bbdfae09a0
The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).
Rules keep the ones that catch real TEST bugs and drop the noise:
- no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
- no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
`api` arg, an unused JPEG_MAGIC import), all removed.
- no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
a page.evaluate() return.
- no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.
Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.
Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
58 lines
2.3 KiB
TypeScript
58 lines
2.3 KiB
TypeScript
/**
|
|
* "Sign out everywhere" — DELETE /api/v1/sessions. A security control (revoke every device after a
|
|
* lost/stolen phone) that had ZERO coverage. Sessions are validated per-request against the DB
|
|
* (auth middleware resolves the token hash to a live session row), so revocation is observable: a
|
|
* revoked token must stop authenticating.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { BASE } from '../../helpers/env';
|
|
|
|
const ctx = (jwt: string) =>
|
|
fetch(`${BASE}/api/v1/me/context`, { headers: { Authorization: `Bearer ${jwt}` } });
|
|
|
|
test.describe('Auth — sign out everywhere', () => {
|
|
test("DELETE /sessions revokes ALL of the caller's sessions, not just the current one", async ({
|
|
api,
|
|
guest,
|
|
db,
|
|
}) => {
|
|
// Two devices for one guest: the join session, plus a second session from a recover login.
|
|
const g = await guest('MultiDevice');
|
|
const second = await api.recover(g.displayName, g.pin);
|
|
const secondJwt = second.body.jwt;
|
|
|
|
// Both tokens work, and there really are two distinct sessions.
|
|
expect((await ctx(g.jwt)).status).toBe(200);
|
|
expect((await ctx(secondJwt)).status).toBe(200);
|
|
expect(await db.countSessionsForUser(g.userId)).toBeGreaterThanOrEqual(2);
|
|
|
|
// Sign out everywhere, authenticated as device one.
|
|
const res = await fetch(`${BASE}/api/v1/sessions`, {
|
|
method: 'DELETE',
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(res.status).toBe(204);
|
|
|
|
// BOTH devices are now logged out — the whole point of the control. If it only killed the
|
|
// caller's own session, device two would still be live and a stolen phone would keep access.
|
|
expect((await ctx(g.jwt)).status, 'the calling device is signed out').toBe(401);
|
|
expect((await ctx(secondJwt)).status, 'the OTHER device is signed out too').toBe(401);
|
|
expect(await db.countSessionsForUser(g.userId)).toBe(0);
|
|
});
|
|
|
|
test("one user signing out everywhere does not touch another user's sessions", async ({
|
|
guest,
|
|
}) => {
|
|
const a = await guest('SignsOut');
|
|
const b = await guest('StaysIn');
|
|
|
|
await fetch(`${BASE}/api/v1/sessions`, {
|
|
method: 'DELETE',
|
|
headers: { Authorization: `Bearer ${a.jwt}` },
|
|
});
|
|
|
|
expect((await ctx(a.jwt)).status).toBe(401);
|
|
expect((await ctx(b.jwt)).status, "another user's session must be untouched").toBe(200);
|
|
});
|
|
});
|