nexarch/web/dms-upload/lib/http.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { resetSessionForTests } from "./http";
import { completeUpload, getUploadStatus, startUpload, uploadChunk } from "./api";

function b64(o: unknown): string {
  return btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(o)))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}
const TOKEN = `${b64({ alg: "EdDSA" })}.${b64({ sub: "u-1", tenant: "acme" })}.sig`;
const json = (b: unknown, s = 200) => new Response(JSON.stringify(b), { status: s, headers: { "Content-Type": "application/json" } });

let calls: { url: string; init: RequestInit }[];

beforeEach(() => {
  calls = [];
  vi.stubGlobal(
    "fetch",
    vi.fn(async (input: RequestInfo | URL, init: RequestInit = {}) => {
      const url = String(input);
      calls.push({ url, init });
      if (url.endsWith("/auth/module-token")) return json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme" });
      return json({ sessionId: "s-1", offset: 0, bytesReceived: 0, status: "uploading", documentId: "d-1", revisionId: "r-1" });
    })
  );
  vi.stubEnv("NEXT_PUBLIC_AUTH_MODE", "token");
  vi.stubEnv("NEXT_PUBLIC_CORE_API_BASE", "/api/core/v1");
  vi.stubEnv("NEXT_PUBLIC_UPLOAD_API_URL", "http://dms.test/api/dms/v1");
  resetSessionForTests();
});
afterEach(() => {
  vi.unstubAllEnvs();
  vi.unstubAllGlobals();
});

describe("UX-10: Upload im Token-Modus", () => {
  it("alle Upload-Aufrufe (auch Chunk mit Blob-Body) tragen Bearer und nie caller/X-User-Id", async () => {
    await startUpload("a.pdf", "application/pdf", 3);
    await uploadChunk("s-1", 0, new Blob(["abc"]));
    await getUploadStatus("s-1");
    await completeUpload("s-1");
    const api = calls.filter((c) => !c.url.includes("/auth/"));
    expect(api).toHaveLength(4);
    for (const c of api) {
      const h = new Headers(c.init.headers);
      expect(h.get("Authorization")).toBe(`Bearer ${TOKEN}`);
      expect(h.get("X-User-Id")).toBeNull();
      expect(c.url).not.toMatch(/caller=/);
      expect(c.url).not.toContain(TOKEN);
    }
    expect(calls.filter((c) => c.url.endsWith("/auth/module-token"))).toHaveLength(1);
  });

  it("401 beim Chunk: Token wird erneuert und der Chunk einmal wiederholt", async () => {
    let first = true;
    (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mockImplementation(async (input: RequestInfo | URL, init: RequestInit = {}) => {
      const url = String(input);
      calls.push({ url, init });
      if (url.endsWith("/auth/module-token")) return json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme" });
      if (first) {
        first = false;
        return new Response("", { status: 401 });
      }
      return json({ bytesReceived: 3 });
    });
    await uploadChunk("s-1", 0, new Blob(["abc"]));
    expect(calls.filter((c) => c.url.endsWith("/auth/module-token"))).toHaveLength(2);
  });
});