From d457c766c3fb8113ec291782f931820bf2a3bdfa Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Mon, 3 Aug 2026 19:45:09 +0300
Subject: [PATCH] test frontend logout

---
 .../website/cypress/e2e/session-auth.cy.ts    | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/frontend/website/cypress/e2e/session-auth.cy.ts b/frontend/website/cypress/e2e/session-auth.cy.ts
index d7fb723..caa7956 100644
--- a/frontend/website/cypress/e2e/session-auth.cy.ts
+++ b/frontend/website/cypress/e2e/session-auth.cy.ts
@@ -3,6 +3,40 @@ const authenticatedUser = {
   email: 'user@example.com',
 }
 
+function interceptLogoutFlow(): void {
+  let authenticated = true
+
+  cy.intercept('GET', '**/api/me', (request) => {
+    if (authenticated) {
+      request.alias = 'me'
+      request.reply({
+        statusCode: 200,
+        body: { user: authenticatedUser },
+      })
+      return
+    }
+
+    request.alias = 'loggedOutMe'
+    request.reply({
+      statusCode: 401,
+      body: { error: 'unauthenticated' },
+    })
+  })
+  cy.intercept('POST', '**/api/logout', (request) => {
+    expect(request.headers.accept).to.equal('application/json')
+    authenticated = false
+    request.reply({ statusCode: 204 })
+  }).as('logout')
+}
+
+function visitDashboardAndLogout(): void {
+  cy.visit('/dashboard')
+  cy.wait('@me')
+  cy.contains('button', 'Log out').click()
+  cy.wait('@logout')
+  cy.wait('@loggedOutMe')
+}
+
 describe('session authentication', () => {
   it('restores an authenticated session on a protected route', () => {
     cy.intercept('GET', '**/api/me', {
@@ -53,4 +87,23 @@ describe('session authentication', () => {
 
     cy.location('pathname').should('equal', '/login')
   })
+
+  it('logs out and redirects to login', () => {
+    interceptLogoutFlow()
+
+    visitDashboardAndLogout()
+
+    cy.location('pathname').should('equal', '/login')
+  })
+
+  it('keeps protected routes inaccessible after logout', () => {
+    interceptLogoutFlow()
+    visitDashboardAndLogout()
+
+    cy.visit('/dashboard')
+    cy.wait('@loggedOutMe')
+
+    cy.location('pathname').should('equal', '/login')
+    cy.location('search').should('include', 'redirect=/dashboard')
+  })
 })