: 'rotated-refresh' })
|
|
}
|
|
})
|
|
|
|
function authApi(http) { return compile('../modules/auth/api/auth.ts', { '@/api/http': http }) }
|
|
function ok(config, data = null) { return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data } } }
|
|
test('logout after immediate local clear revokes captured Bearer and Refresh', async () => {
|
|
const calls=[]; const http=harness(async c=>{calls.push(c);return ok(c)})
|
|
http.setSession('', '');await authApi(http).logoutMerchant(oldAccess,'old-refresh')
|
|
assert.equal(calls.length,1);assert.equal(calls[0].headers.Authorization,`Bearer ${oldAccess}`)
|
|
assert.deepEqual(JSON.parse(calls[0].data),{refreshToken:'old-refresh'});assert.deepEqual(http.session(),{token:'',refreshToken:''})
|
|
})
|
|
test('only explicit logout401 refreshes once and revokes same-identity replacement without storing it', async () => {
|
|
const calls=[];const http=harness(async c=>{calls.push(c);if(c.url==='/auth/refresh')return ok(c,{accessToken:newAccess,refreshToken:'new-refresh'});if(c.headers.Authorization===`Bearer ${oldAccess}`)throw unauthorized(c);return ok(c)})
|
|
http.setSession('','');await authApi(http).logoutMerchant(oldAccess,'old-refresh')
|
|
assert.deepEqual(calls.map(x=>x.url),['/auth/logout','/auth/refresh','/auth/logout']);assert.equal(calls[2].headers.Authorization,`Bearer ${newAccess}`);assert.equal(JSON.parse(calls[2].data).refreshToken,'new-refresh');assert.deepEqual(http.session(),{token:'',refreshToken:''})
|
|
})
|
|
test('unknown logout failure never refreshes; changed identity cannot be revoked as replacement', async () => {
|
|
for(const mode of ['network','wrongIdentity','second401']){const calls=[];const http=harness(async c=>{calls.push(c);if(mode==='network')throw new axios.AxiosError('offline',axios.AxiosError.ERR_NETWORK,c);if(c.url==='/auth/refresh')return ok(c,{accessToken:mode==='wrongIdentity'?otherAccess:newAccess,refreshToken:'replacement'});throw unauthorized(c)})
|
|
http.setSession('','');await assert.rejects(authApi(http).logoutMerchant(oldAccess,'old-refresh'));assert.equal(calls.length,mode==='network'?1:mode==='wrongIdentity'?2:3);assert.deepEqual(http.session(),{token:'',refreshToken:''})}
|
|
})
|
|
test('logout consumes already inflight refresh once while old business caller cannot revive session',async()=>{
|
|
const started=deferred(),release=deferred(),calls=[];const http=harness(async c=>{calls.push(c);if(c.url==='/auth/refresh'){started.resolve();await release.promise;return ok(c,{accessToken:newAccess,refreshToken:'new-refresh'})}return ok(c)})
|
|
const refreshing=http.refreshAuthenticatedSession();const rejected=assert.rejects(refreshing,e=>e.code==='SESSION_CHANGED');await started.promise
|
|
const leaving=authApi(http).logoutMerchant(oldAccess,'old-refresh');http.setSession('','');release.resolve();await leaving;await rejected
|
|
assert.deepEqual(calls.map(x=>x.url),['/auth/refresh','/auth/logout']);assert.equal(calls[1].headers.Authorization,`Bearer ${newAccess}`);assert.deepEqual(http.session(),{token:'',refreshToken:''})
|
|
})
|
|
test('late successful business response after logout rejects even after same-identity new login',async()=>{
|
|
const started=deferred(),release=deferred();const http=harness(async c=>{if(c.url==='/merchant/v1/orders'){started.resolve();await release.promise}return ok(c,'old-data')})
|
|
const pending=http.apiRequest({url:'/merchant/v1/orders'});const rejected=assert.rejects(pending,e=>e.code==='SESSION_CHANGED');await started.promise
|
|
await authApi(http).logoutMerchant(oldAccess,'old-refresh');http.setSession(newAccess,'new-login-refresh');release.resolve();await rejected;assert.equal(http.session().refreshToken,'new-login-refresh')
|
|
})
|
|
|
|
test('inflight refresh unknown outcome stops logout without competing retry and preserves later login',async()=>{
|
|
