Skip to content

Commit 9fa9d20

Browse files
sattvikcsattvikc
committed
fix: session refresh tests
1 parent c9e0eef commit 9fa9d20

File tree

1 file changed

+349
-0
lines changed

1 file changed

+349
-0
lines changed

‎recipe/session/session_refresh_test.go‎

Lines changed: 349 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,349 @@
1+
package session
2+
3+
import (
4+
"net/http"
5+
"net/http/httptest"
6+
"testing"
7+
8+
"github.com/stretchr/testify/assert"
9+
"github.com/supertokens/supertokens-golang/recipe/session/errors"
10+
"github.com/supertokens/supertokens-golang/recipe/session/sessmodels"
11+
"github.com/supertokens/supertokens-golang/supertokens"
12+
"github.com/supertokens/supertokens-golang/test/unittesting"
13+
)
14+
15+
func TestRevokingSessionDuringRefreshWithRevokeSession(t *testing.T) {
16+
customAntiCsrfVal := "VIA_TOKEN"
17+
configValue := supertokens.TypeInput{
18+
Supertokens: &supertokens.ConnectionInfo{
19+
ConnectionURI: "http://localhost:8080",
20+
},
21+
AppInfo: supertokens.AppInfo{
22+
AppName: "SuperTokens",
23+
WebsiteDomain: "supertokens.io",
24+
APIDomain: "api.supertokens.io",
25+
},
26+
RecipeList: []supertokens.Recipe{
27+
Init(&sessmodels.TypeInput{
28+
AntiCsrf: &customAntiCsrfVal,
29+
Override: &sessmodels.OverrideStruct{
30+
APIs: func(originalImplementation sessmodels.APIInterface) sessmodels.APIInterface {
31+
oRefreshPOST := *originalImplementation.RefreshPOST
32+
refreshPost := func(options sessmodels.APIOptions, userContext supertokens.UserContext) (sessmodels.SessionContainer, error) {
33+
sessionContainer, err := oRefreshPOST(options, userContext)
34+
if err != nil {
35+
return sessionContainer, err
36+
}
37+
err = sessionContainer.RevokeSession()
38+
if err != nil {
39+
return sessionContainer, err
40+
}
41+
return sessionContainer, nil
42+
}
43+
*originalImplementation.RefreshPOST = refreshPost
44+
return originalImplementation
45+
},
46+
},
47+
}),
48+
},
49+
}
50+
51+
BeforeEach()
52+
unittesting.StartUpST("localhost", "8080")
53+
defer AfterEach()
54+
err := supertokens.Init(configValue)
55+
if err != nil {
56+
t.Error(err.Error())
57+
}
58+
59+
mux := http.NewServeMux()
60+
61+
mux.HandleFunc("/create", func(rw http.ResponseWriter, r *http.Request) {
62+
CreateNewSession(rw, "user", map[string]interface{}{}, map[string]interface{}{})
63+
})
64+
65+
testServer := httptest.NewServer(supertokens.Middleware(mux))
66+
defer func() {
67+
testServer.Close()
68+
}()
69+
70+
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/create", nil)
71+
assert.NoError(t, err)
72+
res, err := http.DefaultClient.Do(req)
73+
assert.NoError(t, err)
74+
cookieData := unittesting.ExtractInfoFromResponse(res)
75+
76+
assert.NotEmpty(t, cookieData["sAccessToken"])
77+
assert.NotEmpty(t, cookieData["antiCsrf"])
78+
assert.NotEmpty(t, cookieData["idRefreshTokenFromHeader"])
79+
assert.NotEmpty(t, cookieData["sRefreshToken"])
80+
81+
req, err = http.NewRequest(http.MethodPost, testServer.URL+"/auth/session/refresh", nil)
82+
assert.NoError(t, err)
83+
req.Header.Add("Cookie", "sRefreshToken="+cookieData["sRefreshToken"]+";"+"sIdRefreshToken="+cookieData["sIdRefreshToken"])
84+
req.Header.Add("anti-csrf", cookieData["antiCsrf"])
85+
res, err = http.DefaultClient.Do(req)
86+
cookieData2 := unittesting.ExtractInfoFromResponse(res)
87+
assert.NoError(t, err)
88+
89+
assert.Equal(t, res.StatusCode, 200)
90+
