Initial import of verae-staff-session from zapier monorepo

test/token.test.js

@@ -0,0 +1,19 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sessionToken, cookieOk, headerOk, cookieHeader } from '../src/token.js';
+
+test('cookie matches HMAC of staff key', () => {
+  const tok = sessionToken();
+  assert.equal(tok.length, 64);
+  assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
+  assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
+  assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
+});
+
+test('cookie Domain is optional', () => {
+  delete process.env.STAFF_COOKIE_DOMAIN;
+  assert.equal(cookieHeader().includes('Domain='), false);
+  process.env.STAFF_COOKIE_DOMAIN = '.example.com';
+  assert.match(cookieHeader(), /Domain=\.example.com/);
+  delete process.env.STAFF_COOKIE_DOMAIN;
+});