@bongos/core 1.19.1076 → 1.19.1077

package/tests/hub_cookie_host_only.mjs

@@ -0,0 +1,279 @@
+// tests/hub_cookie_host_only.mjs — the hub's sign-in never reaches a project hall (task 1004357).
+//
+// ADR 0145 Finding 1: the hub scoped its session + handshake cookies to ".<apex>", so the
+// browser sent a hub builder's session to EVERY subdomain — including a project's hall at
+// <handle>.<apex>, which runs code from the project's own repository. That code could read the
+// Cookie header and replay the session against the hub.
+//
+// This suite runs the REAL auth router over HTTP and feeds every Set-Cookie into a small
+// RFC 6265 cookie jar (host-only vs Domain matching), then asks the jar what a project hall
+// would receive. It walks the whole sign-in: start on builders., the restart on the apex, the
+// GitHub callback (the GitHub exchange itself is stubbed), the handoff back to builders., a
+// builder moving from the apex to builders. while signed in, and a browser that still holds a
+// pre-fix apex-scoped cookie. Only the DB session lookup and the GitHub code exchange are stubbed.
+//
+// Run:  node --test tests/hub_cookie_host_only.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// RFC 2606 reserved — synthetic, never routable, no host brand in this file.
+const APEX = 'bongos-test.example';
+const HALL = `mercury.${APEX}`;          // a project's hall on one of our addresses
+const BUILDERS = `builders.${APEX}`;
+
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-hub-cookie-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'HUBCOOKIE_FIXTURE',
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}`, oauthOrigin: `https://${APEX}` },
+}));
+process.env.BONGOS_BRANDING_FILE = brandFile;
+process.env.HUBCOOKIE_FIXTURE_GITHUB_CLIENT_ID = 'fixture-client';
+process.env.HUBCOOKIE_FIXTURE_GITHUB_CLIENT_SECRET = 'fixture-secret';
+// An ambient <PREFIX>_PUBLIC_ORIGIN in the shell would outrank the pack's origin — clear every spelling.
+const require0 = createRequire(import.meta.url);
+for (const p of ['BONGOS', ...require0('../src/instance-config.js').LEGACY_ENV_PREFIXES]) delete process.env[`${p}_PUBLIC_ORIGIN`];
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const db = require('../src/bongos/db');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+
+// ── stubs: the two things that would leave the process ──
+const LIVE = new Map();                       // token → session row
+db.lookupSession = async (t) => LIVE.get(t) || null;
+const realCompleteWebFlow = auth.completeWebFlow;
+auth.completeWebFlow = async () => {
+  const token = 'tok' + 'a'.repeat(40);
+  const expiresAt = new Date(Date.now() + 86400000);
+  LIVE.set(token, { builder_id: 7, expires_at: expiresAt });
+  return { token, expiresAt, builder: { id: 7 } };
+};
+
+let server, port;
+before(async () => {
+  const app = express();
+  app.set('trust proxy', true);
+  app.use('/api/bongos', buildAuthRouter());
+  // A stand-in for any page/API on any host: echoes the Cookie header the browser sent.
+  app.get('/echo', (req, res) => res.json({ cookie: req.headers.cookie || '' }));
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(() => { server.close(); auth.completeWebFlow = realCompleteWebFlow; });
+
+// ── a minimal RFC 6265 jar: Domain cookies match the domain and every subdomain, host-only
+//    cookies match exactly one host. Max-Age<=0 / a past Expires deletes. ──
+function makeJar() {
+  const cookies = new Map(); // key name|domain|hostOnly → {name, value, domain, hostOnly}
+  return {
+    store(host, setCookies) {
+      for (const sc of setCookies) {
+        const [pair, ...attrs] = sc.split(';').map((s) => s.trim());
+        const i = pair.indexOf('=');
+        const name = pair.slice(0, i); const value = pair.slice(i + 1);
+        let domain = null; let dead = false;
+        for (const a of attrs) {
+          const [k, v = ''] = a.split('=');
+          const key = k.toLowerCase();
+          if (key === 'domain') domain = v.replace(/^\./, '').toLowerCase();
+          if (key === 'max-age' && Number(v) <= 0) dead = true;
+          if (key === 'expires' && new Date(v).getTime() < Date.now()) dead = true;
+        }
+        const hostOnly = !domain;
+        const d = domain || host;
+        const k = `${name}|${d}|${hostOnly}`;
+        if (dead) cookies.delete(k); else cookies.set(k, { name, value, domain: d, hostOnly });
+      }
+    },
+    header(host) {
+      return [...cookies.values()]
+        .filter((c) => (c.hostOnly ? host === c.domain : host === c.domain || host.endsWith('.' + c.domain)))
+        .map((c) => `${c.name}=${c.value}`).join('; ');
+    },
+    all() { return [...cookies.values()]; },
+  };
+}
+
