testAutoRefresh.js

import BosBase from "bosbase";

function createToken(expiresInSeconds) {
  const header = Buffer.from(JSON.stringify({ alg: "none", typ: "JWT" })).toString("base64url");
  const payload = Buffer.from(
    JSON.stringify({
      exp: Math.floor(Date.now() / 1000) + expiresInSeconds,
      type: "auth",
      collectionId: "pbc_3142635823",
    }),
  ).toString("base64url");
  return `${header}.${payload}.sig`;
}

async function testAutoRefreshThreshold() {
  console.log("[INFO] Testing autoRefreshThreshold for superuser auth...");

  const pb = new BosBase("http://api.test.local");
  const shortLivedToken = createToken(30); // expires within the 60s threshold
  const refreshedToken = createToken(300);

  const calls = [];
  const originalFetch = global.fetch;

  const stubFetch = async (url, options = {}) => {
    const path = typeof url === "string" ? url : url?.toString?.() || "";

    if (path.includes("/auth-with-password")) {
      calls.push({ step: "login", authHeader: options.headers?.Authorization });
      return {
        status: 200,
        url: path,
        json: async () => ({
          token: shortLivedToken,
          record: { id: "admin1", collectionName: "_superusers" },
        }),
      };
    }

    if (path.includes("/auth-refresh")) {
      calls.push({ step: "refresh", authHeader: options.headers?.Authorization });
      return {
        status: 200,
        url: path,
        json: async () => ({
          token: refreshedToken,
          record: { id: "admin1", collectionName: "_superusers" },
        }),
      };
    }

    calls.push({ step: "protected", authHeader: options.headers?.Authorization });
    return {
      status: 200,
      url: path,
      json: async () => ({
        authHeader: options.headers?.Authorization || null,
      }),
    };
  };

  global.fetch = stubFetch;

  try {
    await pb.collection("_superusers").authWithPassword("demo@example.com", "pass", {
      autoRefreshThreshold: 60,
    });

    if (pb.authStore.token !== shortLivedToken) {
      throw new Error("Initial login token was not stored in the auth store");
    }
    if (!pb.authStore.isSuperuser) {
      throw new Error("Auth store should mark the saved token as superuser");
    }

    const result = await pb.send("/api/protected", { method: "GET" });

    if (pb.authStore.token !== refreshedToken) {
      throw new Error("Token was not refreshed before the next request");
    }
    if (result.authHeader !== refreshedToken) {
      throw new Error("Protected request did not send the refreshed Authorization header");
    }

    const order = calls.map((c) => c.step).join(",");
    if (order !== "login,refresh,protected") {
      throw new Error(`Auto refresh call order incorrect, got: ${order}`);
    }

    console.log("[SUCCESS] autoRefreshThreshold triggered authRefresh before the next request");
  } finally {
    global.fetch = originalFetch;
  }
}

async function main() {
  try {
    await testAutoRefreshThreshold();
    console.log("\n========== Auto refresh helper test completed ==========");
  } catch (error) {
    console.error("[ERROR] Auto refresh helper test failed:");
    console.error(error?.stack || error);
    process.exit(1);
  }
}

main();