Nick Szaunig
370102387f
ARCHITECTURE.md §3 legt fest: Access-Token im Memory/Context, Refresh-Token
als httpOnly-Cookie. Vorherige Implementierung gab beide Tokens im JSON-Body
zurueck - vor dem Frontend-Aufbau (das genau gegen diesen Vertrag baut)
korrigiert.
/api/v1/auth/login und /refresh setzen jetzt ein httpOnly-Cookie
(Path /api/v1/auth, SameSite=Lax, secure in production) und liefern nur
noch { accessToken } im Body. /refresh und /logout lesen den Refresh-Token
aus dem Cookie statt aus dem Request-Body.
e2e-Tests und Live-Smoke-Test (curl mit Cookie-Jar) verifizieren
Login/Rotation/Logout-Invalidierung. 12 e2e- + 26 Unit-Tests, Lint,
Typecheck und Build gruen.
49 lines
1.2 KiB
TypeScript
49 lines
1.2 KiB
TypeScript
import { INestApplication } from '@nestjs/common';
|
|
import request from 'supertest';
|
|
import { App } from 'supertest/types';
|
|
import type { Response } from 'supertest';
|
|
|
|
export interface AccessTokenBody {
|
|
accessToken: string;
|
|
}
|
|
|
|
export interface UserBody {
|
|
id: string;
|
|
email: string;
|
|
name: string;
|
|
role: string;
|
|
isActive: boolean;
|
|
createdAt: string;
|
|
deactivatedAt: string | null;
|
|
}
|
|
|
|
export interface LoginResult {
|
|
accessToken: string;
|
|
refreshTokenCookie: string;
|
|
}
|
|
|
|
export function extractCookie(response: Response, name: string): string {
|
|
const setCookie =
|
|
(response.headers['set-cookie'] as unknown as string[] | undefined) ?? [];
|
|
const raw = setCookie.find((cookie) => cookie.startsWith(`${name}=`));
|
|
if (!raw) {
|
|
throw new Error(`Expected a Set-Cookie header for "${name}"`);
|
|
}
|
|
return raw.split(';')[0];
|
|
}
|
|
|
|
export async function login(
|
|
app: INestApplication<App>,
|
|
email: string,
|
|
password: string,
|
|
): Promise<LoginResult> {
|
|
const response = await request(app.getHttpServer())
|
|
.post('/api/v1/auth/login')
|
|
.send({ email, password })
|
|
.expect(200);
|
|
return {
|
|
accessToken: (response.body as AccessTokenBody).accessToken,
|
|
refreshTokenCookie: extractCookie(response, 'refreshToken'),
|
|
};
|
|
}
|