fix tests

plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts

@@ -160,7 +160,7 @@ describe('OAuthAdapter', () => {
     expect(mockResponse.cookie).toHaveBeenCalledTimes(0);
   });
 
-  it('removes refresh cookie when logging out', async () => {
+  it('removes access and refresh cookies when logging out', async () => {
     const oauthProvider = new OAuthAdapter(providerInstance, {
       ...oAuthProviderOptions,
       disableRefresh: false,
@@ -176,7 +176,12 @@ describe('OAuthAdapter', () => {
     } as unknown) as express.Response;
 
     await oauthProvider.logout(mockRequest, mockResponse);
-    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(2);
+    expect(mockResponse.cookie).toHaveBeenCalledWith(
+      expect.stringContaining('access-token'),
+      '',
+      expect.objectContaining({ path: '/api' }),
+    );
     expect(mockResponse.cookie).toHaveBeenCalledWith(
       expect.stringContaining('test-provider-refresh-token'),
       '',

plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts

@@ -258,17 +258,21 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
     res: express.Response,
     accessToken: string,
   ) => {
-    const payload = JWT.decode(accessToken) as object & {
-      exp: number;
-    };
-    res.cookie(`access-token`, accessToken, {
-      expires: new Date(payload?.exp ? payload?.exp * 1000 : 0),
-      secure: this.options.secure,
-      sameSite: 'lax',
-      domain: this.options.cookieDomain,
-      path: '/api',
-      httpOnly: true,
-    });
+    try {
+      const payload = JWT.decode(accessToken) as object & {
+        exp: number;
+      };
+      res.cookie(`access-token`, accessToken, {
+        expires: new Date(payload?.exp ? payload?.exp * 1000 : 0),
+        secure: this.options.secure,
+        sameSite: 'lax',
+        domain: this.options.cookieDomain,
+        path: '/api',
+        httpOnly: true,
+      });
+    } catch (_err) {
+      // Ignore
+    }
   };
 
   private setRefreshTokenCookie = (