assert.Equal(t, cookieData2["accessTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
91+
assert.Equal(t, cookieData2["refreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
92+
assert.Equal(t, cookieData2["idRefreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
93+
assert.Equal(t, cookieData2["accessToken"], "")
94+
assert.Equal(t, cookieData2["refreshToken"], "")
95+
assert.Equal(t, cookieData2["idRefreshTokenFromCookie"], "")
96+
assert.Equal(t, cookieData2["idRefreshTokenFromHeader"], "remove")
97+
assert.Greater(t, len(cookieData2["frontToken"]), 1)
98+
}
99+
100+
func TestRevokingSessionDuringRefreshWithRevokeSessionAndSend401(t *testing.T) {
101+
customAntiCsrfVal := "VIA_TOKEN"
102+
configValue := supertokens.TypeInput{
103+
Supertokens: &supertokens.ConnectionInfo{
104+
ConnectionURI: "http://localhost:8080",
105+
},
106+
AppInfo: supertokens.AppInfo{
107+
AppName: "SuperTokens",
108+
WebsiteDomain: "supertokens.io",
109+
APIDomain: "api.supertokens.io",
110+
},
111+
RecipeList: []supertokens.Recipe{
112+
Init(&sessmodels.TypeInput{
113+
AntiCsrf: &customAntiCsrfVal,
114+
Override: &sessmodels.OverrideStruct{
115+
APIs: func(originalImplementation sessmodels.APIInterface) sessmodels.APIInterface {
116+
oRefreshPOST := *originalImplementation.RefreshPOST
117+
refreshPost := func(options sessmodels.APIOptions, userContext supertokens.UserContext) (sessmodels.SessionContainer, error) {
118+
sessionContainer, err := oRefreshPOST(options, userContext)
119+
if err != nil {
120+
return sessionContainer, err
121+
}
122+
err = sessionContainer.RevokeSession()
123+
if err != nil {
124+
return sessionContainer, err
125+
}
126+
options.Res.Header().Add("Content-type", "application/json")
127+
options.Res.WriteHeader(401)
128+
options.Res.Write([]byte("{}"))
129+
return sessionContainer, nil
130+
}
131+
*originalImplementation.RefreshPOST = refreshPost
132+
return originalImplementation
133+
},
134+
},
135+
}),
136+
},
137+
}
138+
139+
BeforeEach()
140+
unittesting.StartUpST("localhost", "8080")
141+
defer AfterEach()
142+
err := supertokens.Init(configValue)
143+
if err != nil {
144+
t.Error(err.Error())
145+
}
146+
147+
mux := http.NewServeMux()
148+
149+
mux.HandleFunc("/create", func(rw http.ResponseWriter, r *http.Request) {
150+
CreateNewSession(rw, "user", map[string]interface{}{}, map[string]interface{}{})
151+
})
152+
153+
testServer := httptest.NewServer(supertokens.Middleware(mux))
154+
defer func() {
155+
testServer.Close()
156+
}()
157+
158+
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/create", nil)
159+
assert.NoError(t, err)
160+
res, err := http.DefaultClient.Do(req)
161+
assert.NoError(t, err)
162+
cookieData := unittesting.ExtractInfoFromResponse(res)
163+
164+
assert.NotEmpty(t, cookieData["sAccessToken"])
165+
assert.NotEmpty(t, cookieData["antiCsrf"])
166+
assert.NotEmpty(t, cookieData["idRefreshTokenFromHeader"])
167+
assert.NotEmpty(t, cookieData["sRefreshToken"])
168+
169+
req, err = http.NewRequest(http.MethodPost, testServer.URL+"/auth/session/refresh", nil)
170+
assert.NoError(t, err)
171+
req.Header.Add("Cookie", "sRefreshToken="+cookieData["sRefreshToken"]+";"+"sIdRefreshToken="+cookieData["sIdRefreshToken"])
172+
req.Header.Add("anti-csrf", cookieData["antiCsrf"])
173+
res, err = http.DefaultClient.Do(req)
174+
cookieData2 := unittesting.ExtractInfoFromResponse(res)
175+
assert.NoError(t, err)
176+
177+
assert.Equal(t, res.StatusCode, 401)
178+
