465 lines
36 KiB
JavaScript
465 lines
36 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const vm = require('node:vm');
|
|
const ts = require('typescript');
|
|
const realAxios = require('axios');
|
|
|
|
// Execute the actual TypeScript modules against Axios adapters and a browser stub.
|
|
// No additional runtime/test dependencies, no network, no production API.
|
|
function harness(shared = {}) {
|
|
const local = shared.local || new Map(); const session = new Map(); const redirects = [];
|
|
const listeners = new Map(); const timers = new Map(); let clock = Date.now();
|
|
const storage = map => ({ getItem: key => map.get(key) ?? null, setItem: (key, value) => map.set(key, String(value)), removeItem: key => map.delete(key) });
|
|
const window = { localStorage: storage(local), sessionStorage: storage(session), location: { pathname: '/shop', search: '', replace: value => redirects.push(value) },
|
|
addEventListener: (name, callback) => listeners.set(name, callback), removeEventListener: name => listeners.delete(name) };
|
|
const document = { cookie: '' };
|
|
const axios = realAxios.create(); axios.create = realAxios.create;
|
|
axios.isAxiosError = realAxios.isAxiosError;
|
|
const cache = {};
|
|
const hooks = []; let cursor = 0;
|
|
const react = { ...require('react'), useState: initial => {
|
|
const index = cursor++;
|
|
if (!(index in hooks)) hooks[index] = typeof initial === 'function' ? initial() : initial;
|
|
return [hooks[index], value => { hooks[index] = typeof value === 'function' ? value(hooks[index]) : value; }];
|
|
}, useRef: initial => { const index = cursor++; return hooks[index] ||= { current: initial }; },
|
|
useEffect: (effect, deps) => {
|
|
const index = cursor++; const previous = hooks[index];
|
|
if (!previous || !deps || deps.some((value, i) => value !== previous.deps[i])) {
|
|
previous?.cleanup?.(); hooks[index] = { deps, cleanup: effect() };
|
|
}
|
|
} };
|
|
const queryState = { isLoading: false, isError: false, error: null, refetch: async () => {} };
|
|
const queryClient = { clears: 0, clear() { this.clears++; } };
|
|
let queryOptions;
|
|
const navigator = { locks: Object.hasOwn(shared, 'locks') ? shared.locks : { request: (_name, callback) => callback() } };
|
|
const dispatches = [];
|
|
function render(component, props = {}) { cursor = 0; return component(props); }
|
|
function load(filename) {
|
|
const full = path.resolve(filename);
|
|
if (cache[full]) return cache[full].exports;
|
|
const module = { exports: {} }; cache[full] = module;
|
|
const source = ts.transpileModule(fs.readFileSync(full, 'utf8'), { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020, esModuleInterop: true, jsx: ts.JsxEmit.ReactJSX } }).outputText;
|
|
const requireStub = name => {
|
|
if (name === 'axios') return axios;
|
|
if (name === 'react') return react;
|
|
if (name === 'react/jsx-runtime') return require(name);
|
|
if (name === '@tanstack/react-query') return { useQuery: options => { queryOptions = options; return queryState; }, useQueryClient: () => queryClient };
|
|
if (name === 'next/navigation') return { useRouter: () => ({ push: value => redirects.push(value), replace: value => redirects.push(value) }) };
|
|
if (name === 'react-redux') return { useDispatch: () => action => dispatches.push(action), useSelector: select => select({ mobileopt: { mobile: 9123456789 } }) };
|
|
if (name.includes('mobileoptSlice')) return { addMobile: payload => ({ payload }) };
|
|
const base = path.join('src', name.slice(2));
|
|
return load(base + (fs.existsSync(base + '.ts') ? '.ts' : '.tsx'));
|
|
};
|
|
vm.runInNewContext('(function(require, module, exports){' + source + '\n})', { window, document, navigator, process, Error, Promise, URLSearchParams, console,
|
|
Date: class extends Date { static now() { return clock; } },
|
|
setInterval: callback => { const id = timers.size + 1; timers.set(id, callback); return id; }, clearInterval: id => timers.delete(id),
|
|
setTimeout,
|
|
})(requireStub, module, module.exports);
|
|
return module.exports;
|
|
}
|
|
const auth = load('src/lib/auth.ts');
|
|
const instance = load('src/axios/axiosInstance.ts').default;
|
|
return { auth, instance, axios, local, session, redirects, document, window, load, render, dispatches, listeners, queryState, queryClient,
|
|
