test frontend logout

frontend/website/cypress/e2e/session-auth.cy.ts

@@ -3,6 +3,40 @@ const authenticatedUser = {
   email: 'user@example.com',
 }
 
+function interceptLogoutFlow(): void {
+  let authenticated = true
+
+  cy.intercept('GET', '**/api/me', (request) => {
+    if (authenticated) {
+      request.alias = 'me'
+      request.reply({
+        statusCode: 200,
+        body: { user: authenticatedUser },
+      })
+      return
+    }
+
+    request.alias = 'loggedOutMe'
+    request.reply({
+      statusCode: 401,
+      body: { error: 'unauthenticated' },
+    })
+  })
+  cy.intercept('POST', '**/api/logout', (request) => {
+    expect(request.headers.accept).to.equal('application/json')
+    authenticated = false
+    request.reply({ statusCode: 204 })
+  }).as('logout')
+}
+
+function visitDashboardAndLogout(): void {
+  cy.visit('/dashboard')
+  cy.wait('@me')
+  cy.contains('button', 'Log out').click()
+  cy.wait('@logout')
+  cy.wait('@loggedOutMe')
+}
+
 describe('session authentication', () => {
   it('restores an authenticated session on a protected route', () => {
     cy.intercept('GET', '**/api/me', {
@@ -53,4 +87,23 @@ describe('session authentication', () => {
 
     cy.location('pathname').should('equal', '/login')
   })
+
+  it('logs out and redirects to login', () => {
+    interceptLogoutFlow()
+
+    visitDashboardAndLogout()
+
+    cy.location('pathname').should('equal', '/login')
+  })
+
+  it('keeps protected routes inaccessible after logout', () => {
+    interceptLogoutFlow()
+    visitDashboardAndLogout()
+
+    cy.visit('/dashboard')
+    cy.wait('@loggedOutMe')
+
+    cy.location('pathname').should('equal', '/login')
+    cy.location('search').should('include', 'redirect=/dashboard')
+  })
 })