descrybe/apps/api/internal/auth/session_test.go

package auth

import (
	"net/http"
	"testing"
	"time"
)

func TestNewSessionManagerCookieFlags(t *testing.T) {
	t.Parallel()

	sm := NewSessionManager(nil, "descrybe_session", "", true, 12)
	if sm.Cookie.Name != "descrybe_session" {
		t.Fatalf("Name = %q", sm.Cookie.Name)
	}
	if sm.Cookie.Domain != "" {
		t.Fatalf("Domain = %q, want host-only default", sm.Cookie.Domain)
	}
	if !sm.Cookie.HttpOnly {
		t.Fatal("session cookie must be HttpOnly")
	}
	if !sm.Cookie.Secure {
		t.Fatal("secure=true must set Secure")
	}
	if sm.Cookie.SameSite != http.SameSiteLaxMode {
		t.Fatalf("SameSite = %v, want Lax", sm.Cookie.SameSite)
	}
	if sm.Cookie.Path != "/" {
		t.Fatalf("Path = %q, want /", sm.Cookie.Path)
	}
	if sm.IdleTimeout != 12*time.Hour {
		t.Fatalf("IdleTimeout = %v, want 12h", sm.IdleTimeout)
	}
	if sm.Lifetime != 7*24*time.Hour {
		t.Fatalf("Lifetime = %v, want 7d", sm.Lifetime)
	}

	insecure := NewSessionManager(nil, "descrybe_session", "", false, 0)
	if insecure.Cookie.Secure {
		t.Fatal("secure=false must not set Secure")
	}
	if !insecure.Cookie.HttpOnly {
		t.Fatal("session cookie must remain HttpOnly")
	}
	if insecure.IdleTimeout != 24*time.Hour {
		t.Fatalf("default IdleTimeout = %v, want 24h", insecure.IdleTimeout)
	}

	// Parent-domain deploys (descrybe.io + api.descrybe.io): leading dot is
	// normalized away; browsers include subdomains whenever Domain is set.
	scoped := NewSessionManager(nil, "descrybe_session", ".descrybe.io", true, 12)
	if scoped.Cookie.Domain != "descrybe.io" {
		t.Fatalf("Domain = %q, want descrybe.io", scoped.Cookie.Domain)
	}
}