homeio

1import { beforeEach, describe, expect, it, vi } from "vitest";
2
3describe("session token", () => {
4  beforeEach(() => {
5    vi.resetModules();
6  });
7
8  it("creates and verifies a valid token", async () => {
9    vi.doMock("@/lib/server/env", () => ({
10      serverEnv: {
11        AUTH_SESSION_SECRET: "a-very-long-secret-for-tests",
12      },
13    }));
14
15    const { createSessionToken, verifySessionToken } = await import(
16      "@/lib/server/modules/auth/session-token"
17    );
18
19    const expiresAt = Math.floor(Date.now() / 1000) + 3600;
20    const token = createSessionToken("session-123", expiresAt);
21
22    expect(verifySessionToken(token)).toEqual({
23      sessionId: "session-123",
24      expiresAtEpochSeconds: expiresAt,
25    });
26  });
27
28  it("rejects tampered token", async () => {
29    vi.doMock("@/lib/server/env", () => ({
30      serverEnv: {
31        AUTH_SESSION_SECRET: "a-very-long-secret-for-tests",
32      },
33    }));
34
35    const { createSessionToken, verifySessionToken } = await import(
36      "@/lib/server/modules/auth/session-token"
37    );
38
39    const expiresAt = Math.floor(Date.now() / 1000) + 3600;
40    const token = createSessionToken("session-123", expiresAt);
41
42    expect(verifySessionToken(`${token}tampered`)).toBeNull();
43  });
44});
45