assert.Equal(t, cookieData2["accessTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
179+
assert.Equal(t, cookieData2["refreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
180+
assert.Equal(t, cookieData2["idRefreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
181+
assert.Equal(t, cookieData2["accessToken"], "")
182+
assert.Equal(t, cookieData2["refreshToken"], "")
183+
assert.Equal(t, cookieData2["idRefreshTokenFromCookie"], "")
184+
assert.Equal(t, cookieData2["idRefreshTokenFromHeader"], "remove")
185+
assert.Greater(t, len(cookieData2["frontToken"]), 1)
186+
}
187+
188+
func TestRevokingSessionDuringRefreshWithThrowingUnauthorizedError(t *testing.T) {
189+
customAntiCsrfVal := "VIA_TOKEN"
190+
configValue := supertokens.TypeInput{
191+
Supertokens: &supertokens.ConnectionInfo{
192+
ConnectionURI: "http://localhost:8080",
193+
},
194+
AppInfo: supertokens.AppInfo{
195+
AppName: "SuperTokens",
196+
WebsiteDomain: "supertokens.io",
197+
APIDomain: "api.supertokens.io",
198+
},
199+
RecipeList: []supertokens.Recipe{
200+
Init(&sessmodels.TypeInput{
201+
AntiCsrf: &customAntiCsrfVal,
202+
Override: &sessmodels.OverrideStruct{
203+
APIs: func(originalImplementation sessmodels.APIInterface) sessmodels.APIInterface {
204+
oRefreshPOST := *originalImplementation.RefreshPOST
205+
refreshPost := func(options sessmodels.APIOptions, userContext supertokens.UserContext) (sessmodels.SessionContainer, error) {
206+
sessionContainer, err := oRefreshPOST(options, userContext)
207+
if err != nil {
208+
return sessionContainer, err
209+
}
210+
return nil, errors.UnauthorizedError{
211+
Msg: "Unauthorized",
212+
}
213+
}
214+
*originalImplementation.RefreshPOST = refreshPost
215+
return originalImplementation
216+
},
217+
},
218+
}),
219+
},
220+
}
221+
222+
BeforeEach()
223+
unittesting.StartUpST("localhost", "8080")
224+
defer AfterEach()
225+
err := supertokens.Init(configValue)
226+
if err != nil {
227+
t.Error(err.Error())
228+
}
229+
230+
mux := http.NewServeMux()
231+
232+
mux.HandleFunc("/create", func(rw http.ResponseWriter, r *http.Request) {
233+
CreateNewSession(rw, "user", map[string]interface{}{}, map[string]interface{}{})
234+
})
235+
236+
testServer := httptest.NewServer(supertokens.Middleware(mux))
237+
defer func() {
238+
testServer.Close()
239+
}()
240+
241+
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/create", nil)
242+
assert.NoError(t, err)
243+
res, err := http.DefaultClient.Do(req)
244+
assert.NoError(t, err)
245+
cookieData := unittesting.ExtractInfoFromResponse(res)
246+
247+
assert.NotEmpty(t, cookieData["sAccessToken"])
248+
assert.NotEmpty(t, cookieData["antiCsrf"])
249+
assert.NotEmpty(t, cookieData["idRefreshTokenFromHeader"])
250+
assert.NotEmpty(t, cookieData["sRefreshToken"])
251+
252+
req, err = http.NewRequest(http.MethodPost, testServer.URL+"/auth/session/refresh", nil)
253+
assert.NoError(t, err)
254+
req.Header.Add("Cookie", "sRefreshToken="+cookieData["sRefreshToken"]+";"+"sIdRefreshToken="+cookieData["sIdRefreshToken"])
255+
req.Header.Add("anti-csrf", cookieData["antiCsrf"])
256+
res, err = http.DefaultClient.Do(req)
257+
cookieData2 := unittesting.ExtractInfoFromResponse(res)
258+
assert.NoError(t, err)
259+
260+
assert.Equal(t, res.StatusCode, 401)
261+
assert.Equal(t, cookieData2["accessTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
262+
assert.Equal(t, cookieData2["refreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