+// One browser request to https://<host><path>, through the jar.
+function request(jar, host, path, { referer } = {}) {
+  return new Promise((resolve, reject) => {
+    const headers = { host, 'x-forwarded-proto': 'https' };
+    const cookie = jar.header(host);
+    if (cookie) headers.cookie = cookie;
+    if (referer) headers.referer = referer;
+    const req = http.request({ host: '127.0.0.1', port, path, method: 'GET', headers }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => {
+        const setCookies = [].concat(res.headers['set-cookie'] || []);
+        jar.store(host, setCookies);
+        resolve({ status: res.statusCode, location: res.headers.location, setCookies, body, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const sessionNames = auth.SESSION_COOKIE_NAMES;
+const hallSees = (jar) => jar.header(HALL);
+const hasSession = (cookieHeader) => sessionNames.some((n) => new RegExp(`(^|; )${n}=`).test(cookieHeader));
+
+test('no hub endpoint ever sets a cookie with a Domain attribute', async () => {
+  const jar = makeJar();
+  const r = await request(jar, APEX, '/api/bongos/auth/web/start?return=%2Fbuilders&repos=1');
+  assert.equal(r.status, 302);
+  assert.ok(r.setCookies.length >= 3, 'state · return · repos');
+  for (const sc of r.setCookies) assert.doesNotMatch(sc, /;\s*Domain=/i, sc);
+  assert.equal(hallSees(jar), '', 'the hall receives none of the handshake cookies');
+});
+
+test('a sign-in begun on builders. restarts on the apex, sets nothing there, and keeps its return', async () => {
+  const jar = makeJar();
+  const r = await request(jar, BUILDERS, '/api/bongos/auth/web/start?return=%2Fwatch');
+  assert.equal(r.status, 302);
+  assert.deepEqual(r.setCookies, [], 'no cookie on the satellite host — its callback could never read it');
+  const u = new URL(r.location);
+  assert.equal(u.host, APEX);
+  assert.equal(u.pathname, '/api/bongos/auth/web/start');
+  assert.equal(u.searchParams.get('return'), `https://${BUILDERS}/watch`);
+});
+
+test('the full sign-in: builders. → apex → GitHub → handoff → builders., and the hall sees nothing', async () => {
+  const jar = makeJar();
+  // 1. builders. → apex start
+  let r = await request(jar, BUILDERS, '/api/bongos/auth/web/start?return=%2Fwatch');
+  const startUrl = new URL(r.location);
+  r = await request(jar, APEX, startUrl.pathname + startUrl.search);
+  assert.equal(r.status, 302);
+  const state = new URL(r.location).searchParams.get('state');
+  assert.ok(state, 'went to GitHub with a state');
+  // 2. GitHub → apex callback (the exchange is stubbed)
+  r = await request(jar, APEX, `/api/bongos/auth/web/callback?code=c0de&state=${state}`);
+  assert.equal(r.status, 302, r.body);
+  const sess = r.setCookies.find((c) => c.startsWith('__Host-bongos_session='));
+  assert.ok(sess, 'the session is the __Host- cookie');
+  assert.doesNotMatch(sess, /Domain=/i);
+  assert.match(sess, /Secure/i);
+  assert.match(sess, /Path=\//);
+  // 3. apex → builders. handoff
+  const hand = new URL(r.location);
+  assert.equal(hand.host, BUILDERS);
+  assert.equal(hand.pathname, '/api/bongos/auth/web/handoff');
+  assert.equal(hand.searchParams.get('return'), '/watch');
+  r = await request(jar, BUILDERS, hand.pathname + hand.search);
+  assert.equal(r.status, 302);
+  assert.equal(r.location, '/watch');
+  assert.equal(r.headers['referrer-policy'], 'no-referrer');
+  // Signed in on both hub hosts…
+  assert.ok(hasSession(jar.header(APEX)), 'apex carries the session');
+  assert.ok(hasSession(jar.header(BUILDERS)), 'builders. carries the session');
+  // …and the project hall, and any other subdomain, receives no hub cookie at all.
+  assert.equal(hallSees(jar), '', `the hall was sent: ${hallSees(jar)}`);
+  assert.equal(jar.header(`status.${APEX}`), '', 'a hub host the builder never visited has nothing either');
+  // 4. the code was single-use
+  r = await request(makeJar(), BUILDERS, hand.pathname + hand.search);
+  assert.equal(r.status, 400);
+  assert.deepEqual(r.setCookies, []);
+});
+
+test('signed in on the apex, opening builders. hands over the session with no GitHub round-trip', async () => {
+  const jar = makeJar();
+  const token = 'tok' + 'b'.repeat(40);
+  LIVE.set(token, { builder_id: 8, expires_at: new Date(Date.now() + 86400000) });
+  jar.store(APEX, [`__Host-bongos_session=${token}; Path=/; Secure; HttpOnly`]);
+  // builders.'s 401 sends the builder to its own start…
+  let r = await request(jar, BUILDERS, '/api/bongos/auth/web/start?return=%2Fbuilders%2Fideas');
+  r = await request(jar, APEX, new URL(r.location).pathname + new URL(r.location).search);
+  const hand = new URL(r.location);
+  assert.equal(hand.host, BUILDERS, 'straight to the handoff, not to GitHub');
