pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-18 05:25:40 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(api)!: enforce declared rate limits and correct route auth (#2500)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-09-06 15:28:32 +02:00
1 parent 908e1b8bd4
commit f8a04b8985
13 files changed
+317 -77
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_api/src/api/auth/tests/LoginAndSessions.test.ts
+12
View File
@@ -101,6 +101,18 @@ describe('Auth login and sessions', () => {
await createBuilder(harness, account.token).post('/auth/logout').expect(204).execute();
await createBuilder(harness, account.token).get('/users/@me').expect(401).execute();
});
it('logout requires a live session', async () => {
await createBuilderWithoutAuth(harness).post('/auth/logout').expect(401).execute();
await createBuilder(harness, createFakeAuthToken()).post('/auth/logout').expect(401).execute();
const account = await createTestAccount(harness);
await createBuilder(harness, account.token).post('/auth/logout').expect(204).execute();
await createBuilder(harness, account.token).post('/auth/logout').expect(401).execute();
});
it('logout with a Bearer-prefixed session token revokes it', async () => {
const account = await createTestAccount(harness);
await createBuilder(harness, `Bearer ${account.token}`).post('/auth/logout').expect(204).execute();
await createBuilder(harness, account.token).get('/users/@me').expect(401).execute();
});
it('treats /auth/sessions/logout as idempotent and removes targeted sessions', async () => {
let account: TestAccount = await createTestAccount(harness);
await createBuilder(harness, account.token)