mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 22:16:26 +00:00
Maurice
e94525afd3
The session e2e suite drove login, logout, the session routes, a password change and renewal, but nothing showed end to end that a password reset, an MFA disable, account deletion or an admin action makes the old cookie stop working, the purge job had only a unit test with a stubbed service, and reset-admin.js had no test of its session handling at all. sessions.e2e.test.ts now also resets a password through the mailed token (both devices get 401, every row is ended, the new password signs in), turns two-factor off from one device (the other gets 401, this one stays), deletes the account (the rows go with it) and runs SessionPurgeJob.tick against the real table (ended and expired rows go, the live session keeps working). The admin paths need AdminModule and with it most of the app, so session-revocation.e2e.test.ts boots buildApp(): an admin setting a password, clearing two-factor and deleting a member each sign both of the member's devices out and leave the admin signed in, while an edit that leaves the password alone signs nobody out. reset-admin-sessions.test.ts runs the script against a database with session rows (only the reset account's live ones end) and against one without the table.