hooks.test.tsx

/* eslint-disable @typescript-eslint/no-explicit-any */
/* eslint-disable import/first */
import { renderHook, act } from '@testing-library/react';
import { TOKEN_EXPIRY_BUFFER_MS } from './constants';

// ---------------------------------------------------------------------------
// Mocks -- must be declared before importing the modules that use them
// ---------------------------------------------------------------------------

const mockUpdate = jest.fn();
const mockUseSession = jest.fn();

jest.mock('next-auth/react', () => ({
  useSession: () => mockUseSession(),
  signIn: jest.fn(),
  signOut: jest.fn(),
}));

jest.mock('@imtbl/auth', () => ({
  loginWithPopup: jest.fn(),
  loginWithEmbedded: jest.fn(),
  loginWithRedirect: jest.fn(),
  logoutWithRedirect: jest.fn(),
}));

jest.mock('./defaultConfig', () => ({
  deriveDefaultRedirectUri: jest.fn(() => 'http://localhost:3000/callback'),
}));

import { useImmutableSession } from './hooks';

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

/**
 * Full session shape matching what NextAuth returns at runtime.
 * The public ImmutableSession type intentionally omits accessToken,
 * but the underlying data still has it -- tests need the full shape
 * to set up mock sessions correctly.
 */
interface TestSession {
  accessToken: string;
  refreshToken?: string;
  idToken?: string;
  accessTokenExpires: number;
  zkEvm?: { ethAddress: string; userAdminAddress: string };
  error?: string;
  user?: any;
  expires: string;
}

function createSession(overrides: Partial<TestSession> = {}): TestSession {
  return {
    accessToken: 'valid-token',
    refreshToken: 'refresh-token',
    idToken: 'id-token',
    accessTokenExpires: Date.now() + 10 * 60 * 1000, // 10 min from now
    user: { sub: 'user-1', email: 'test@test.com' },
    expires: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
    ...overrides,
  };
}

function setupUseSession(session: TestSession | null, status: string = 'authenticated') {
  mockUseSession.mockReturnValue({
    data: session,
    status,
    update: mockUpdate,
  });
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

describe('useImmutableSession', () => {
  beforeEach(() => {
    jest.clearAllMocks();
    mockUpdate.mockReset();
  });

  describe('session type safety', () => {
    it('does not expose accessToken on the public session type', () => {
      const session = createSession();
      setupUseSession(session);
      mockUpdate.mockResolvedValue(session);

      const { result } = renderHook(() => useImmutableSession());

      // TypeScript prevents accessing accessToken, but at runtime the
      // underlying object still has it. Verify the hook returns a session
      // and that the public type doesn't advertise accessToken.
      expect(result.current.session).toBeDefined();
      expect(result.current.session?.error).toBeUndefined();
      // The property exists at runtime (it's the same object) but the type
      // system hides it -- this is a compile-time guard, not a runtime one.
      // eslint-disable-next-line @typescript-eslint/no-explicit-any
      expect((result.current.session as any).accessToken).toBeDefined();
    });
  });

  describe('getAccessToken()', () => {
    it('returns the token immediately when it is valid (fast path)', async () => {
      const session = createSession();
      setupUseSession(session);
      mockUpdate.mockResolvedValue(session); // in case proactive timer fires

      const { result } = renderHook(() => useImmutableSession());

      const token = await result.current.getAccessToken();
      expect(token).toBe('valid-token');
    });

    it('triggers refresh and returns fresh token when expired', async () => {
      const expiredSession = createSession({
        accessTokenExpires: Date.now() - 1000, // already expired
      });
      setupUseSession(expiredSession);

      const freshSession = createSession({
        accessToken: 'fresh-token',
        accessTokenExpires: Date.now() + 10 * 60 * 1000,
      });
      mockUpdate.mockResolvedValue(freshSession);

      const { result } = renderHook(() => useImmutableSession());

      let token: string = '';
      await act(async () => {
        token = await result.current.getAccessToken();
      });
      expect(token).toBe('fresh-token');
      expect(mockUpdate).toHaveBeenCalled();
    });

    it('triggers refresh when token is within the buffer window', async () => {
      const almostExpiredSession = createSession({
        accessTokenExpires: Date.now() + TOKEN_EXPIRY_BUFFER_MS - 1000, // within buffer
      });
      setupUseSession(almostExpiredSession);

      const freshSession = createSession({
        accessToken: 'refreshed-token',
        accessTokenExpires: Date.now() + 10 * 60 * 1000,
      });
      mockUpdate.mockResolvedValue(freshSession);

      const { result } = renderHook(() => useImmutableSession());

