8 lines
1.5 KiB
JavaScript
8 lines
1.5 KiB
JavaScript
import {test} from 'node:test';import assert from 'node:assert/strict';
|
|
const storage=()=>{const values=new Map();return {getItem:key=>values.get(key)||null,setItem:(key,value)=>values.set(key,value),removeItem:key=>values.delete(key)};};
|
|
globalThis.sessionStorage=storage();globalThis.localStorage=storage();globalThis.window=new EventTarget();
|
|
const {api,state,signIn}=await import('../src/state.mjs');
|
|
test('API never sends credentials to an arbitrary origin',async()=>{let calls=0;globalThis.fetch=async()=>{calls++;throw new Error('unexpected HTTP');};await assert.rejects(api('//external.example/path'),/接口地址无效/);assert.equal(calls,0);});
|
|
test('authenticated requests use same-origin APIs and preserve structured errors',async()=>{signIn('Bearer local-test');globalThis.fetch=async(path,options)=>{assert.equal(path,'/api/v1/user/info');assert.equal(options.headers.Authorization,'Bearer local-test');assert.equal(options.redirect,'error');return {ok:false,status:422,json:async()=>({message:'invalid',errors:{email:['邮箱格式不正确']}})};};await assert.rejects(api('/user/info'),/邮箱格式不正确/);});
|
|
test('a stale expired request cannot sign out a newer session',async()=>{signIn('Bearer old-local-test');let resolve;globalThis.fetch=()=>new Promise(done=>resolve=done);const pending=api('/user/info');signIn('Bearer new-local-test');resolve({ok:false,status:401,json:async()=>({message:'Unauthorized'})});await assert.rejects(pending,/Unauthorized/);assert.equal(state.token,'Bearer new-local-test');});
|