const started=deferred(),release=deferred(),calls=[];const http=harness(async c=>{calls.push(c);started.resolve();await release.promise;throw new axios.AxiosError('offline',axios.AxiosError.ERR_NETWORK,c)})
|
|
const refreshing=http.refreshAuthenticatedSession();const rejected=assert.rejects(refreshing);await started.promise
|
|
const leaving=authApi(http).logoutMerchant(oldAccess,'old-refresh');const failure=assert.rejects(leaving,e=>e.code==='NETWORK_ERROR');http.setSession(otherAccess,'other-refresh');release.resolve();await failure;await rejected
|
|
assert.equal(calls.length,1);assert.deepEqual(http.session(),{token:otherAccess,refreshToken:'other-refresh'})
|
|
})
|
|
test('logout401 refresh and replacement revocation cannot overwrite later login',async()=>{
|
|
const started=deferred(),release=deferred(),calls=[];const http=harness(async c=>{calls.push(c);if(c.url==='/auth/refresh'){started.resolve();await release.promise;return ok(c,{accessToken:newAccess,refreshToken:'new-refresh'})}if(c.headers.Authorization===`Bearer ${oldAccess}`)throw unauthorized(c);return ok(c)})
|
|
const leaving=authApi(http).logoutMerchant(oldAccess,'old-refresh');http.setSession('','');await started.promise;http.setSession(otherAccess,'other-refresh');release.resolve();await leaving
|
|
assert.equal(calls[2].headers.Authorization,`Bearer ${newAccess}`);assert.deepEqual(http.session(),{token:otherAccess,refreshToken:'other-refresh'})
|
|
})
|
|
test('late old business401 after logout does not refresh or replay under same-identity new login',async()=>{
|
|
const started=deferred(),release=deferred(),calls=[];const http=harness(async c=>{calls.push(c);if(c.url==='/merchant/v1/orders/first-leg/one/submit'){started.resolve();await release.promise;throw unauthorized(c)}return ok(c)})
|
|
const request=http.apiRequest({method:'POST',url:'/merchant/v1/orders/first-leg/one/submit'});const rejected=assert.rejects(request,e=>e.code==='SESSION_CHANGED');await started.promise;await authApi(http).logoutMerchant(oldAccess,'old-refresh');http.setSession(newAccess,'new-login-refresh');release.resolve();await rejected
|
|
assert.deepEqual(calls.map(x=>x.url),['/merchant/v1/orders/first-leg/one/submit','/auth/logout']);assert.equal(http.session().refreshToken,'new-login-refresh')
|
|
})
|
|
|
|
test('same identity new pair logout does not adopt another session inflight refresh',async()=>{
|
|
const started=deferred(),release=deferred(),calls=[];const http=harness(async c=>{calls.push(c);if(c.url==='/auth/refresh'){started.resolve();await release.promise;return ok(c,{accessToken:newAccess,refreshToken:'old-session-rotated'})}return ok(c)})
|
|
const refreshing=http.refreshAuthenticatedSession();const rejected=assert.rejects(refreshing);await started.promise;http.setSession(newAccess,'new-login-refresh')
|
|
const leaving=authApi(http).logoutMerchant(newAccess,'new-login-refresh');http.setSession('','');await leaving
|
|
assert.equal(calls[1].headers.Authorization,`Bearer ${newAccess}`);assert.equal(JSON.parse(calls[1].data).refreshToken,'new-login-refresh');release.resolve();await rejected;assert.deepEqual(http.session(),{token:'',refreshToken:''})
|
|
})
|
|
|
|
test('logout rejects refreshed 19 digit identity differing only in low digit',async()=>{
|
|
const raw='{"user_id":2107003446494334978,"tenant_id":2107003446494334978,"membership_id":2107003446494334978,"app_code":"MERCHANT"}'
|
|
const original=`test.${Buffer.from(raw).toString('base64url')}.test`
|
|
for(const field of ['user_id','tenant_id','membership_id']){
|
|
const changed=raw.replace(`"${field}":2107003446494334978`,`"${field}":2107003446494334979`),calls=[]
|
|
const http=harness(async c=>{calls.push(c);if(c.url==='/auth/refresh')return ok(c,{accessToken:`test.${Buffer.from(changed).toString('base64url')}.test`,refreshToken:'replacement'});throw unauthorized(c)})
|
|
http.setSession('','');await assert.rejects(authApi(http).logoutMerchant(original,'original-refresh'),e=>e.code==='SESSION_CHANGED');assert.equal(calls.length,2)
|
|
}
|
|
})
|