chore(auth): #331 unify existing tests

main_test.go

@@ -112,7 +112,8 @@ func TestIntegrationSecurityHeader(t *testing.T) {
 func TestIntegrationAuth(t *testing.T) {
 	t.Parallel()
 
-	t.Run("should return secure cookie on signin with generated csrf-token and session-id", func(t *testing.T) {
+	t.Run("SignIn", func(t *testing.T) {
+		t.Run("should return secure cookie with NEW session-id", func(t *testing.T) {
 			t.Parallel()
 
 			db, basePath, ctx := setupIntegrationTest(t)
@@ -132,15 +133,15 @@ func TestIntegrationAuth(t *testing.T) {
 			html, err := html.Parse(resp.Body)
 			assert.Nil(t, err)
 
-		csrfToken := findCsrfToken(html)
-		assert.NotEqual(t, "", csrfToken)
+			anonymousCsrfToken := findCsrfToken(html)
+			assert.NotEqual(t, "", anonymousCsrfToken)
 			anonymousSession := findCookie(resp, "id")
 			assert.NotNil(t, anonymousSession)
 
 			formData := url.Values{
 				"email":      {"mail@mail.de"},
 				"password":   {"password"},
-			"csrf-token": {csrfToken},
+				"csrf-token": {anonymousCsrfToken},
 			}
 
 			req, err = http.NewRequestWithContext(ctx, "POST", basePath+"/api/auth/signin", strings.NewReader(formData.Encode()))
@@ -158,8 +159,12 @@ func TestIntegrationAuth(t *testing.T) {
 			assert.Equal(t, http.SameSiteStrictMode, cookie.SameSite, "Cookie is not secure")
 			assert.True(t, cookie.HttpOnly, "Cookie is not secure")
 			assert.True(t, cookie.Secure, "Cookie is not secure")
+
+			assert.NotEqual(t, anonymousSession.Value, cookie.Value, "Session ID did not change")
 		})
-	t.Run("should change password and invalidate other sessions from user", func(t *testing.T) {
+	})
+	t.Run("ChangePassword", func(t *testing.T) {
+		t.Run("should change password and invalidate all other user sessions", func(t *testing.T) {
 			t.Parallel()
 
 			db, basePath, ctx := setupIntegrationTest(t)
@@ -228,7 +233,10 @@ func TestIntegrationAuth(t *testing.T) {
 			assert.Equal(t, "other", sessionIds[0])
 			assert.Equal(t, "session-id", sessionIds[1])
 		})
-	t.Run("should forget password and invalidate all user sessions", func(t *testing.T) {
+	})
+
+	t.Run("ForgotPassword", func(t *testing.T) {
+		t.Run("should change password and invalidate ALL sessions", func(t *testing.T) {
 			t.Parallel()
 
 			d, basePath, ctx := setupIntegrationTest(t)
@@ -291,6 +299,7 @@ func TestIntegrationAuth(t *testing.T) {
 			assert.Nil(t, err)
 			assert.False(t, sessions.Next())
 		})
+	})
 }
 
 func findCookie(resp *http.Response, name string) *http.Cookie {