Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-16 10:11:54 +03:00
commit 016910ffb7
447 changed files with 73972 additions and 0 deletions
@@ -0,0 +1,37 @@
+import { expect, test } from "@playwright/test";
+import { API_URL, registerVerifyLogin, uniqueEmail } from "../helpers/api";
+
+function extractRefreshCookie(headers: Record<string, string>): string {
+  const setCookie = headers["set-cookie"] ?? headers["Set-Cookie"] ?? "";
+  const match = setCookie.match(/refresh_token=([^;]+)/);
+  if (!match) {
+    throw new Error("refresh_token cookie missing");
+  }
+  return match[1];
+}
+
+test.describe("§15.7 scenario 7: Refresh rotation", () => {
+  test("old refresh token rejected after rotation; reuse revokes family", async ({ request }) => {
+    const email = uniqueEmail("e2e-refresh");
+    await registerVerifyLogin(request, email);
+
+    const login = await request.post(`${API_URL}/api/v1/auth/login`, { data: { email, password: "Valid1234" } });
+    const oldRefresh = extractRefreshCookie(login.headers());
+
+    const rotated = await request.post(`${API_URL}/api/v1/auth/refresh`, {
+      headers: { Cookie: `refresh_token=${oldRefresh}` }
+    });
+    expect(rotated.ok()).toBeTruthy();
+    const newRefresh = extractRefreshCookie(rotated.headers());
+
+    const oldReuse = await request.post(`${API_URL}/api/v1/auth/refresh`, {
+      headers: { Cookie: `refresh_token=${oldRefresh}` }
+    });
+    expect(oldReuse.status()).toBe(401);
+
+    const familyReuse = await request.post(`${API_URL}/api/v1/auth/refresh`, {
+      headers: { Cookie: `refresh_token=${newRefresh}` }
+    });
+    expect(familyReuse.status()).toBe(401);
+  });
+});