get queryOptions() { return queryOptions; }, advance: ms => { clock += ms; timers.forEach(callback => callback()); } };
|
|
}
|
|
function failure(config, status, data = { detail: 'Error' }) {
|
|
return new realAxios.AxiosError('Request failed', 'ERR_BAD_RESPONSE', config, null, { data, status, statusText: 'Failed', headers: {}, config });
|
|
}
|
|
function response(config, data, status = 200) { return { config, data, status, statusText: 'OK', headers: {} }; }
|
|
|
|
test('stores valid tokens and rejects malformed success responses', () => {
|
|
const h = harness();
|
|
h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
assert.equal(h.auth.getAccessToken(), 'access.old');
|
|
assert.equal(h.auth.getRefreshToken(), 'refresh.old');
|
|
assert.match(h.document.cookie, /isAuth=true/);
|
|
assert.throws(() => h.auth.saveTokens({ access: undefined, refresh: 'bad' }));
|
|
});
|
|
test('request with no token never sends Bearer null or undefined', async () => {
|
|
const h = harness();
|
|
h.instance.defaults.adapter = config => { assert.equal(config.headers.Authorization, undefined); return Promise.resolve(response(config, {})); };
|
|
await h.instance.get('/public/');
|
|
});
|
|
test('400, 403, 500 and network failures always reject and preserve session', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
for (const status of [400, 403, 500, null]) {
|
|
h.instance.defaults.adapter = config => Promise.reject(status ? failure(config, status) : new realAxios.AxiosError('Offline', 'ERR_NETWORK', config));
|
|
await assert.rejects(h.instance.get('/customer/v2/create/'));
|
|
assert.equal(h.auth.getAccessToken(), 'access.old');
|
|
assert.equal(h.redirects.length, 0);
|
|
}
|
|
});
|
|
test('simultaneous 401 requests perform one refresh and both retry', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
let calls = 0;
|
|
h.axios.defaults.adapter = async config => { calls++; await new Promise(resolve => setImmediate(resolve)); return response(config, { access: 'access.new', refresh: 'refresh.new' }); };
|
|
h.instance.defaults.adapter = config => config.headers.Authorization === 'Bearer access.old' ? Promise.reject(failure(config, 401)) : Promise.resolve(response(config, { ok: true }));
|
|
const result = await Promise.all([h.instance.get('/first/'), h.instance.get('/second/')]);
|
|
assert.equal(calls, 1); assert.equal(result.length, 2); assert.equal(h.auth.getAccessToken(), 'access.new');
|
|
});
|
|
test('revoked refresh clears tokens, cookie and redirects to login', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
await assert.rejects(h.instance.get('/cuser/info/'));
|
|
assert.equal(h.auth.getAccessToken(), null); assert.equal(h.auth.getRefreshToken(), null);
|
|
assert.equal(h.redirects[0], '/login?reason=session'); assert.match(h.document.cookie, /max-age=0/);
|
|
});
|
|
test('401 without refresh logs out and rejects', async () => {
|
|
const h = harness();
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
await assert.rejects(h.instance.get('/cuser/info/'));
|
|
assert.equal(h.redirects[0], '/login?reason=session');
|
|
});
|
|
test('network failure while refreshing preserves recoverable session', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => Promise.reject(new realAxios.AxiosError('Offline', 'ERR_NETWORK', config));
|
|
await assert.rejects(h.instance.get('/cuser/info/'));
|
|
assert.equal(h.auth.getRefreshToken(), 'refresh.old'); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('malformed refresh success logs out instead of storing undefined', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => Promise.resolve(response(config, { error: 'Invalid' }));
|
|
await assert.rejects(h.instance.get('/cuser/info/'));
|
|
assert.equal(h.auth.getAccessToken(), null);
|
|
});
|
|
test('retry 401 does not refresh forever', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let calls = 0;
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => { calls++; return Promise.resolve(response(config, { access: 'access.new', refresh: 'refresh.new' })); };
|
|
await assert.rejects(h.instance.get('/cuser/info/')); assert.equal(calls, 1); assert.equal(h.auth.getAccessToken(), null);
|
|
});
|
|
test('public auth 401 displays error without triggering token refresh', async () => {
|
|
const h = harness(); let calls = 0;
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => { calls++; return Promise.resolve(response(config, {})); };
