1import { isStateStoreCredentialsStale } from "@/Cloudflare/StateStore/CredentialsFile.ts";
2import { describe, expect, it } from "alchemy-test";
3
4const ACCOUNT_A = "c8eeff0e4f5ebeeedc8d9af2013d7997";
5const ACCOUNT_B = "a1b2c3d4e5f60718293a4b5c6d7e8f90";
6
7/**
8 * The cached Cloudflare state-store credentials encode an account (the `url`
9 * is a `*.workers.dev` subdomain). {@link isStateStoreCredentialsStale} guards
10 * against trusting a cache minted for a different account than the one now in
11 * use — the bug where deploys silently read/write state in a previously
12 * logged-in account.
13 */
14describe(
15 "isStateStoreCredentialsStale",
16 {
17 tags: [
18 "unit",
19 "provider:cloudflare",
20 "provider:cloudflare:statestore",
21 "local",
22 ],
23 },
24 () => {
25 it("is fresh when the cached account matches the current account", () => {
26 expect(
27 isStateStoreCredentialsStale(
28 {
29 url: "https://s.workers.dev",
30 authToken: "t",
31 accountId: ACCOUNT_A,
32 },
33 ACCOUNT_A,
34 ),
35 ).toBe(false);
36 });
37
38 it("is stale when the cached account differs from the current account", () => {
39 expect(
40 isStateStoreCredentialsStale(
41 {
42 url: "https://s.workers.dev",
43 authToken: "t",
44 accountId: ACCOUNT_A,
45 },
46 ACCOUNT_B,
47 ),
48 ).toBe(true);
49 });
50
51 it("is stale for a legacy cache with no accountId", () => {
52 expect(
53 isStateStoreCredentialsStale(
54 { url: "https://s.workers.dev", authToken: "t" },
55 ACCOUNT_A,
56 ),
57 ).toBe(true);
58 });
59 },
60);