fix: handle auth callback failures

2026-06-05 16:50:52 +08:00
parent e6a1d14b09
commit 09979f3bb5
6 changed files with 105 additions and 4 deletions
@@ -24,6 +24,12 @@ export function runTests() {
      authMeRouteSource.includes("total"),
    "/api/auth/me proxy must expose stage durations through Server-Timing for HAR inspection",
  );
+  assert(
+    authMeRouteSource.includes('response.headers.set("Cache-Control", "no-store")') &&
+      authMeRouteSource.indexOf('response.headers.set("Cache-Control", "no-store")') >
+        authMeRouteSource.indexOf("function finishAuthMeResponse"),
+    "/api/auth/me proxy must mark every auth profile response no-store so anonymous state cannot be reused after login",
+  );
  const finishStart = authMeRouteSource.indexOf("function finishAuthMeResponse");
  const finishEnd = authMeRouteSource.indexOf("async function trackAuthDiagnosticEvent");
  const finishSource =