|
|
await assert.rejects(h.instance.post('/auth/token/', {}));
|
|
assert.equal(calls, 0); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('logout revokes original refresh token and clears all local identity', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); h.local.set('nameFamily', 'Previous');
|
|
h.axios.defaults.adapter = config => { assert.match(config.url, /auth\/logout/); assert.equal(JSON.parse(config.data).refresh, 'refresh.old'); return Promise.resolve(response(config, null, 204)); };
|
|
await h.auth.logout(); assert.equal(h.local.size, 0); assert.equal(h.redirects[0], '/login');
|
|
});
|
|
test('late refresh response cannot restore a logged-out session', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let resolveRefresh;
|
|
h.instance.defaults.adapter = config => Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => new Promise(resolve => { resolveRefresh = () => resolve(response(config, { access: 'access.new', refresh: 'refresh.new' })); });
|
|
const pending = h.instance.get('/cuser/info/');
|
|
await new Promise(resolve => setImmediate(resolve)); h.auth.clearSession(); resolveRefresh();
|
|
await assert.rejects(pending); assert.equal(h.auth.getAccessToken(), null);
|
|
});
|
|
test('API messages including duplicate mobile and SMS failure are preserved', () => {
|
|
const h = harness();
|
|
const config = {};
|
|
assert.equal(h.auth.apiErrorMessage(failure(config, 400, { mobile: ['شماره تکراری است'] })), 'شماره تکراری است');
|
|
assert.equal(h.auth.apiErrorMessage(failure(config, 503, { detail: 'ارسال پیامک انجام نشد' })), 'ارسال پیامک انجام نشد');
|
|
});
|
|
|
|
function elements(tree, predicate) {
|
|
if (!tree || typeof tree !== 'object') return [];
|
|
if (Array.isArray(tree)) return tree.flatMap(item => elements(item, predicate));
|
|
return [...(predicate(tree) ? [tree] : []), ...elements(tree.props?.children, predicate)];
|
|
}
|
|
function textContent(tree) {
|
|
if (typeof tree === 'string' || typeof tree === 'number') return String(tree);
|
|
if (Array.isArray(tree)) return tree.map(textContent).join('');
|
|
return tree?.props ? textContent(tree.props.children) : '';
|
|
}
|
|
test('login page renders API errors and re-enables submit', async () => {
|
|
const h = harness(); const component = h.load('src/components/auth/customer-login-form.tsx').default;
|
|
elements(h.render(component), item => item.type === 'input')[0].props.onChange({ target: { value: '09123456789' } });
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, 503, { detail: 'ارسال پیامک انجام نشد' }));
|
|
const form = elements(h.render(component), item => item.type === 'form')[0];
|
|
await form.props.onSubmit({ preventDefault() {} });
|
|
const tree = h.render(component);
|
|
const alerts = elements(tree, item => item.props?.role === 'alert');
|
|
assert.ok(alerts.some(item => textContent(item).includes('ارسال پیامک انجام نشد')));
|
|
assert.ok(elements(tree, item => item.type === 'button').some(item => !item.props.disabled));
|
|
assert.equal(h.redirects.length, 0);
|
|
});
|
|
|
|
test('customer login does not navigate when SMS is rejected or account is absent', async () => {
|
|
const h = harness(); const component = h.load('src/components/auth/customer-login-form.tsx').default;
|
|
elements(h.render(component), item => item.type === 'input')[0].props.onChange({ target: { value: '09123456789' } });
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, 400, { mobile: ['کاربر ثبت نشده است'] }));
|
|
await elements(h.render(component), item => item.type === 'form')[0].props.onSubmit({ preventDefault() {} });
|
|
assert.ok(textContent(h.render(component)).includes('کاربر ثبت نشده است'));
|
|
assert.equal(h.dispatches.length, 0); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('OTP page retains code input after wrong code', async () => {
|
|
const h = harness(); const component = h.load('src/components/auth/customer-login-form.tsx').default;
|
|
h.auth.rememberLoginMobile('9123456789');
|
|
const render = () => h.render(component, { initialStep: 'verify' });
|
|
let tree = render();
|
|
elements(tree, item => item.type === 'input')[0].props.onChange({ target: { value: '۱۲۳۴۵۶' } });
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, 400, { opt: ['کد تأیید اشتباه است'] }));
|
|