+  r = await request(jar, BUILDERS, hand.pathname + hand.search);
+  assert.equal(r.location, '/builders/ideas');
+  assert.match(jar.header(BUILDERS), new RegExp(`__Host-bongos_session=${token}`));
+  assert.equal(hallSees(jar), '');
+});
+
+test('a handoff is never minted for, nor redeemable on, a project hall', async () => {
+  const jar = makeJar();
+  const token = 'tok' + 'c'.repeat(40);
+  LIVE.set(token, { builder_id: 9, expires_at: new Date(Date.now() + 86400000) });
+  jar.store(APEX, [`__Host-bongos_session=${token}; Path=/; Secure; HttpOnly`]);
+  // A sign-in whose return is the hall goes to GitHub like any other — no handoff code for it.
+  const r = await request(jar, APEX, `/api/bongos/auth/web/start?return=${encodeURIComponent(`https://${HALL}/`)}`);
+  assert.equal(new URL(r.location).host, 'github.com');
+  assert.equal(buildAuthRouter.handoffUrlFor({ baseUrl: '/api/bongos' }, `https://${HALL}/x`, token, null), null);
+  // A code minted for builders. is refused on the hall host.
+  const code = buildAuthRouter.mintHandoffCode({ token, host: BUILDERS });
+  const onHall = await request(makeJar(), HALL, `/api/bongos/auth/web/handoff?code=${code}&return=%2F`);
+  assert.equal(onHall.status, 400);
+  assert.deepEqual(onHall.setCookies, []);
+  // (In production a hall's requests reach the hall's own server, never this one — the real
+  // guarantee is that no code is ever put in a URL to a non-hub host, asserted just above.)
+  // A code minted for builders. and presented on another hub host is refused AND burnt.
+  const onStatus = await request(makeJar(), `status.${APEX}`, `/api/bongos/auth/web/handoff?code=${code}&return=%2F`);
+  assert.equal(onStatus.status, 400);
+  assert.deepEqual(onStatus.setCookies, []);
+  assert.equal(buildAuthRouter.redeemHandoffCode(code, BUILDERS), null, 'single-use even on a host mismatch');
+});
+
+test('a handoff code expires, and its return can never leave the host', async () => {
+  const t0 = Date.now();
+  const code = buildAuthRouter.mintHandoffCode({ token: 'x', host: BUILDERS, now: t0 });
+  assert.equal(buildAuthRouter.redeemHandoffCode(code, BUILDERS, t0 + buildAuthRouter.HANDOFF_TTL_MS + 1), null);
+  assert.equal(buildAuthRouter.redeemHandoffCode('not-hex', BUILDERS), null);
+  const token = 'tok' + 'd'.repeat(40);
+  const good = buildAuthRouter.mintHandoffCode({ token, host: BUILDERS });
+  const r = await request(makeJar(), BUILDERS, `/api/bongos/auth/web/handoff?code=${good}&return=${encodeURIComponent('https://evil.example/')}`);
+  assert.equal(r.status, 302);
+  assert.equal(r.location, '/', 'an absolute return is dropped — relative paths only');
+});
+
+test('a browser holding a pre-fix apex-scoped session is moved onto the host-only cookie', async () => {
+  const jar = makeJar();
+  const token = 'tok' + 'e'.repeat(40);
+  LIVE.set(token, { builder_id: 10, expires_at: new Date(Date.now() + 86400000) });
+  jar.store(APEX, [`bongos_session=${token}; Domain=.${APEX}; Path=/; Secure; HttpOnly`]);
+  assert.ok(hasSession(hallSees(jar)), 'precondition: the legacy cookie reaches the hall (the bug)');
+  // Any API request on the hub…
+  await request(jar, APEX, '/api/bongos/auth/web/admission-status');
+  // …re-issues the token host-only and expires the apex-scoped copy.
+  assert.match(jar.header(APEX), new RegExp(`__Host-bongos_session=${token}`));
+  assert.equal(hallSees(jar), '', `the hall still receives: ${hallSees(jar)}`);
+});
+
+test('a dead pre-fix cookie is simply expired, and a DB failure signs nobody out', async () => {
+  const jar = makeJar();
+  jar.store(APEX, [`bongos_session=deadtoken; Domain=.${APEX}; Path=/; Secure`]);
+  await request(jar, APEX, '/api/bongos/auth/web/admission-status');
+  assert.equal(hallSees(jar), '');
+  assert.equal(jar.header(APEX), '');
+
+  const jar2 = makeJar();
+  jar2.store(APEX, [`bongos_session=anything; Domain=.${APEX}; Path=/; Secure`]);
+  const real = db.lookupSession;
+  db.lookupSession = async () => { throw new Error('db down'); };
+  try {
+    const r = await request(jar2, APEX, '/api/bongos/auth/web/admission-status');
+    assert.deepEqual(r.setCookies, [], 'a lookup that throws changes nothing');
+  } finally { db.lookupSession = real; }
+});
+
+test('plain http (localhost dev) keeps the un-prefixed name, still host-only', async () => {
+  const jar = makeJar();
+  const res = { cookies: [], cookie(n, v, o) { this.cookies.push([n, v, o]); }, clearCookie() {} };
+  buildAuthRouter.setSessionCookie({ headers: { host: 'localhost:3000' } }, res, 'tok', null);
+  assert.equal(res.cookies[0][0], 'bongos_session');
+  assert.equal(res.cookies[0][2].domain, undefined);
+  assert.equal(res.cookies[0][2].secure, false);
+  assert.equal(jar.all().length, 0);
+});

