refactor: enforce frontend view model boundaries
This commit is contained in:
@@ -9,14 +9,18 @@ import { apiClient, configureAuthClient } from "./client";
|
||||
describe("apiClient authentication", () => {
|
||||
it("refreshes once and retries an unauthorized protected request", async () => {
|
||||
let token = "expired";
|
||||
|
||||
const refresh = vi.fn(() => {
|
||||
token = "fresh";
|
||||
|
||||
return Promise.resolve(true);
|
||||
});
|
||||
|
||||
const authorization: string[] = [];
|
||||
server.use(
|
||||
http.get("*/api/v1/brokerage-accounts", ({ request }) => {
|
||||
authorization.push(request.headers.get("Authorization") ?? "");
|
||||
|
||||
return authorization.length === 1
|
||||
? HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 })
|
||||
: HttpResponse.json(resource([]));
|
||||
@@ -50,10 +54,14 @@ describe("apiClient authentication", () => {
|
||||
});
|
||||
|
||||
it("does not attach Bearer auth to authentication endpoints", async () => {
|
||||
let authorization: null | string = /* eslint-disable-line unicorn/no-null -- Exercise the explicit null returned by the production API/DOM contract. */ null;
|
||||
let authorization: null | string
|
||||
// eslint-disable-next-line unicorn/no-null -- Exercise the explicit null returned by the production API/DOM contract.
|
||||
= null;
|
||||
|
||||
server.use(
|
||||
http.post("*/api/v1/auth/refresh", ({ request }) => {
|
||||
authorization = request.headers.get("Authorization");
|
||||
|
||||
return HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 });
|
||||
}),
|
||||
);
|
||||
@@ -71,12 +79,15 @@ describe("apiClient authentication", () => {
|
||||
let generation = 0;
|
||||
let calls = 0;
|
||||
|
||||
const { promise: pending, resolve: release } = Promise.withResolvers<void>();
|
||||
const { promise: pending, resolve: release }
|
||||
= Promise.withResolvers<void>();
|
||||
|
||||
server.use(
|
||||
http.get("*/api/v1/brokerage-accounts", async () => {
|
||||
if (++calls === 1)
|
||||
return HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 });
|
||||
await pending;
|
||||
|
||||
return HttpResponse.json(resource([{ id: "previous-user-account" }]));
|
||||
}),
|
||||
);
|
||||
@@ -86,10 +97,12 @@ describe("apiClient authentication", () => {
|
||||
generation: () => generation,
|
||||
refresh: () => Promise.resolve(true),
|
||||
});
|
||||
|
||||
// eslint-disable-next-line vitest/valid-expect -- Attach rejection handling before releasing the request; the assertion is awaited below.
|
||||
const response = expect(
|
||||
apiClient.GET("/api/v1/brokerage-accounts"),
|
||||
).rejects.toMatchObject({ name: "AbortError" });
|
||||
|
||||
await vi.waitFor(() => expect(calls).toBe(2));
|
||||
generation += 1;
|
||||
release();
|
||||
|
||||
Reference in New Issue
Block a user