7 lines
1.1 KiB
JavaScript
7 lines
1.1 KiB
JavaScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { maxAge, cookie, sameOrigin, allowedAuthMethod } from "../src/lib/auth-policy.mjs";
|
|
test("session renewal honors backend absolute lifetime and clamps idle time",()=>{ assert.equal(maxAge("7"),7);assert.equal(maxAge(99999999),2592000);assert.equal(maxAge(-1),null);assert.equal(maxAge(""),null);assert.equal(maxAge(null),null); });
|
|
test("cookies stay inaccessible to JavaScript and expire on logout",()=>{ assert.match(cookie("secret;bad",90,true),/secret%3Bbad; HttpOnly; SameSite=Lax; Path=\/; Max-Age=90; Secure$/);assert.match(cookie("",0,false),/Max-Age=0$/); });
|
|
test("mutations cannot use another origin or method",()=>{assert.equal(sameOrigin("https://evil.test","http://localhost:17322"),false);assert.equal(sameOrigin("http://localhost:17321","http://localhost:17322"),false);assert.equal(sameOrigin("null","http://localhost:17322"),false);assert.equal(allowedAuthMethod("auth/login","GET"),false);assert.equal(allowedAuthMethod("auth/me","POST"),false);assert.equal(allowedAuthMethod("auth/exchange","POST"),true);assert.equal(allowedAuthMethod("canvas","POST"),false);});
|