43 lines
1.4 KiB
TypeScript
43 lines
1.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { sealData, unsealData } from "iron-session";
|
|
import {
|
|
DEVELOPMENT_SESSION_SECRET,
|
|
getSessionOptions,
|
|
} from "./sessionConfig";
|
|
|
|
describe("session configuration", () => {
|
|
it.each([undefined, "", "short", DEVELOPMENT_SESSION_SECRET])(
|
|
"rejects invalid production secret %s",
|
|
(secret) => {
|
|
expect(() =>
|
|
getSessionOptions({ NODE_ENV: "production", SESSION_SECRET: secret })
|
|
).toThrow(/SESSION_SECRET/);
|
|
}
|
|
);
|
|
|
|
it("allows the labelled fallback only outside production", () => {
|
|
expect(getSessionOptions({ NODE_ENV: "development" }).password).toBe(
|
|
DEVELOPMENT_SESSION_SECRET
|
|
);
|
|
});
|
|
|
|
it("honors secure cookies only when explicitly enabled in production", () => {
|
|
const options = getSessionOptions({
|
|
NODE_ENV: "production",
|
|
SESSION_SECRET: "a-secure-production-secret-that-is-long-enough",
|
|
SECURE_COOKIES: "true",
|
|
});
|
|
expect(options.cookieOptions?.secure).toBe(true);
|
|
});
|
|
|
|
it("does not authenticate data sealed with the development fallback under a real secret", async () => {
|
|
const sealed = await sealData(
|
|
{ isAuthenticated: true },
|
|
{ password: DEVELOPMENT_SESSION_SECRET, ttl: 60 }
|
|
);
|
|
await expect(unsealData(sealed, {
|
|
password: "a-secure-production-secret-that-is-long-enough",
|
|
ttl: 60,
|
|
})).resolves.toEqual({});
|
|
});
|
|
});
|