package/tests/landing_page.mjs

@@ -488,7 +488,10 @@ test('sign out POSTs, and expires both cookies in both Domain forms', () => {
   // Every accepted cookie name must be expired, not just the newest: a browser arriving with an
   // older name would otherwise keep a live cookie through "sign out". Derived from the canonical
   // list so this follows the rename chain (task 1003704, and again at 1003706).
-  assert.match(CODE, new RegExp('\\[' + SESSION_COOKIE_NAMES.map((n) => `'${n}'`).join(', ') + '\\]'));
+  // Minus the __Host- head (task 1004357): a page script cannot expire that httpOnly, Secure-only
+  // cookie; the server logout clears it.
+  const scriptClearable = SESSION_COOKIE_NAMES.filter((n) => !n.startsWith('__Host-'));
+  assert.match(CODE, new RegExp('\\[' + scriptClearable.map((n) => `'${n}'`).join(', ') + '\\]'));
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/';/);
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/; Domain=\.' \+ apex/);
   // it runs whether the POST lands or not

package/tests/session_rename_fallback.mjs

@@ -185,11 +185,13 @@ test('readSessionConfigSync falls back too — it is what resolveApiBase reads',
 const req = (cookie, authz) => ({ headers: { cookie, ...(authz ? { authorization: authz } : {}) } });
 
 test('SESSION_COOKIE_NAMES is newest-first and frozen', () => {
-  assert.deepEqual(auth.SESSION_COOKIE_NAMES, ['bongos_session', 'gds_session', 'pms_session']);
+  // __Host-bongos_session is the host-only head (task 1004357); the pre-1004357 apex-scoped
+  // bongos_session stays readable so nobody is signed out when the fix deploys.
+  assert.deepEqual(auth.SESSION_COOKIE_NAMES, ['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']);
   assert.ok(Object.isFrozen(auth.SESSION_COOKIE_NAMES));
 });
 
