builtbykev
cf91c04e90
The OAuth-only 'sb-token' localStorage key was read by profile, slip, dashboard (recent-scans), settings, and tracker for their authenticated fetches. Email/password users never had that key, so those fetches sent no Authorization header and silently returned nothing. - web/src/lib/authToken.js — currentAccessToken() reads the REAL Supabase session (sb-<ref>-auth-token, v2 top-level or v1 currentSession), legacy fallback. CommonJS so Jest can unit-test it (5 tests). - Swept all 5 pages to the helper (scan already session-first from DS1). - lib/api.ts (0 callers) + ParlayTray (unmounted) left as dead code. 236 suites / 2842 tests green, next build exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
// DS1 follow-up — currentAccessToken reads the REAL Supabase session, so
|
|
// email/password users' authenticated fetches carry a token (the OAuth-only
|
|
// 'sb-token' key left them silently unauthenticated everywhere).
|
|
|
|
const { currentAccessToken } = require('../../web/src/lib/authToken');
|
|
|
|
function fakeWindow(store) {
|
|
const keys = Object.keys(store);
|
|
global.window = {
|
|
localStorage: {
|
|
length: keys.length,
|
|
key: (i) => keys[i] ?? null,
|
|
getItem: (k) => (k in store ? store[k] : null),
|
|
},
|
|
};
|
|
}
|
|
afterEach(() => { delete global.window; });
|
|
|
|
describe('currentAccessToken', () => {
|
|
test('reads the v2 supabase session (access_token at top level)', () => {
|
|
fakeWindow({ 'sb-zmdnczhtdxcddsxzttub-auth-token': JSON.stringify({ access_token: 'TOKEN_V2', refresh_token: 'r' }) });
|
|
expect(currentAccessToken()).toBe('TOKEN_V2');
|
|
});
|
|
test('reads the v1 shape (currentSession.access_token)', () => {
|
|
fakeWindow({ 'sb-abc-auth-token': JSON.stringify({ currentSession: { access_token: 'TOKEN_V1' } }) });
|
|
expect(currentAccessToken()).toBe('TOKEN_V1');
|
|
});
|
|
test('falls back to the legacy sb-token key', () => {
|
|
fakeWindow({ 'sb-token': 'LEGACY' });
|
|
expect(currentAccessToken()).toBe('LEGACY');
|
|
});
|
|
test('no session → null (never throws on malformed JSON)', () => {
|
|
fakeWindow({ 'sb-x-auth-token': 'not json{' });
|
|
expect(currentAccessToken()).toBeNull();
|
|
});
|
|
test('SSR (no window) → null', () => {
|
|
expect(currentAccessToken()).toBeNull();
|
|
});
|
|
});
|