263+
assert.Equal(t, cookieData2["idRefreshTokenExpiry"], "Thu, 01 Jan 1970 00:00:00 GMT")
264+
assert.Equal(t, cookieData2["accessToken"], "")
265+
assert.Equal(t, cookieData2["refreshToken"], "")
266+
assert.Equal(t, cookieData2["idRefreshTokenFromCookie"], "")
267+
assert.Equal(t, cookieData2["idRefreshTokenFromHeader"], "remove")
268+
assert.Greater(t, len(cookieData2["frontToken"]), 1)
269+
}
270+
271+
func TestRevokingSessionDuringRefreshFailsIfJustSending401(t *testing.T) {
272+
customAntiCsrfVal := "VIA_TOKEN"
273+
configValue := supertokens.TypeInput{
274+
Supertokens: &supertokens.ConnectionInfo{
275+
ConnectionURI: "http://localhost:8080",
276+
},
277+
AppInfo: supertokens.AppInfo{
278+
AppName: "SuperTokens",
279+
WebsiteDomain: "supertokens.io",
280+
APIDomain: "api.supertokens.io",
281+
},
282+
RecipeList: []supertokens.Recipe{
283+
Init(&sessmodels.TypeInput{
284+
AntiCsrf: &customAntiCsrfVal,
285+
Override: &sessmodels.OverrideStruct{
286+
APIs: func(originalImplementation sessmodels.APIInterface) sessmodels.APIInterface {
287+
oRefreshPOST := *originalImplementation.RefreshPOST
288+
refreshPost := func(options sessmodels.APIOptions, userContext supertokens.UserContext) (sessmodels.SessionContainer, error) {
289+
sessionContainer, err := oRefreshPOST(options, userContext)
290+
if err != nil {
291+
return sessionContainer, err
292+
}
293+
options.Res.Header().Add("Content-type", "application/json")
294+
options.Res.WriteHeader(401)
295+
options.Res.Write([]byte("{}"))
296+
return sessionContainer, nil
297+
}
298+
*originalImplementation.RefreshPOST = refreshPost
299+
return originalImplementation
300+
},
301+
},
302+
}),
303+
},
304+
}
305+
306+
BeforeEach()
307+
unittesting.StartUpST("localhost", "8080")
308+
defer AfterEach()
309+
err := supertokens.Init(configValue)
310+
if err != nil {
311+
t.Error(err.Error())
312+
}
313+
314+
mux := http.NewServeMux()
315+
316+
mux.HandleFunc("/create", func(rw http.ResponseWriter, r *http.Request) {
317+
CreateNewSession(rw, "user", map[string]interface{}{}, map[string]interface{}{})
318+
})
319+
320+
testServer := httptest.NewServer(supertokens.Middleware(mux))
321+
defer func() {
322+
testServer.Close()
323+
}()
324+
325+
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/create", nil)
326+
assert.NoError(t, err)
327+
res, err := http.DefaultClient.Do(req)
328+
assert.NoError(t, err)
329+
cookieData := unittesting.ExtractInfoFromResponse(res)
330+
331+
assert.NotEmpty(t, cookieData["sAccessToken"])
332+
assert.NotEmpty(t, cookieData["antiCsrf"])
333+
assert.NotEmpty(t, cookieData["idRefreshTokenFromHeader"])
334+
assert.NotEmpty(t, cookieData["sRefreshToken"])
335+
336+
req, err = http.NewRequest(http.MethodPost, testServer.URL+"/auth/session/refresh", nil)
337+
assert.NoError(t, err)
338+
req.Header.Add("Cookie", "sRefreshToken="+cookieData["sRefreshToken"]+";"+"sIdRefreshToken="+cookieData["sIdRefreshToken"])
339+
req.Header.Add("anti-csrf", cookieData["antiCsrf"])
340+
res, err = http.DefaultClient.Do(req)
341+
cookieData2 := unittesting.ExtractInfoFromResponse(res)
342+
assert.NoError(t, err)
343+
344+
assert.Equal(t, res.StatusCode, 401)
345+
assert.NotEmpty(t, cookieData2["sAccessToken"])
346+
assert.NotEmpty(t, cookieData2["antiCsrf"])
347+
assert.NotEmpty(t, cookieData2["idRefreshTokenFromHeader"])
348+
assert.NotEmpty(t, cookieData2["sRefreshToken"])
349+
}

0 commit comments

Comments
 (0)