await elements(render(), item => item.type === 'form')[0].props.onSubmit({ preventDefault() {} });
|
|
tree = render();
|
|
assert.ok(textContent(tree).includes('کد تأیید اشتباه است'));
|
|
assert.equal(elements(tree, item => item.type === 'input')[0].props.value, '۱۲۳۴۵۶');
|
|
assert.equal(h.redirects.length, 0);
|
|
});
|
|
|
|
test('a stale retry failure does not clear a newer session from another tab', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.instance.defaults.adapter = config => {
|
|
if (config.headers.Authorization === 'Bearer access.new') h.auth.saveTokens({ access: 'access.other-tab', refresh: 'refresh.other-tab' });
|
|
return Promise.reject(failure(config, 401));
|
|
};
|
|
h.axios.defaults.adapter = config => Promise.resolve(response(config, { access: 'access.new', refresh: 'refresh.new' }));
|
|
await assert.rejects(h.instance.get('/cuser/info/'));
|
|
assert.equal(h.auth.getAccessToken(), 'access.other-tab'); assert.equal(h.redirects.length, 0);
|
|
});
|
|
|
|
function customerForm(h, props = {}) {
|
|
const component = h.load('src/components/auth/customer-login-form.tsx').default;
|
|
return { render: () => h.render(component, props), submit: () => elements(h.render(component, props), item => item.type === 'form')[0].props.onSubmit({ preventDefault() {} }),
|
|
input: value => elements(h.render(component, props), item => item.type === 'input')[0].props.onChange({ target: { value } }) };
|
|
}
|
|
const customerOption = name => ({ uuid: name, cuser_role: { sys_ws: { name }, role_type: { role_name_en: 'workspace_customer' } } });
|
|
const settle = () => new Promise(resolve => setImmediate(resolve));
|
|
|
|
test('SMS success displays OTP in the same page even when sessionStorage is blocked', async () => {
|
|
const h = harness(); const form = customerForm(h);
|
|
h.window.sessionStorage.setItem = () => { throw new Error('Storage denied'); };
|
|
h.axios.defaults.adapter = config => Promise.resolve(response(config, { result: { mobile: 9123456789, retry_after: 60 } }));
|
|
form.input('۰۹۱۲۳۴۵۶۷۸۹');
|
|
await form.submit();
|
|
assert.ok(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length);
|
|
assert.ok(textContent(form.render()).includes('09123456789'));
|
|
assert.equal(h.redirects.length, 0);
|
|
assert.equal(h.auth.readLoginMobile(), '9123456789');
|
|
});
|
|
test('same-render double login submits only one SMS request', async () => {
|
|
const h = harness(); const form = customerForm(h); let resolve; let requests = 0;
|
|
form.input('09123456789');
|
|
h.axios.defaults.adapter = config => { requests++; return new Promise(done => { resolve = () => done(response(config, { result: { mobile: 9123456789 } })); }); };
|
|
const handler = elements(form.render(), item => item.type === 'form')[0].props.onSubmit;
|
|
const first = handler({ preventDefault() {} }); const second = handler({ preventDefault() {} });
|
|
await settle(); assert.equal(requests, 1);
|
|
assert.ok(elements(form.render(), item => item.type === 'button').every(item => item.props.disabled));
|
|
resolve(); await Promise.all([first, second]);
|
|
});
|
|
test('absent account and disabled panel messages render without navigating or opening OTP', async () => {
|
|
for (const [status, message] of [[400, 'کاربری با این شماره ثبت نشده است'], [403, 'دسترسی شما به پنل مشتریان فعال نیست']]) {
|
|
const h = harness(); const form = customerForm(h); form.input('09123456789');
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, status, { detail: message }));
|
|
await form.submit();
|
|
assert.ok(textContent(form.render()).includes(message));
|
|
assert.equal(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length, 0);
|
|
assert.equal(h.redirects.length, 0);
|
|
}
|
|
});
|
|
test('lost SMS response permits entering the code that was actually received', async () => {
|
|
const h = harness(); const form = customerForm(h); form.input('09123456789');
|
|
h.axios.defaults.adapter = config => Promise.reject(new realAxios.AxiosError('Timeout', 'ECONNABORTED', config));
|
|
await form.submit();
|
|
const recovery = elements(form.render(), item => item.type === 'button' && textContent(item).includes('دریافت کرده'))[0];
|
|
assert.ok(recovery); recovery.props.onClick();
|
|
assert.ok(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length);
|
|
});
|
|
