homeio

1import { describe, expect, it } from "vitest";
2import {
3  getExpiredSessionCookieOptions,
4  getSessionCookieOptions,
5} from "@/lib/server/modules/auth/cookies";
6
7function makeRequest(url: string, forwardedProto?: string): Request {
8  const headers: HeadersInit = {};
9  if (forwardedProto) headers["x-forwarded-proto"] = forwardedProto;
10  return new Request(url, { headers });
11}
12
13describe("auth cookies", () => {
14  it("uses secure=false for plain http requests", () => {
15    const request = makeRequest("http://192.168.1.67/api/auth/login");
16    expect(getSessionCookieOptions(new Date(Date.now() + 1_000), request).secure).toBe(false);
17    expect(getExpiredSessionCookieOptions(request).secure).toBe(false);
18  });
19
20  it("uses secure=true for https requests", () => {
21    const request = makeRequest("https://homeio.example.com/api/auth/login");
22    expect(getSessionCookieOptions(new Date(Date.now() + 1_000), request).secure).toBe(true);
23    expect(getExpiredSessionCookieOptions(request).secure).toBe(true);
24  });
25
26  it("uses x-forwarded-proto=https even when request URL is http (behind proxy)", () => {
27    const request = makeRequest("http://127.0.0.1:12026/api/auth/login", "https");
28    expect(getSessionCookieOptions(new Date(Date.now() + 1_000), request).secure).toBe(true);
29    expect(getExpiredSessionCookieOptions(request).secure).toBe(true);
30  });
31
32  it("uses x-forwarded-proto=http to override https URL", () => {
33    const request = makeRequest("https://example.com/api/auth/login", "http");
34    expect(getSessionCookieOptions(new Date(Date.now() + 1_000), request).secure).toBe(false);
35    expect(getExpiredSessionCookieOptions(request).secure).toBe(false);
36  });
37});
38