package integration_test

import (
	"net/http"
	"testing"
)

// Logout must revoke session AND unbind device so refresh is not still "logged in".
func TestAuthLogoutUnbindsDevice(t *testing.T) {
	r, _ := setupAPI(t)
	key := mustRegister(t, r)

	_, key = doJSON(t, r, http.MethodGet, "/api/v1/auth/me", nil, key)

	_, key = doJSON(t, r, http.MethodPost, "/api/v1/auth/logout", nil, key)
	testBearer = ""

	_, _, status := doJSONExpect(t, r, http.MethodGet, "/api/v1/auth/me", nil, key, 40112)
	if status != http.StatusUnauthorized {
		t.Fatalf("after logout GET /auth/me want HTTP 401, got %d", status)
	}

	_, key, _ = doJSONExpect(t, r, http.MethodGet, "/api/v1/profiles", nil, key, 40112)
	_ = key
}