test('429 displays a countdown and can recover the previously sent code', async () => {
|
|
const h = harness(); const form = customerForm(h); form.input('09123456789');
|
|
h.axios.defaults.adapter = config => Promise.reject(failure(config, 429, { detail: 'کد قبلی را وارد کنید', retry_after: 30 }));
|
|
await form.submit();
|
|
const tree = form.render();
|
|
assert.ok(textContent(tree).includes('30 ثانیه'));
|
|
assert.equal(elements(tree, item => item.type === 'button' && item.props.type === 'submit')[0].props.disabled, true);
|
|
h.advance(31000);
|
|
assert.equal(elements(form.render(), item => item.type === 'button' && item.props.type === 'submit')[0].props.disabled, false);
|
|
});
|
|
test('resend remains disabled during its cooldown and sends once after it ends', async () => {
|
|
const h = harness(); const form = customerForm(h); form.input('09123456789'); let requests = 0;
|
|
h.axios.defaults.adapter = config => { requests++; return Promise.resolve(response(config, { result: { mobile: 9123456789, retry_after: 60 } })); };
|
|
await form.submit();
|
|
let resend = elements(form.render(), item => item.type === 'button' && textContent(item) === 'دریافت دوباره کد')[0];
|
|
assert.equal(resend.props.disabled, true); await resend.props.onClick(); assert.equal(requests, 1);
|
|
h.advance(61000);
|
|
resend = elements(form.render(), item => item.type === 'button' && textContent(item) === 'دریافت دوباره کد')[0];
|
|
assert.equal(resend.props.disabled, false); await resend.props.onClick(); assert.equal(requests, 2);
|
|
});
|
|
test('same-render double OTP submit verifies and exchanges tokens only once', async () => {
|
|
const h = harness(); h.auth.rememberLoginMobile('9123456789'); const form = customerForm(h, { initialStep: 'verify' }); form.input('۱۲۳۴۵۶');
|
|
let verifyRequests = 0; let tokenRequests = 0; let release;
|
|
h.axios.defaults.adapter = config => {
|
|
if (config.url.includes('/verify/')) { verifyRequests++; return new Promise(done => { release = () => done(response(config, [customerOption('Workspace')])); }); }
|
|
tokenRequests++; return Promise.resolve(response(config, { access: 'access.logged-in', refresh: 'refresh.logged-in' }));
|
|
};
|
|
const handler = elements(form.render(), item => item.type === 'form')[0].props.onSubmit;
|
|
const first = handler({ preventDefault() {} }); const second = handler({ preventDefault() {} });
|
|
await settle(); assert.equal(verifyRequests, 1); release(); await Promise.all([first, second]);
|
|
assert.equal(tokenRequests, 1); assert.equal(h.auth.getAccessToken(), 'access.logged-in');
|
|
assert.deepEqual(h.redirects, ['/shop']);
|
|
assert.ok(elements(form.render(), item => item.type === 'button').every(item => item.props.disabled));
|
|
});
|
|
test('token exchange failure preserves verified choices for retry without consuming OTP twice', async () => {
|
|
const h = harness(); h.auth.rememberLoginMobile('9123456789'); const form = customerForm(h, { initialStep: 'verify' }); form.input('123456');
|
|
let verifications = 0; let exchanges = 0;
|
|
h.axios.defaults.adapter = config => {
|
|
if (config.url.includes('/verify/')) { verifications++; return Promise.resolve(response(config, [customerOption('Workspace')])); }
|
|
exchanges++;
|
|
return exchanges === 1 ? Promise.reject(failure(config, 503, { detail: 'ارتباط قطع شد' })) : Promise.resolve(response(config, { access: 'access.ok', refresh: 'refresh.ok' }));
|
|
};
|
|
await form.submit();
|
|
assert.ok(textContent(form.render()).includes('ارتباط قطع شد'));
|
|
const choice = elements(form.render(), item => item.type === 'button' && textContent(item) === 'Workspace')[0];
|
|
await choice.props.onClick();
|
|
assert.equal(verifications, 1); assert.equal(exchanges, 2); assert.deepEqual(h.redirects, ['/shop']);
|
|
});
|
|
test('multiple workspace choice uses a synchronous lock and ignores operator roles', async () => {
|
|
const h = harness(); h.auth.rememberLoginMobile('9123456789'); const form = customerForm(h, { initialStep: 'verify' }); form.input('123456'); let exchanges = 0; let release;
|
|
const operator = customerOption('Operator'); operator.cuser_role.role_type.role_name_en = 'workspace_operator';
|
|
h.axios.defaults.adapter = config => config.url.includes('/verify/') ? Promise.resolve(response(config, [customerOption('One'), customerOption('Two'), operator])) : new Promise(done => { exchanges++; release = () => done(response(config, { access: 'access.ok', refresh: 'refresh.ok' })); });
