Repository: strapi/strapi
File: packages/core/core/src/services/__tests__/session-manager.test.ts (TypeScript)

Code before:
      const refreshToken = 'valid-refresh-token';
      const userId = 'user123';
      const sessionId = 'session456';

      // Mock validateRefreshToken to return success
      const mockValidateResult = {
        isValid: true,
        userId,
        sessionId,
      };

      sessionManager.validateRefreshToken = jest.fn().mockResolvedValue(mockValidateResult);
      mockJwt.sign.mockReturnValue('access-jwt-token');

      const result = await sessionManager.generateAccessToken(refreshToken);

      expect(sessionManager.validateRefreshToken).toHaveBeenCalledWith(refreshToken);
      expect(mockJwt.sign).toHaveBeenCalledWith(
        {
          userId,
          sessionId,
          type: 'access',
        },
        config.jwtSecret,
        {
          expiresIn: config.accessTokenLifespan,
        }
      );
      expect(result).toEqual({
        token: 'access-jwt-token',
      });
    });

    it('should return error for invalid refresh token', async () => {
      const refreshToken = 'invalid-refresh-token';

      // Mock validateRefreshToken to return failure
      const mockValidateResult = {
        isValid: false,
      };

      sessionManager.validateRefreshToken = jest.fn().mockResolvedValue(mockValidateResult);

      const result = await sessionManager.generateAccessToken(refreshToken);

      expect(sessionManager.validateRefreshToken).toHaveBeenCalledWith(refreshToken);
      expect(mockJwt.sign).not.toHaveBeenCalled();
      expect(result).toEqual({
        error: 'invalid_refresh_token',
      });
    });

Review comment (security):

```suggestion
    it('should use correct algorithm and expiration time for access token', async () => {
      const refreshToken = 'valid-refresh-token';
      const userId = 'user123';
      const sessionId = 'session456';

      // Mock validateRefreshToken to return success
      const mockValidateResult = {
        isValid: true,
        userId,
        sessionId,
      };

      sessionManager.validateRefreshToken = jest.fn().mockResolvedValue(mockValidateResult);
      mockJwt.sign.mockReturnValue('access-jwt-token');

      await sessionManager.generateAccessToken(refreshToken);

      // Verify the algorithm is explicitly set to HS256
      expect(mockJwt.sign).toHaveBeenCalledWith(
        expect.any(Object),
        config.jwtSecret,
        expect.objectContaining({
          algorithm: 'HS256',
          expiresIn: config.accessTokenLifespan,
        })
      );

      // Verify the expiration time matches the config
      const signCall = mockJwt.sign.mock.calls[0];
      const options = signCall[2];
      expect(options.expiresIn).toBe(config.accessTokenLifespan);
      expect(options.algorithm).toBe('HS256');
    });

    it('should generate access token for valid refresh token', async () => {
```

just an extra test you may or may not want

Code after:
        userId,
        sessionId,
      };
      sessionManager.validateRefreshToken = jest.fn().mockResolvedValue(mockValidateResult);

      mockJwt.sign.mockReturnValue('access-jwt-token' as any);
      await sessionManager.generateAccessToken(refreshToken);

      // Verify the algorithm is explicitly set to HS256
      expect(mockJwt.sign).toHaveBeenCalledWith(
        expect.any(Object),
        config.jwtSecret,
        expect.objectContaining({
          algorithm: 'HS256',
          expiresIn: config.accessTokenLifespan,
        })
      );

      // Verify the expiration time matches the config
      const signCall = mockJwt.sign.mock.calls[0];
      const options = signCall[2];
      expect(options.expiresIn).toBe(config.accessTokenLifespan);
      expect(options.algorithm).toBe('HS256');
    });

    it('should generate access token for valid refresh token', async () => {
      const refreshToken = 'valid-refresh-token';
      const userId = 'user123';
      const sessionId = 'session456';

      // Mock validateRefreshToken to return success
      const mockValidateResult = {
        isValid: true,
        userId,
        sessionId,
      };

      sessionManager.validateRefreshToken = jest.fn().mockResolvedValue(mockValidateResult);
      mockJwt.sign.mockReturnValue('access-jwt-token');

      const result = await sessionManager.generateAccessToken(refreshToken);

      expect(sessionManager.validateRefreshToken).toHaveBeenCalledWith(refreshToken);
      expect(mockJwt.sign).toHaveBeenCalledWith(
        {
          userId,
          sessionId,
          type: 'access',
        },
        config.jwtSecret,
        {