till/mana-swift-core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

v1.1.1 — Session-Token statt JWT für Account-Calls

Browse source 
Wire-Konvention für authenticated Account-Endpoints (changeEmail,
changePassword, deleteAccount) geklärt. Server-seitig wurde in
mana-auth Better Auths bearer-Plugin aktiviert (requireSignature:
false), das Session-Tokens zu Session-Cookies konvertiert. Native-
Apps senden daher jetzt den Session-Token (refreshToken-Feldwert)
statt des JWT als Authorization: Bearer für diese drei Endpoints.

Der JWT bleibt für app-eigene Backends (memoro-api, cardecky-api,
manaspur-api) der richtige Authorization-Header — die Trennung ist
nur für mana-auth interne Endpoints.

currentSessionToken() als public Helper hinzu (symmetrisch zu
currentAccessToken).

38/38 Tests grün.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Till JS 2026-05-13 19:35:57 +02:00
parent 716509e10e
commit 3459c78731
4 changed files with 68 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Tests/ManaCoreTests/AuthClientAccountTests.swift
View file

@ -201,12 +201,16 @@ struct AuthClientAccountTests {
}
}
@Test("changePassword schickt Bearer-Header wenn eingeloggt")
@Test("changePassword schickt Session-Token als Bearer (nicht JWT)")
func changePasswordSendsBearer() async throws {
let (client, _) = Self.makeClient()
// Mock-Token im Keychain ablegen via persistSession-Helper.
// Authenticated Account-Calls senden den Session-Token (refreshToken)
// statt des JWT, weil server-seitig Better Auths bearer-Plugin
// den Session-Token zu einem Session-Cookie konvertiert. Siehe
// AuthClient+Account.swift Doc-Header.
let access = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1MSIsImV4cCI6MjAwMDAwMDAwMH0.sig"
try client.persistSession(email: "u@x.de", accessToken: access, refreshToken: "r")
let session = "session-token-value"
try client.persistSession(email: "u@x.de", accessToken: access, refreshToken: session)
let captured = MockURLProtocol.Capture()
MockURLProtocol.handler = { request in
@ -216,7 +220,7 @@ struct AuthClientAccountTests {
try await client.changePassword(currentPassword: "alt", newPassword: "neu")
let request = try #require(captured.request)
#expect(request.value(forHTTPHeaderField: "Authorization") == "Bearer \(access)")
#expect(request.value(forHTTPHeaderField: "Authorization") == "Bearer \(session)")
#expect(request.url?.path == "/api/v1/auth/change-password")
}