1 files changed, 59 insertions, 0 deletions
diff --git a/src/lib/server/auth.test.ts b/src/lib/server/auth.test.ts
new file mode 100644
index 0000000..59ddabc
--- /dev/null
+++ b/src/lib/server/auth.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { Cookies } from '@sveltejs/kit';
+import {
+	AUTH_COOKIE_NAME,
+	SESSION_MAX_AGE_SECONDS,
+	createSession,
+	isValidSession,
+	renewSession,
+	verifyPassword,
+} from './auth';
+
+const TEST_PASSWORD = vi.hoisted(() => {
+	return 'family-password-5f2c1d7e';
+});
+const NOW = 1_800_000_000_000;
+
+vi.mock('$env/dynamic/private', () => ({
+	env: { AUTH_PASSWORD: TEST_PASSWORD },
+}));
+
+describe('authentication', () => {
+	it('verifies the configured shared password', () => {
+		expect(verifyPassword(TEST_PASSWORD)).toBe(true);
+		expect(verifyPassword('wrong-password')).toBe(false);
+	});
+
+	it('accepts a signed session until its expiry', () => {
+		const session = createSession(NOW);
+
+		expect(
+			isValidSession(session, NOW + SESSION_MAX_AGE_SECONDS * 1000 - 1),
+		).toBe(true);
+		expect(isValidSession(session, NOW + SESSION_MAX_AGE_SECONDS * 1000)).toBe(
+			false,
+		);
+		expect(isValidSession(`${session}x`, NOW)).toBe(false);
+	});
+
+	it('renews a valid session with the requested cookie settings', () => {
+		const session = createSession(NOW);
+		const cookies = {
+			get: vi.fn(() => session),
+			set: vi.fn(),
+		} as unknown as Cookies;
+
+		expect(renewSession(cookies, true, NOW + 1_000)).toBe(true);
+		expect(cookies.set).toHaveBeenCalledWith(
+			AUTH_COOKIE_NAME,
+			expect.any(String),
+			expect.objectContaining({
+				path: '/',
+				httpOnly: true,
+				secure: true,
+				sameSite: 'lax',
+				maxAge: SESSION_MAX_AGE_SECONDS,
+			}),
+		);
+	});
+});