|
|
await form.submit(); assert.equal(exchanges, 0); assert.ok(!textContent(form.render()).includes('Operator'));
|
|
const choice = elements(form.render(), item => item.type === 'button' && textContent(item) === 'One')[0];
|
|
const first = choice.props.onClick(); const second = choice.props.onClick(); await settle(); assert.equal(exchanges, 1);
|
|
release(); await Promise.all([first, second]);
|
|
});
|
|
test('direct verification URL without navigation state presents a usable mobile form', () => {
|
|
const h = harness(); const form = customerForm(h, { initialStep: 'verify' });
|
|
assert.ok(elements(form.render(), item => item.props?.id === 'mobile').length);
|
|
assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('OTP verified route uses remembered state without Redux or working sessionStorage', () => {
|
|
const h = harness(); h.window.sessionStorage.setItem = () => { throw new Error('denied'); }; h.auth.rememberLoginMobile('9123456789');
|
|
const form = customerForm(h, { initialStep: 'verify' });
|
|
assert.ok(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length);
|
|
});
|
|
test('logout double invocation revokes once and redirects once', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let calls = 0; let release;
|
|
h.axios.defaults.adapter = config => { calls++; return new Promise(done => { release = () => done(response(config, null, 204)); }); };
|
|
const first = h.auth.logout(); const second = h.auth.logout(); assert.equal(first, second);
|
|
await settle(); assert.equal(calls, 1); assert.equal(h.auth.getAccessToken(), null);
|
|
release(); await Promise.all([first, second]); assert.deepEqual(h.redirects, ['/login']);
|
|
});
|
|
test('late login token response after logout is revoked and cannot restore the session', async () => {
|
|
const h = harness(); let release; let revoked = 0;
|
|
h.axios.defaults.adapter = config => config.url.includes('/auth/token/') ? new Promise(done => { release = () => done(response(config, { access: 'access.late', refresh: 'refresh.late' })); }) : (revoked++, Promise.resolve(response(config, null, 204)));
|
|
const pending = h.auth.obtainTokens('login-option'); await settle(); await h.auth.logout(); release();
|
|
await assert.rejects(pending); assert.equal(h.auth.getAccessToken(), null); assert.equal(revoked, 1);
|
|
});
|
|
test('storage failure has a useful message and partially written tokens are rolled back', () => {
|
|
const h = harness(); const original = h.window.localStorage.setItem;
|
|
h.window.localStorage.setItem = (key, value) => { if (key === 'refresh') throw new Error('quota'); original(key, value); };
|
|
assert.throws(() => h.auth.saveTokens({ access: 'access.new', refresh: 'refresh.new' }), /ذخیره/);
|
|
assert.equal(h.auth.getAccessToken(), null); assert.equal(h.auth.getRefreshToken(), null);
|
|
});
|
|
test('clearing session still invalidates in-memory reads when storage removal fails', () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.window.localStorage.removeItem = () => { throw new Error('denied'); };
|
|
h.auth.clearSession(); assert.equal(h.auth.getAccessToken(), null); assert.equal(h.auth.getRefreshToken(), null);
|
|
assert.match(h.document.cookie, /max-age=0/);
|
|
});
|
|
test('old account request is never retried under a newly logged-in identity', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let calls = 0;
|
|
h.instance.defaults.adapter = config => { calls++; h.auth.saveTokens({ access: 'access.other-person', refresh: 'refresh.other-person' }); return Promise.reject(failure(config, 401)); };
|
|
await assert.rejects(h.instance.post('/shop/cart/', { product: 10 }));
|
|
assert.equal(calls, 1); assert.equal(h.auth.getAccessToken(), 'access.other-person'); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('simultaneous refreshes in separate tabs serialize through Web Locks', async () => {
|
|
const local = new Map(); let queue = Promise.resolve(); let lockCalls = 0; let refreshCalls = 0;
|
|
const locks = { request(name, callback) { assert.equal(name, 'crm-customer-jwt-refresh'); lockCalls++; const result = queue.then(callback); queue = result.catch(() => {}); return result; } };
|
|