-for (const name of ['bongos_session', 'gds_session', 'pms_session']) {
+for (const name of ['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']) {
   test(`a request carrying ONLY ${name} still resolves a token`, () => {
     assert.deepEqual(auth.extractTokens(req(`${name}=TOKEN-X`)), ['TOKEN-X']);
   });
@@ -220,17 +222,19 @@ test('a non-session cookie is never mistaken for one', () => {
 
 // ── 4. the router sets the new name and clears the old ones ─────────────────────────────────
 
-test('routes/auth.js sets ONLY the head name and derives the clear-list from the tail', () => {
+test('routes/auth.js sets ONLY the first two names and derives the clear-list from the read-list', () => {
   const src = read('src/bongos/routes/auth.js');
   assert.match(src, /const SESSION_COOKIE = auth\.SESSION_COOKIE_NAMES\[0\];/,
-    'the SET name must be the read-list head, not a second literal');
-  assert.match(src, /const SESSION_COOKIE_OLD = auth\.SESSION_COOKIE_NAMES\.slice\(1\);/,
-    'the clear-list must be the read-list tail');
+    'the https SET name must be the read-list head, not a second literal');
+  assert.match(src, /const SESSION_COOKIE_INSECURE = auth\.SESSION_COOKIE_NAMES\[1\];/,
+    'the plain-http SET name must be the read-list second entry');
+  assert.match(src, /for \(const name of auth\.SESSION_COOKIE_NAMES\) \{\n\s+if \(name === keep\) continue;/,
+    'the clear-list must be every read-list name but the one being set');
   assert.doesNotMatch(src, /'gds_session'|"gds_session"|'pms_session'|"pms_session"/,
     'no session-cookie name may be re-declared as a literal here — that is how the lists drift');
   // Superseded names must be cleared on BOTH the sign-in write and the logout, or a stale cookie
   // outlives the session it belonged to.
-  const clears = src.split('clearSupersededSessionCookies(req, res)').length - 1;
+  const clears = src.split('clearSupersededSessionCookies(req, res').length - 1;
   assert.ok(clears >= 3, `expected the clear helper defined + used at sign-in and logout, saw ${clears}`);
 });
 
@@ -245,7 +249,7 @@ test('rate-limit.js — its dependency-free copy of the cookie names matches the
   const src = read('src/bongos/middleware/rate-limit.js');
   const m = /const SESSION_COOKIE_RES = \[([^\]]*)\]/.exec(src);
   assert.ok(m, 'SESSION_COOKIE_RES not found — did the limiter stop reading session cookies?');
-  const names = [...m[1].matchAll(/'([a-z_]+)'/g)].map((x) => x[1]);
+  const names = [...m[1].matchAll(/'([A-Za-z_-]+)'/g)].map((x) => x[1]);
   assert.deepEqual(names, auth.SESSION_COOKIE_NAMES,
     'the limiter’s copy drifted from src/bongos/auth.js SESSION_COOKIE_NAMES');
 });
@@ -256,10 +260,14 @@ test('the browser logout clears every session-cookie name', () => {
   for (const rel of ['modules/hall-ui/public/shell.js',
     'modules/public-landing/public/index.html',
     'modules/public-landing/public/projects.html']) {
-    const m = /\[((?:'[a-z_]+',?\s*)+)\]\.forEach\(function \(name\) \{/.exec(read(rel));
+    const m = /\[((?:'[A-Za-z_-]+',?\s*)+)\]\.forEach\(function \(name\) \{/.exec(read(rel));
     assert.ok(m, `${rel}: cookie-clearing list not found`);
-    const names = [...m[1].matchAll(/'([a-z_]+)'/g)].map((x) => x[1]);
-    assert.deepEqual(names, auth.SESSION_COOKIE_NAMES, `${rel}: clear-list drifted`);
+    const names = [...m[1].matchAll(/'([A-Za-z_-]+)'/g)].map((x) => x[1]);
+    // Minus the __Host- head (task 1004357): a page script cannot expire it — its expire would
+    // have to be Secure, and the httpOnly cookie is invisible to document.cookie anyway. The
+    // SERVER logout clears it (clearSupersededSessionCookies with { all: true }).
+    const scriptClearable = auth.SESSION_COOKIE_NAMES.filter((n) => !n.startsWith('__Host-'));
+    assert.deepEqual(names, scriptClearable, `${rel}: clear-list drifted`);
   }
 });
 

