@@ -4,6 +4,14 @@ import { appConfigs } from '../../presets';
4
4
import type { FakeUser } from '../../testUtils' ;
5
5
import { createTestUtils , testAgainstRunningApps } from '../../testUtils' ;
6
6
7
+ /**
8
+ * Tests MemoryTokenCache session isolation in multi-session scenarios
9
+ *
10
+ * This suite validates that when multiple user sessions exist simultaneously,
11
+ * each session maintains its own isolated token cache. Tokens are not shared
12
+ * between different sessions, even within the same tab, ensuring proper
13
+ * security boundaries between users.
14
+ */
7
15
testAgainstRunningApps ( { withEnv : [ appConfigs . envs . withSessionTasks ] } ) (
8
16
'MemoryTokenCache Multi-Session Integration @nextjs' ,
9
17
( { app } ) => {
@@ -26,6 +34,23 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasks] })(
26
34
await app . teardown ( ) ;
27
35
} ) ;
28
36
37
+ /**
38
+ * Test Flow:
39
+ * 1. Tab1: Sign in as user1, fetch and cache their token
40
+ * 2. Tab2: Opens and inherits user1's session via cookies
41
+ * 3. Tab2: Sign in as user2 using programmatic sign-in (preserves both sessions)
42
+ * 4. Tab2: Now has two active sessions (user1 and user2)
43
+ * 5. Tab2: Switch between sessions and fetch tokens for each
44
+ * 6. Verify no network requests occur (tokens served from cache)
45
+ * 7. Tab1: Verify it still has user1 as active session (tab independence)
46
+ *
47
+ * Expected Behavior:
48
+ * - Each session has its own isolated token cache
49
+ * - Switching sessions in tab2 returns different tokens
50
+ * - Both tokens are served from cache (no network requests)
51
+ * - Tab1 remains unaffected by tab2's session changes
52
+ * - Multi-session state is properly maintained per-tab
53
+ */
29
54
test ( 'MemoryTokenCache multi-session - multiple users in different tabs with separate token caches' , async ( {
30
55
context,
31
56
} ) => {
0 commit comments