frontend-react/src/utils/authGate.test.ts

import { describe, it, expect, beforeEach } from 'vitest';
import {
  setClerkAuthState,
  shouldHardRedirectOn401,
  resolvePostAuthRedirect,
  safeSignInRedirectPath,
} from './authGate';

describe('authGate', () => {
  beforeEach(() => {
    setClerkAuthState({ isLoaded: false, isSignedIn: false });
  });

  it('does not hard-redirect while Clerk is loading', () => {
    setClerkAuthState({ isLoaded: false, isSignedIn: false });
    expect(shouldHardRedirectOn401()).toBe(false);
  });

  it('does not hard-redirect when Clerk says signed in (token race)', () => {
    setClerkAuthState({ isLoaded: true, isSignedIn: true });
    expect(shouldHardRedirectOn401()).toBe(false);
  });

  it('allows hard-redirect only when signed out and loaded', () => {
    setClerkAuthState({ isLoaded: true, isSignedIn: false });
    expect(shouldHardRedirectOn401()).toBe(true);
    // throttled
    expect(shouldHardRedirectOn401()).toBe(false);
  });

  it('resolvePostAuthRedirect maps dashboard to projects and honors redirect_url', () => {
    expect(resolvePostAuthRedirect('?redirect_url=%2Fprojects')).toBe('/projects');
    expect(resolvePostAuthRedirect('?redirect_url=%2Fdashboard')).toBe('/projects');
    expect(resolvePostAuthRedirect('')).toBe('/projects');
    expect(resolvePostAuthRedirect('?redirect_url=https://evil.com')).toBe('/projects');
  });

  it('safeSignInRedirectPath keeps public paths free of bounce params', () => {
    expect(safeSignInRedirectPath('/sign-in')).toBe('/sign-in');
    expect(safeSignInRedirectPath('/projects')).toContain('redirect_url=');
  });
});