(sessionCookie: string)
| 115 | // waiting out a real expiry. Same sealing library + password map the WorkOS |
| 116 | // SDK uses, so the gate can't tell this seal from one the SDK minted. |
| 117 | const withTamperedAccessToken = async (sessionCookie: string): Promise<string> => { |
| 118 | const sealed = sessionCookie.slice("wos-session=".length).replace(/~\d$/, ""); |
| 119 | const session = (await Iron.unseal(sealed, { "1": E2E_COOKIE_PASSWORD }, Iron.defaults)) as { |
| 120 | accessToken: string; |
| 121 | }; |
| 122 | const [header, payload, signature] = session.accessToken.split("."); |
| 123 | const tampered = { |
| 124 | ...session, |
| 125 | accessToken: `${header}.${payload}.${[...(signature ?? "")].reverse().join("")}`, |
| 126 | }; |
| 127 | const resealed = await Iron.seal( |
| 128 | tampered, |
| 129 | { id: "1", secret: E2E_COOKIE_PASSWORD }, |
| 130 | Iron.defaults, |
| 131 | ); |
| 132 | return `wos-session=${resealed}~2`; |
| 133 | }; |
| 134 | |
| 135 | scenario( |
| 136 | "Session gate · a stale access token is refreshed in-flight and the rotated session reaches the browser", |
no test coverage detected