27 lines
1.6 KiB
JavaScript
27 lines
1.6 KiB
JavaScript
/**
|
|
* 会话 cookie 的期限与属性单元测试。直接调用格式化函数，不连接浏览器 cookie jar 或真实认证后端。
|
|
* 后端剩余期限与前端 30 天上限取有效结果；数值 0 表示立即过期，非法输入回退默认值。
|
|
*/
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { sessionCookie, sessionMaxAge, SESSION_IDLE_SECONDS } from "../src/lib/session-cookie.ts";
|
|
|
|
// 核对秒数常量、可解析整数字符串与最大期限；0 不可误回退，负数、非有限值、非整数等使用默认 30 天。
|
|
test("session cookies respect backend remaining lifetime and a 30-day maximum", () => {
|
|
assert.equal(SESSION_IDLE_SECONDS, 2592000);
|
|
assert.equal(sessionMaxAge(2592000), 2592000);
|
|
assert.equal(sessionMaxAge("3600"), 3600);
|
|
assert.equal(sessionMaxAge(90 * 86400), 2592000);
|
|
assert.equal(sessionMaxAge(0), 0);
|
|
assert.equal(sessionMaxAge(-1), 2592000);
|
|
for (const invalid of [Infinity, "garbage", "1.5", NaN, {}, null]) assert.equal(sessionMaxAge(invalid), 2592000);
|
|
});
|
|
|
|
// 只检查生成的 Set-Cookie 文本：后端期限、HttpOnly、SameSite=Lax、可选 Secure 和 Max-Age=0；不代表端到端会话续期已验证。
|
|
test("renewed cookies retain HttpOnly/SameSite and use the backend-capped deadline", () => {
|
|
const cookie = sessionCookie("session-token", 42, true);
|
|
assert.match(cookie, /Max-Age=42;/); assert.match(cookie, /HttpOnly/); assert.match(cookie, /SameSite=Lax/); assert.match(cookie, /; Secure$/);
|
|
assert(!sessionCookie("session-token", 1000, false).includes("Secure"));
|
|
assert.match(sessionCookie("session-token", 0, true), /Max-Age=0/);
|
|
});
|