add session clear tests

Author: devksingh4

tests/live/clearSession.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from "vitest";
+import { createJwt, getBaseEndpoint } from "./utils.js";
+import { allAppRoles } from "../../src/common/roles.js";
+
+const baseEndpoint = getBaseEndpoint();
+
+describe("Session clearing tests", async () => {
+  test("Token is revoked on logout", async () => {
+    const token = await createJwt();
+    // token works
+    const response = await fetch(`${baseEndpoint}/api/v1/protected`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    });
+    expect(response.status).toBe(200);
+    const responseBody = await response.json();
+    expect(responseBody).toStrictEqual({
+      username: "[email protected]",
+      roles: allAppRoles,
+    });
+    // user logs out
+    const clearResponse = await fetch(`${baseEndpoint}/api/v1/clearSession`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    });
+    expect(clearResponse.status).toBe(201);
+    // token should be revoked
+    const responseFail = await fetch(`${baseEndpoint}/api/v1/protected`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    });
+    expect(responseFail.status).toBe(403);
+  });
+});

tests/live/utils.ts

@@ -3,6 +3,7 @@ import {
   SecretsManagerClient,
   GetSecretValueCommand,
 } from "@aws-sdk/client-secrets-manager";
+import { randomUUID } from "node:crypto";
 
 export const getSecretValue = async (
   secretId: string,
@@ -47,7 +48,7 @@ export async function createJwt(
     iss: "custom_jwt",
     iat: Math.floor(Date.now() / 1000),
     nbf: Math.floor(Date.now() / 1000),
-    exp: Math.floor(Date.now() / 1000) + 3600 * 24, // Token expires after 24 hour
+    exp: Math.floor(Date.now() / 1000) + 3600 * 1, // Token expires after 1 hour
     acr: "1",
     aio: "AXQAi/8TAAAA",
     amr: ["pwd"],
@@ -64,7 +65,7 @@ export async function createJwt(
     sub: "subject",
     tid: "tenant-id",
     unique_name: username,
-    uti: "uti-value",
+    uti: randomUUID().toString(),
     ver: "1.0",
   };
   const token = jwt.sign(payload, secretData.JWTKEY, { algorithm: "HS256" });