|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + */ |
| 4 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 5 | + |
| 6 | +const mocks = vi.hoisted(() => ({ |
| 7 | + defineInternalJsonRoute: vi.fn(() => vi.fn()), |
| 8 | + signOut: vi.fn(), |
| 9 | +})) |
| 10 | + |
| 11 | +vi.mock('@/lib/api/server/routes', () => ({ |
| 12 | + defineInternalJsonRoute: mocks.defineInternalJsonRoute, |
| 13 | + internalOrchestrationErrorPolicy: { project: vi.fn(), unhandled: vi.fn() }, |
| 14 | + internalRateLimits: { none: vi.fn(() => ({ kind: 'none' })) }, |
| 15 | + internalSessionAuth: { authenticate: vi.fn() }, |
| 16 | +})) |
| 17 | + |
| 18 | +vi.mock('@/lib/auth', () => ({ |
| 19 | + auth: { api: { signOut: mocks.signOut } }, |
| 20 | + getSession: vi.fn(), |
| 21 | +})) |
| 22 | + |
| 23 | +vi.mock('@/lib/users/application/delete-account', () => ({ |
| 24 | + deleteAccountUseCase: { execute: vi.fn() }, |
| 25 | + previewAccountDeletionUseCase: { execute: vi.fn() }, |
| 26 | +})) |
| 27 | + |
| 28 | +vi.mock('@/lib/users/application/operations', () => ({ |
| 29 | + userAccountOperations: { delete: { id: 'user.delete' }, previewDeletion: { id: 'user.preview' } }, |
| 30 | +})) |
| 31 | + |
| 32 | +import '@/app/api/users/me/deletion/route' |
| 33 | + |
| 34 | +type RouteOptions = { |
| 35 | + finalizeResponse?: (args: { request: Request }) => Promise<{ headers?: HeadersInit }> |
| 36 | +} |
| 37 | + |
| 38 | +/** Captured at import time; the route registers itself once when the module loads. */ |
| 39 | +const routeOptions = mocks.defineInternalJsonRoute.mock.calls.map((call) => call[0] as RouteOptions) |
| 40 | + |
| 41 | +describe('POST /api/users/me/deletion', () => { |
| 42 | + beforeEach(() => { |
| 43 | + mocks.signOut.mockReset() |
| 44 | + }) |
| 45 | + |
| 46 | + /** |
| 47 | + * The session row is deleted with the account, but the signed cookie cache |
| 48 | + * still authenticates the browser for its TTL; the response must clear it. |
| 49 | + */ |
| 50 | + it('clears the session cookies on the deletion response', async () => { |
| 51 | + const options = routeOptions.find( |
| 52 | + (candidate) => typeof candidate.finalizeResponse === 'function' |
| 53 | + ) |
| 54 | + expect(options?.finalizeResponse).toBeDefined() |
| 55 | + |
| 56 | + const cleared = new Headers([['set-cookie', 'better-auth.session_token=; Max-Age=0']]) |
| 57 | + mocks.signOut.mockResolvedValue({ headers: cleared, response: { success: true } }) |
| 58 | + const request = new Request('http://localhost/api/users/me/deletion', { |
| 59 | + method: 'POST', |
| 60 | + headers: { cookie: 'better-auth.session_token=abc' }, |
| 61 | + }) |
| 62 | + |
| 63 | + const finalization = await options!.finalizeResponse!({ request }) |
| 64 | + |
| 65 | + expect(mocks.signOut).toHaveBeenCalledWith({ headers: request.headers, returnHeaders: true }) |
| 66 | + expect(finalization.headers).toBe(cleared) |
| 67 | + }) |
| 68 | + |
| 69 | + it('never fails a completed deletion because the cookies could not be cleared', async () => { |
| 70 | + const options = routeOptions.find( |
| 71 | + (candidate) => typeof candidate.finalizeResponse === 'function' |
| 72 | + ) |
| 73 | + mocks.signOut.mockRejectedValue(new Error('sign-out unavailable')) |
| 74 | + |
| 75 | + await expect( |
| 76 | + options!.finalizeResponse!({ |
| 77 | + request: new Request('http://localhost/api/users/me/deletion', { method: 'POST' }), |
| 78 | + }) |
| 79 | + ).resolves.toEqual({}) |
| 80 | + }) |
| 81 | +}) |
0 commit comments