package/tests/subdomain_auth.mjs

@@ -3,9 +3,10 @@
 // Locks down the two security-sensitive pure helpers added for the dedicated
 // builders.<apex> subdomain:
 //   - safeReturnTo: the open-redirect guard on the post-sign-in return target.
-//   - sessionCookieDomainOpts: which hosts get an apex-scoped session cookie
-//     (so one sign-in spans the subdomains) vs a host-only one (localhost,
-//     staging — which must NOT bleed a token across environments).
+//   - legacyApexCookieOpts: the hub hosts whose PRE-1004357 apex-scoped cookies
+//     get cleared. Since task 1004357 nothing is SET with a Domain attribute —
+//     tests/hub_cookie_host_only.mjs proves that over HTTP; this pins which hosts
+//     still clear the legacy form (the hub's own four, never staging or a hall).
 // Pure functions, no DB — requiring the route module does not open a pool.
 //
 // Both helpers derive their allowed hosts from the instance branding pack's
@@ -49,7 +50,7 @@ function ok(cond, msg) {
   if (cond) { pass++; console.log(`  ok  ${msg}`); }
   else { fail++; console.log(`  FAIL ${msg}`); }
 }
-const { safeReturnTo, sessionCookieDomainOpts } = authRoute;
+const { safeReturnTo, legacyApexCookieOpts } = authRoute;
 
 // ---- safeReturnTo: open-redirect guard ------------------------------------
 console.log('\nsafeReturnTo — accepts safe same-city targets:');
@@ -72,19 +73,20 @@ ok(safeReturnTo(null) === null, 'null');
 ok(safeReturnTo('/' + 'a'.repeat(600)) === null, 'over length cap');
 ok(safeReturnTo('builders') === null, 'bare word (no leading slash, not a URL)');
 
-// ---- sessionCookieDomainOpts: cross-subdomain scoping ----------------------
+// ---- legacyApexCookieOpts: where the legacy apex-scoped form is cleared -------
 const reqWith = (host) => ({ headers: { host } });
-console.log('\nsessionCookieDomainOpts — apex-scoped on production hosts:');
-ok(sessionCookieDomainOpts(reqWith(APEX)).domain === `.${APEX}`, `apex → .${APEX}`);
-ok(sessionCookieDomainOpts(reqWith(`www.${APEX}`)).domain === `.${APEX}`, `www → .${APEX}`);
-ok(sessionCookieDomainOpts(reqWith(`builders.${APEX}`)).domain === `.${APEX}`, `builders → .${APEX}`);
-ok(sessionCookieDomainOpts(reqWith(`status.${APEX}`)).domain === `.${APEX}`, `status → .${APEX}`);
-ok(sessionCookieDomainOpts(reqWith(`${APEX}:3000`)).domain === `.${APEX}`, 'apex with port');
+console.log('\nlegacyApexCookieOpts — the hub hosts clear the legacy apex form:');
+ok(legacyApexCookieOpts(reqWith(APEX)).domain === `.${APEX}`, `apex → .${APEX}`);
+ok(legacyApexCookieOpts(reqWith(`www.${APEX}`)).domain === `.${APEX}`, `www → .${APEX}`);
+ok(legacyApexCookieOpts(reqWith(`builders.${APEX}`)).domain === `.${APEX}`, `builders → .${APEX}`);
+ok(legacyApexCookieOpts(reqWith(`status.${APEX}`)).domain === `.${APEX}`, `status → .${APEX}`);
+ok(legacyApexCookieOpts(reqWith(`${APEX}:3000`)).domain === `.${APEX}`, 'apex with port');
 
-console.log('\nsessionCookieDomainOpts — host-only elsewhere (no domain key):');
-ok(sessionCookieDomainOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
-ok(sessionCookieDomainOpts(reqWith(`staging.${APEX}`)).domain === undefined, 'staging → host-only (no cross-env bleed)');
-ok(sessionCookieDomainOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
+console.log('\nlegacyApexCookieOpts — nothing to clear elsewhere (no domain key):');
+ok(legacyApexCookieOpts(reqWith(`mercury.${APEX}`)).domain === undefined, 'a project hall host is not a hub host');
+ok(legacyApexCookieOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
+ok(legacyApexCookieOpts(reqWith(`staging.${APEX}`)).domain === undefined, 'staging → host-only (no cross-env bleed)');
+ok(legacyApexCookieOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
 
 console.log(`\nSubdomain-auth tests: ${pass} passed, ${fail} failed`);
 if (fail > 0) process.exit(1);