      let token: string = '';
      await act(async () => {
        token = await result.current.getAccessToken();
      });
      expect(token).toBe('refreshed-token');
      expect(mockUpdate).toHaveBeenCalled();
    });

    it('throws when refresh fails (no accessToken in response)', async () => {
      const expiredSession = createSession({
        accessTokenExpires: Date.now() - 1000,
      });
      setupUseSession(expiredSession);

      mockUpdate.mockResolvedValue(null);

      const { result } = renderHook(() => useImmutableSession());

      await expect(
        act(async () => {
          await result.current.getAccessToken();
        }),
      ).rejects.toThrow('[auth-next-client] Failed to get access token');
    });

    it('throws when refresh returns a session with error', async () => {
      const expiredSession = createSession({
        accessTokenExpires: Date.now() - 1000,
      });
      setupUseSession(expiredSession);

      const errorSession = createSession({ error: 'RefreshTokenError' });
      mockUpdate.mockResolvedValue(errorSession);

      const { result } = renderHook(() => useImmutableSession());

      await expect(
        act(async () => {
          await result.current.getAccessToken();
        }),
      ).rejects.toThrow('RefreshTokenError');
    });

    it('deduplicates concurrent calls (only one update())', async () => {
      const expiredSession = createSession({
        accessTokenExpires: Date.now() - 1000,
      });
      setupUseSession(expiredSession);

      const freshSession = createSession({
        accessToken: 'deduped-token',
        accessTokenExpires: Date.now() + 10 * 60 * 1000,
      });

      // Track how many times update is actually invoked
      let updateCallCount = 0;
      mockUpdate.mockImplementation(() => {
        updateCallCount++;
        return Promise.resolve(freshSession);
      });

      const { result } = renderHook(() => useImmutableSession());

      let token1: string = '';
      let token2: string = '';
      await act(async () => {
        [token1, token2] = await Promise.all([
          result.current.getAccessToken(),
          result.current.getAccessToken(),
        ]);
      });

      expect(token1).toBe('deduped-token');
      expect(token2).toBe('deduped-token');
      // The proactive effect may also trigger one call, so we check
      // that concurrent getAccessToken calls are deduped (not doubled)
      // The key invariant: at most 1 update() call per pending refresh cycle
      expect(updateCallCount).toBeLessThanOrEqual(2); // 1 from effect + 1 from getAccessToken (deduped)
    });
  });

  describe('reactive refresh on mount', () => {
    it('triggers refresh when token is already expired on mount', async () => {
      const session = createSession({
        accessTokenExpires: Date.now() - 1000, // already expired
      });
      setupUseSession(session);

      const freshSession = createSession({
        accessToken: 'immediate-refresh',
      });
      mockUpdate.mockResolvedValue(freshSession);

      await act(async () => {
        renderHook(() => useImmutableSession());
      });

      // The proactive useEffect should have called update
      expect(mockUpdate).toHaveBeenCalled();
    });

    it('does not set isRefreshing during reactive refresh (prevents UI flicker)', async () => {
      const session = createSession({
        accessTokenExpires: Date.now() - 1000, // already expired
      });
      setupUseSession(session);

      const freshSession = createSession({
        accessToken: 'immediate-refresh',
      });
      mockUpdate.mockResolvedValue(freshSession);

      const capturedIsRefreshing: boolean[] = [];
      const { result } = renderHook(() => {
        const hook = useImmutableSession();
        capturedIsRefreshing.push(hook.isRefreshing);
        return hook;
      });

      await act(async () => {
        // Let the reactive refresh effect run and complete
        await mockUpdate.mock.results[0]?.value;
      });

      // isRefreshing should NEVER have been true during reactive refresh.
      // It is reserved for explicit user-triggered refreshes (getUser(true)).
      expect(capturedIsRefreshing.every((v) => v === false)).toBe(true);
      expect(result.current.isRefreshing).toBe(false);
    });

    it('does not trigger refresh when token is valid and far from expiry', async () => {
      const session = createSession({
        accessTokenExpires: Date.now() + 10 * 60 * 1000, // 10 min from now, well beyond buffer
      });
      setupUseSession(session);

      await act(async () => {
        renderHook(() => useImmutableSession());
      });

      // Should NOT have called update -- token is still valid
      expect(mockUpdate).not.toHaveBeenCalled();
    });

    it('does not trigger refresh when session has error (prevents infinite loop)', async () => {
      // Simulate: token expired and last refresh failed (e.g. RefreshTokenError)
      const sessionWithError = createSession({
        accessTokenExpires: Date.now() - 1000, // expired
        error: 'RefreshTokenError',
      });
      setupUseSession(sessionWithError);

      await act(async () => {
        renderHook(() => useImmutableSession());
      });

