Unit Testing CSRF Protection Logic in Angular

import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
import { TestBed } from '@angular/core/testing';
import { HttpClient, HttpXsrfTokenExtractor } from '@angular/common/http';
import { MyService } from './my.service';

describe('CSRF Protection Logic', () => {
  let httpTestingController: HttpTestingController;
  let service: MyService;
  let xsrfTokenExtractor: HttpXsrfTokenExtractor;

  beforeEach(() => {
    TestBed.configureTestingModule({
      imports: [HttpClientTestingModule],
      providers: [MyService, {provide: HttpXsrfTokenExtractor, useValue: {getToken: () => 'dummy-csrf-token'}}]
    });
    httpTestingController = TestBed.inject(HttpTestingController);
    service = TestBed.inject(MyService);
    xsrfTokenExtractor = TestBed.inject(HttpXsrfTokenExtractor);
  });

  afterEach(() => {
    httpTestingController.verify();
  });

  it('should have CSRF token in header when posting', () => {
    const testUrl = '/api/test';
    const testData = { payload: 'data' };

    service.postData(testUrl, testData).subscribe(response => {
      expect(response).toBeTruthy();
    });

    const req = httpTestingController.expectOne(testUrl);
    expect(req.request.method).toBe('POST');
    expect(req.request.headers.get('X-XSRF-TOKEN')).toBe('dummy-csrf-token');
    req.flush({});
  });
});