pikasTech-HWLAB/web/hwlab-cloud-web/auth.test.ts

import assert from "node:assert/strict";
import test from "node:test";

import { ensureWorkbenchAuth } from "./auth.ts";

const AUTH_STORAGE_KEY = "hwlab.cloudWorkbench.auth.v1";

test("local auth restore refreshes the server cookie before showing the workbench", async () => {
  const harness = installAuthHarness({
    localSession: validLocalSession(),
    responses: {
      "/auth/session": { authenticated: false },
      "/auth/login": {
        authenticated: true,
        user: { username: "admin" },
        expiresAt: futureIso()
      }
    }
  });

  try {
    const session = await ensureWorkbenchAuth({ loginShell: harness.loginShell, appShell: harness.appShell });

    assert.equal(session.authenticated, true);
    assert.equal(session.mode, "server");
    assert.deepEqual(harness.fetchCalls.map((call) => call.path), ["/auth/session", "/auth/login"]);
    assert.deepEqual(harness.fetchCalls.map((call) => call.method), ["GET", "POST"]);
    assert.deepEqual(JSON.parse(harness.fetchCalls[1].body), { username: "admin", password: "hwlab2026" });
    assert.equal(harness.loginShell.hidden, true);
    assert.equal(harness.appShell.hidden, false);
    assert.equal(globalThis.document.body.dataset.authState, "authenticated");
  } finally {
    harness.restore();
  }
});

test("local auth restore remains usable when server cookie refresh is unavailable", async () => {
  const harness = installAuthHarness({
    localSession: validLocalSession(),
    responses: {
      "/auth/session": { authenticated: false },
      "/auth/login": { authenticated: false, error: "invalid_credentials", status: 401 }
    }
  });

  try {
    const session = await ensureWorkbenchAuth({ loginShell: harness.loginShell, appShell: harness.appShell });

    assert.equal(session.authenticated, true);
    assert.equal(session.mode, "local");
    assert.deepEqual(harness.fetchCalls.map((call) => call.path), ["/auth/session", "/auth/login"]);
    assert.equal(harness.loginShell.hidden, true);
    assert.equal(harness.appShell.hidden, false);
    assert.equal(globalThis.document.body.dataset.authState, "authenticated");
  } finally {
    harness.restore();
  }
});

function installAuthHarness({ localSession, responses }) {
  const previous = {
    window: globalThis.window,
    document: globalThis.document,
    fetch: globalThis.fetch,
    config: globalThis.HWLAB_CLOUD_WEB_CONFIG
  };
  const storage = new Map();
  if (localSession) storage.set(AUTH_STORAGE_KEY, JSON.stringify(localSession));
  const fetchCalls = [];
  const loginShell = elementStub();
  const appShell = elementStub();

  globalThis.HWLAB_CLOUD_WEB_CONFIG = { auth: { mode: "auto", username: "admin", password: "hwlab2026" } };
  globalThis.document = { body: { dataset: {} } };
  globalThis.window = {
    localStorage: {
      getItem: (key) => storage.get(key) ?? null,
      setItem: (key, value) => storage.set(key, String(value)),
      removeItem: (key) => storage.delete(key)
    },
    setTimeout: () => 0,
    clearTimeout: () => {}
  };
  globalThis.fetch = async (path, options = {}) => {
    const response = responses[path] ?? { status: 404, authenticated: false };
    fetchCalls.push({
      path,
      method: options.method ?? "GET",
      body: options.body ?? null,
      credentials: options.credentials ?? null
    });
    const status = Number(response.status ?? (response.authenticated === false && response.error ? 401 : 200));
    return {
      status,
      ok: status >= 200 && status < 300,
      json: async () => ({ ...response, status: undefined })
    };
  };

  return {
    loginShell,
    appShell,
    fetchCalls,
    restore() {
      globalThis.window = previous.window;
      globalThis.document = previous.document;
      globalThis.fetch = previous.fetch;
      globalThis.HWLAB_CLOUD_WEB_CONFIG = previous.config;
    }
  };
}

function validLocalSession() {
  return {
    version: 1,
    username: "admin",
    issuedAt: Date.now() - 60_000,
    expiresAt: Date.now() + 60 * 60 * 1000
  };
}

function futureIso() {
  return new Date(Date.now() + 60 * 60 * 1000).toISOString();
}

function elementStub() {
  return {
    hidden: false,
    attributes: new Map(),
    setAttribute(name, value) {
      this.attributes.set(name, String(value));
    },
    removeAttribute(name) {
      this.attributes.delete(name);
    }
  };
}