max / makenotwork

1.8 KB · 59 lines History Blame Raw

1	//! Session revocation workflow tests.
2	//!
3	//! Tests the ability to revoke individual sessions and all other sessions.
4
5	use crate::harness::TestHarness;
6
7	#[tokio::test]
8	async fn revoke_all_other_sessions() {
9	let mut h = TestHarness::new().await;
10	let _user_id = h.signup("sessrev", "sessrev@test.com", "password123").await;
11
12	// The user is now logged in with one session.
13	// Revoking all other sessions should succeed (even if there are no others).
14	let resp = h
15	.client
16	.delete("/api/users/me/sessions")
17	.await;
18	assert!(
19	resp.status.is_success(),
20	"Revoke all other sessions should succeed: {} {}",
21	resp.status, resp.text
22	);
23	}
24
25	#[tokio::test]
26	async fn revoke_all_sessions_requires_auth() {
27	let mut h = TestHarness::new().await;
28
29	// Not logged in — should be rejected
30	let resp = h
31	.client
32	.delete("/api/users/me/sessions")
33	.await;
34	assert!(
35	resp.status.is_client_error() \|\| resp.status.is_redirection(),
36	"Unauthenticated session revocation should be rejected: {} {}",
37	resp.status, resp.text
38	);
39	}
40
41	#[tokio::test]
42	async fn revoke_nonexistent_session_succeeds_gracefully() {
43	let mut h = TestHarness::new().await;
44	let _user_id = h.signup("sessbad", "sessbad@test.com", "password123").await;
45
46	// The handler deletes 0 rows silently and re-renders the sessions page.
47	// Verify it doesn't panic or error.
48	let fake_id = uuid::Uuid::new_v4();
49	let resp = h
50	.client
51	.delete(&format!("/api/users/me/sessions/{}", fake_id))
52	.await;
53	assert!(
54	resp.status.is_success(),
55	"Nonexistent session revocation should succeed gracefully: {} {}",
56	resp.status, resp.text
57	);
58	}
59