      // Must NOT call update - otherwise we would retry refresh repeatedly
      // and cause an infinite loop (update -> same session with error -> effect re-runs -> update again).
      expect(mockUpdate).not.toHaveBeenCalled();
    });
  });

  describe('session reference stability', () => {
    it('returns same reference when useSession returns new object with identical data', () => {
      const sessionData = createSession();
      setupUseSession(sessionData);
      mockUpdate.mockResolvedValue(sessionData);

      const { result, rerender } = renderHook(() => useImmutableSession());

      const firstRef = result.current.session;

      // Simulate window-focus refetch: useSession returns a new object with identical data.
      // Pin timestamps from the first session to avoid ms drift between Date.now() calls.
      setupUseSession(createSession({
        accessTokenExpires: sessionData.accessTokenExpires,
        expires: sessionData.expires,
      }));
      rerender();

      expect(result.current.session).toBe(firstRef);
    });

    it('returns new reference when accessToken changes', () => {
      const sessionData = createSession();
      setupUseSession(sessionData);
      mockUpdate.mockResolvedValue(sessionData);

      const { result, rerender } = renderHook(() => useImmutableSession());

      const firstRef = result.current.session;

      // Simulate token refresh: new accessToken
      setupUseSession(createSession({ accessToken: 'new-token' }));
      rerender();

      expect(result.current.session).not.toBe(firstRef);
    });

    it('returns new reference when error appears', () => {
      const sessionData = createSession();
      setupUseSession(sessionData);
      mockUpdate.mockResolvedValue(sessionData);

      const { result, rerender } = renderHook(() => useImmutableSession());

      const firstRef = result.current.session;

      // Simulate refresh failure: error field added
      setupUseSession(createSession({ error: 'RefreshTokenError' }));
      rerender();

      expect(result.current.session).not.toBe(firstRef);
    });

    it('returns new reference when going from null to session', () => {
      setupUseSession(null, 'unauthenticated');
      mockUpdate.mockResolvedValue(null);

      const { result, rerender } = renderHook(() => useImmutableSession());

      expect(result.current.session).toBeNull();

      setupUseSession(createSession());
      rerender();

      expect(result.current.session).not.toBeNull();
    });

    it('returns new reference when going from session to null', () => {
      const sessionData = createSession();
      setupUseSession(sessionData);
      mockUpdate.mockResolvedValue(sessionData);

      const { result, rerender } = renderHook(() => useImmutableSession());

      expect(result.current.session).not.toBeNull();

      setupUseSession(null, 'unauthenticated');
      rerender();

      expect(result.current.session).toBeNull();
    });
  });

  describe('getUser() respects pending refresh', () => {
    it('waits for in-flight refresh before returning user', async () => {
      const expiredSession = createSession({
        accessTokenExpires: Date.now() - 1000,
      });
      setupUseSession(expiredSession);

      const freshSession = createSession({
        accessToken: 'user-fresh-token',
        accessTokenExpires: Date.now() + 10 * 60 * 1000,
      });

      mockUpdate.mockResolvedValue(freshSession);

      const { result } = renderHook(() => useImmutableSession());

      let user: any;
      await act(async () => {
        user = await result.current.getUser();
      });

      // getUser() should have waited for the refresh and gotten the fresh token
      expect(user?.accessToken).toBe('user-fresh-token');
    });

    it('getUser(true) still calls update with forceRefresh even when session has error', async () => {
      // Session is in error state (e.g. previous refresh failed)
      const sessionWithError = createSession({
        accessTokenExpires: Date.now() - 1000,
        error: 'RefreshTokenError',
      });
      setupUseSession(sessionWithError);

      // Server recovers and returns a valid session (e.g. user re-authenticated elsewhere)
      const recoveredSession = createSession({
        accessToken: 'recovered-token',
        accessTokenExpires: Date.now() + 10 * 60 * 1000,
        user: { sub: 'user-1', email: 'recovered@test.com' },
      });
      mockUpdate.mockResolvedValue(recoveredSession);

      const { result } = renderHook(() => useImmutableSession());

      let user: any;
      await act(async () => {
        user = await result.current.getUser(true);
      });

      // forceRefresh must have been attempted (proactive effect does NOT run when session.error is set)
      expect(mockUpdate).toHaveBeenCalledWith({ forceRefresh: true });
      // When server returns a good session, we get the user
      expect(user?.accessToken).toBe('recovered-token');
      expect(user?.profile?.email).toBe('recovered@test.com');
    });
  });
});