[vjymisal0]

Fixes #24639

Summary

Adds web/src/lib/auth/__tests__/logoutCleanup.test.ts, covering branches of lib/auth/logoutCleanup.ts that AuthContext.test.tsx does not reach:

• invalidateServerSession() POSTs /auth/logout with Authorization: Bearer <token> and X-Requested-With: XMLHttpRequest for a real session.
• It skips the backend call when there is no stored token or the token is DEMO_TOKEN_VALUE.
• It resolves without throwing when the backend is unreachable.
• clearLocalAuthStorage() removes the session-scoped user cache and rotates kc-session-id.
• clearLocalAuthStorage() still resets demo mode when sessionStorage.removeItem throws.

Test-only. No source changes.

Verification

cd web
npx vitest run src/lib/auth/__tests__/logoutCleanup.test.ts src/lib/auth/__tests__/AuthContext.test.tsx
Test Files  2 passed (2)
     Tests  14 passed (14)

Mutation check: removing the DEMO_TOKEN_VALUE guard and the kc-session-id removal from logoutCleanup.ts makes the corresponding new tests fail (2 failed, 4 passed). The source was restored afterwards.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign eeshaansa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[netlify]

✅ Deploy Preview for kubestellarconsole ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	eb29d35
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6ae1d7a0846e8abc49e2c333
😎 Deploy Preview	https://deploy-preview-24640.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

Read the implementation alongside the tests, not just the diff — this looks correct to me (a maintainer still needs to approve; I cannot).

Verified against web/src/lib/auth/logoutCleanup.ts at head 77994af:

• Every vi.mock path resolves to the module the implementation actually imports: ../../authToken → lib/authToken, ../../../hooks/mcp/agentFetch → hooks/mcp/agentFetch, ../../demoMode → lib/demoMode, etc. None are stale.
• The two skip branches tested (null token, DEMO_TOKEN_VALUE) match the guard at logoutCleanup.ts:23; the unreachable-backend case matches the .catch(() => {}) at logoutCleanup.ts:31 (fire-and-forget, so resolves.toBeUndefined() is the right assertion).
• The sessionStorage-throws test is subtler than it looks and is implemented correctly: cacheUser(null) (tokenHelpers.ts:132-137) runs after the try/catch at logoutCleanup.ts:53-60 but only calls safeRemove, so the mocked throwing Storage.prototype.removeItem cannot reject the promise; and the mock's this === sessionStorage guard leaves localStorage assertions meaningful.
• clearSessionCaches's collaborators are mocked at module level, so importing logoutCleanup doesn't drag in the SSE/presence graph. Test-only change; no source files touched.

One note: the Authorization header line in both the implementation and the test assertion was masked by a secret scrubber on my read path, so I could not independently verify the exact header value the test pins — CI running vitest verifies it functionally either way.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Ready for a human merge: verdict approved @77994af, 31/31 checks green, DCO yes, soak 30m0s elapsed. Blocked only by role/untrusted (no verified hive claim or registry tier).

_{The hive never approves on your behalf: /lgtm /approve (or merge) if you accept it.}

[hivecommons-hive]

Read the tests against web/src/lib/auth/logoutCleanup.ts on main — this looks correct to me.

Verified against the source (not just the diff):

• All eight vi.mock paths match the module's real imports (authToken, agentFetch, demoMode, usePermissions, useActiveUsers, sseClient, mcp/shared, dashboardSync).
• The demo/no-token skip branch being pinned exists at logoutCleanup.ts:23 (currentToken && currentToken !== DEMO_TOKEN_VALUE), and the unreachable-backend test is backed by the .catch at logoutCleanup.ts:32.
• kc-session-id rotation (logoutCleanup.ts:58) and setGlobalDemoMode(false, true) (logoutCleanup.ts:50) match the assertions exactly; the SecurityError spy only throws for sessionStorage, so safeSet/safeRemove on localStorage still run, which is what the final assertion depends on.

One note, not a defect: the expected Authorization header value in the test was masked by a secret scrubber in every read I could get, so I could not byte-compare it to the source's header literal. CI (including the frontend test run and coverage-gate) is green at head eb29d35, which covers that assertion in practice.

Test-only change, matches the stated scope of #24639. No findings.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Ready for a human merge: verdict approved @eb29d35, 25/25 checks green, DCO yes, soak 30m0s elapsed. Blocked only by role/untrusted (no verified hive claim or registry tier).

_{The hive never approves on your behalf: /lgtm /approve (or merge) if you accept it.}