const first = harness({ local, locks }); const second = harness({ local, locks }); first.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
for (const h of [first, second]) {
|
|
h.instance.defaults.adapter = config => config.headers.Authorization === 'Bearer access.old' ? Promise.reject(failure(config, 401)) : Promise.resolve(response(config, {}));
|
|
h.axios.defaults.adapter = async config => { refreshCalls++; await settle(); return response(config, { access: 'access.rotated', refresh: 'refresh.rotated' }); };
|
|
}
|
|
await Promise.all([first.instance.get('/first/'), second.instance.get('/second/')]);
|
|
assert.equal(lockCalls, 2); assert.equal(refreshCalls, 1); assert.equal(second.auth.getAccessToken(), 'access.rotated');
|
|
});
|
|
test('a new identity can refresh while a previous identity refresh is still pending', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let releaseOld;
|
|
h.instance.defaults.adapter = config => config.headers.Authorization === 'Bearer access.current' ? Promise.resolve(response(config, {})) : Promise.reject(failure(config, 401));
|
|
h.axios.defaults.adapter = config => JSON.parse(config.data).refresh === 'refresh.old' ? new Promise(done => { releaseOld = () => done(response(config, { access: 'access.stale', refresh: 'refresh.stale' })); }) : Promise.resolve(response(config, { access: 'access.current', refresh: 'refresh.current' }));
|
|
const old = h.instance.get('/previous-person/'); await settle(); h.auth.saveTokens({ access: 'access.new-person', refresh: 'refresh.new-person' });
|
|
await h.instance.get('/current-person/'); releaseOld(); await assert.rejects(old);
|
|
assert.equal(h.auth.getAccessToken(), 'access.current'); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('protected UI with a stale routing cookie and no real session never displays children', () => {
|
|
const h = harness(); h.document.cookie = 'isAuth=true'; const guard = h.load('src/components/auth/session-guard.tsx').default;
|
|
const tree = h.render(guard, { children: 'Private customer data' });
|
|
assert.ok(!textContent(tree).includes('Private customer data')); assert.equal(h.queryOptions.enabled, false);
|
|
assert.deepEqual(h.redirects, ['/login?reason=session']);
|
|
});
|
|
test('protected session checks revalidate on focus and periodically, preserving network failure for retry', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); const guard = h.load('src/components/auth/session-guard.tsx').default;
|
|
h.render(guard, { children: 'Private data' }); h.render(guard, { children: 'Private data' });
|
|
assert.equal(h.queryOptions.enabled, true); assert.equal(h.queryOptions.retry, false); assert.equal(h.queryOptions.refetchOnWindowFocus, true); assert.equal(h.queryOptions.refetchInterval, 60000);
|
|
h.queryState.isError = true; h.queryState.error = failure({}, 503, { detail: 'ارتباط موقتاً قطع است' });
|
|
const tree = h.render(guard, { children: 'Private data' });
|
|
assert.ok(textContent(tree).includes('ارتباط موقتاً قطع است')); assert.ok(!textContent(tree).includes('Private data'));
|
|
assert.equal(h.auth.getRefreshToken(), 'refresh.old'); assert.equal(h.redirects.length, 0);
|
|
});
|
|
test('logout or identity change in another tab clears protected cached data', () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); const guard = h.load('src/components/auth/session-guard.tsx').default;
|
|
h.render(guard, { children: 'Private data' }); h.render(guard, { children: 'Private data' });
|
|
h.local.delete('access'); h.local.delete('refresh'); h.local.delete('authSession');
|
|
h.listeners.get('storage')({ key: 'authSession', newValue: null });
|
|
assert.equal(h.queryClient.clears, 1); assert.deepEqual(h.redirects, ['/login?reason=session']);
|
|
assert.ok(!textContent(h.render(guard, { children: 'Private data' })).includes('Private data'));
|
|
});
|
|
|
|
test('invalid stored OTP mobile falls back to the mobile form', () => {
|
|
const h = harness(); h.session.set('loginMobile', 'undefined'); const form = customerForm(h, { initialStep: 'verify' });
|
|
assert.ok(elements(form.render(), item => item.props?.id === 'mobile').length);
|
|
});
|
|
test('new login in another tab survives this tab previously clearing its session', () => {
|
|
const local = new Map(); const first = harness({ local }); const second = harness({ local });
|
|
first.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); first.auth.clearSession();
