From 32cab125cb65a6677695c8182823f4328ca76983 Mon Sep 17 00:00:00 2001
From: wlrnjs <wlrnjs5824@gmail.com>
Date: Mon, 5 Oct 2026 17:22:34 +0900
Subject: [PATCH] =?UTF-8?q?test(auth):=20=ED=86=A0=ED=81=B0=20=EC=BF=A0?=
 =?UTF-8?q?=ED=82=A4=20=EB=8F=84=EB=A9=94=EC=9D=B8=20=ED=8C=90=EC=A0=95?=
 =?UTF-8?q?=EA=B3=BC=20=EA=B6=8C=ED=95=9C=20=EC=97=86=EC=9D=8C=20=EC=8B=9C?=
 =?UTF-8?q?=20=ED=86=A0=ED=81=B0=20=EC=9C=A0=EC=A7=80=20=ED=85=8C=EC=8A=A4?=
 =?UTF-8?q?=ED=8A=B8=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../getAuthCookieDomain.test.ts               | 21 +++++++++++++++++++
 tests/e2e/auth-login.spec.ts                  |  4 ++++
 2 files changed, 25 insertions(+)
 create mode 100644 src/utils/getAuthCookieDomain/getAuthCookieDomain.test.ts

diff --git a/src/utils/getAuthCookieDomain/getAuthCookieDomain.test.ts b/src/utils/getAuthCookieDomain/getAuthCookieDomain.test.ts
new file mode 100644
index 0000000..5d0d333
--- /dev/null
+++ b/src/utils/getAuthCookieDomain/getAuthCookieDomain.test.ts
@@ -0,0 +1,21 @@
+import { getAuthCookieDomain } from "./getAuthCookieDomain";
+
+describe("getAuthCookieDomain", () => {
+  it.each(["finditem.kr", "www.finditem.kr", "a.finditem.kr", "a.finditem.kr:443"])(
+    "%s이면 상위 도메인을 반환한다",
+    (host) => {
+      expect(getAuthCookieDomain(host)).toBe(".finditem.kr");
+    }
+  );
+
+  it.each(["localhost:3000", "evilfinditem.kr", "finditem.kr.evil.com", ""])(
+    "%s이면 도메인을 붙이지 않는다",
+    (host) => {
+      expect(getAuthCookieDomain(host)).toBeUndefined();
+    }
+  );
+
+  it("Host 헤더가 없으면 도메인을 붙이지 않는다", () => {
+    expect(getAuthCookieDomain(null)).toBeUndefined();
+  });
+});
diff --git a/tests/e2e/auth-login.spec.ts b/tests/e2e/auth-login.spec.ts
index c6c8cd7..21573a9 100644
--- a/tests/e2e/auth-login.spec.ts
+++ b/tests/e2e/auth-login.spec.ts
@@ -49,6 +49,10 @@ test.describe("관리자 로그인 (/login)", () => {
 
     await expect(page).toHaveURL(/\/login\?reason=forbidden$/);
     await expect(page.getByText("관리자 권한이 있는 계정으로 로그인해 주세요.")).toBeVisible();
+
+    // 토큰은 운영 앱과 공유하므로 권한이 없어도 지우지 않는다.
+    const cookieNames = (await context.cookies()).map((cookie) => cookie.name);
+    expect(cookieNames).toEqual(expect.arrayContaining(["access_token", "refresh_token"]));
   });
 
   test("관리자 계정으로 로그인 화면에 접근하면 관리자 메인으로 이동한다", async ({