|
|
second.auth.saveTokens({ access: 'access.new-person', refresh: 'refresh.new-person' });
|
|
assert.equal(first.auth.getAccessToken(), 'access.new-person'); assert.equal(first.auth.getRefreshToken(), 'refresh.new-person');
|
|
});
|
|
test('late successful response from a previous identity is rejected instead of displaying old data', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.instance.defaults.adapter = config => { h.auth.saveTokens({ access: 'access.other-person', refresh: 'refresh.other-person' }); return Promise.resolve(response(config, { private: 'previous person' })); };
|
|
await assert.rejects(h.instance.get('/orders/'), /نشست/);
|
|
assert.equal(h.auth.getAccessToken(), 'access.other-person');
|
|
});
|
|
test('old request sees another-tab rotation and retries without issuing another refresh', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let first = true; let refreshes = 0;
|
|
h.axios.defaults.adapter = config => { refreshes++; return Promise.resolve(response(config, {})); };
|
|
h.instance.defaults.adapter = config => {
|
|
if (first) { first = false; h.auth.saveTokens({ access: 'access.rotated', refresh: 'refresh.rotated' }, 'refresh.old'); return Promise.reject(failure(config, 401)); }
|
|
assert.equal(config.headers.Authorization, 'Bearer access.rotated'); return Promise.resolve(response(config, {}));
|
|
};
|
|
await h.instance.get('/orders/'); assert.equal(refreshes, 0);
|
|
});
|
|
test('navigation wrappers both use the shared form and preserve the verification route', () => {
|
|
const h = harness(); const login = h.load('src/app/(login_register)/login/page.tsx').default;
|
|
const verify = h.load('src/app/(login_register)/login/verify/page.tsx').default;
|
|
const form = h.load('src/components/auth/customer-login-form.tsx').default;
|
|
assert.equal(h.render(login).type, form); assert.equal(h.render(verify).type, form);
|
|
assert.equal(h.render(verify).props.initialStep, 'verify');
|
|
});
|
|
test('logout button handles same-render repeated clicks and becomes disabled', async () => {
|
|
const h = harness(); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let calls = 0;
|
|
h.axios.defaults.adapter = config => { calls++; return Promise.resolve(response(config, null, 204)); };
|
|
const component = h.load('src/app/components/layout/customer-info.tsx').default;
|
|
const button = elements(h.render(component), item => item.type === 'button')[0];
|
|
button.props.onClick(); button.props.onClick(); await settle();
|
|
assert.equal(calls, 1); assert.equal(elements(h.render(component), item => item.type === 'button')[0].props.disabled, true);
|
|
});
|
|
|
|
test('tabs without Web Locks serialize rotating refresh through an expiring storage lease', async () => {
|
|
const local = new Map(); const first = harness({ local, locks: null }); const second = harness({ local, locks: null });
|
|
first.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' }); let requests = 0;
|
|
for (const h of [first, second]) {
|
|
h.instance.defaults.adapter = config => config.headers.Authorization === 'Bearer access.old' ? Promise.reject(failure(config, 401)) : Promise.resolve(response(config, {}));
|
|
h.axios.defaults.adapter = async config => { requests++; await settle(); return response(config, { access: 'access.rotated', refresh: 'refresh.rotated' }); };
|
|
}
|
|
await Promise.all([first.instance.get('/first/'), second.instance.get('/second/')]);
|
|
assert.equal(requests, 1); assert.equal(local.has('customerRefreshLease'), false);
|
|
});
|
|
test('an abandoned expired refresh lease cannot block a later refresh', async () => {
|
|
const h = harness({ locks: null }); h.auth.saveTokens({ access: 'access.old', refresh: 'refresh.old' });
|
|
h.local.set('customerRefreshLease', JSON.stringify({ owner: 'closed-tab', identity: h.auth.getSessionIdentity(), expires: 0 }));
|
|
h.instance.defaults.adapter = config => config.headers.Authorization === 'Bearer access.old' ? Promise.reject(failure(config, 401)) : Promise.resolve(response(config, {}));
|
|
h.axios.defaults.adapter = config => Promise.resolve(response(config, { access: 'access.new', refresh: 'refresh.new' }));
|
|
await h.instance.get('/orders/'); assert.equal(h.auth.getAccessToken(), 'access.new'); assert.equal(h.local.has('customerRefreshLease'), false);
|
|
});
|