@dotdo/postgres 0.1.0

package/src/worker/auth.security-red.test.ts

@@ -0,0 +1,1236 @@
+/**
+ * RED PHASE: Worker Authentication Security Tests
+ *
+ * SECURITY CRITICAL: These tests protect against unauthorized access.
+ *
+ * Issue: postgres-8y64 - [P0-RED] Worker auth missing tests - auth bypass risk
+ *
+ * These tests are intentionally written to FAIL because the security features
+ * they verify are not yet implemented or have gaps. Each failing test represents
+ * a security vulnerability that needs to be addressed.
+ *
+ * Tests verify:
+ * 1. Token validation works correctly (cryptographic verification)
+ * 2. Expired tokens are rejected (with edge cases)
+ * 3. Invalid signatures are rejected (cryptographic validation)
+ * 4. Rate limiting prevents brute force (comprehensive scenarios)
+ * 5. SQL injection in claims is blocked (all injection vectors)
+ * 6. Clock skew handling (boundary conditions)
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Hono } from 'hono'
+import {
+  createAuthMiddleware,
+  requireAuth,
+  getAuth,
+  generateDatabaseId,
+  clearTokenCache,
+  clearRateLimitState,
+  type AuthConfig,
+  type AuthContext,
+  type AuthenticatedUser,
+} from './auth'
+
+// Mock fetch for testing
+const mockFetch = vi.fn()
+let originalFetch: typeof fetch
+
+beforeEach(() => {
+  mockFetch.mockReset()
+  originalFetch = globalThis.fetch
+  globalThis.fetch = mockFetch
+  clearTokenCache()
+  clearRateLimitState()
+})
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+/**
+ * Helper to create a test app with auth middleware
+ */
+function createTestApp(config: AuthConfig = {}) {
+  const app = new Hono<{ Variables: { auth: AuthContext } }>()
+  app.use('*', createAuthMiddleware(config))
+
+  app.get('/api/protected', (c) => {
+    const auth = getAuth(c)
+    return c.json({
+      user: auth.user,
+      databaseId: auth.databaseId,
+      isAuthenticated: auth.isAuthenticated,
+    })
+  })
+
+  app.get('/api/admin', requireAuth(), (c) => {
+    const auth = getAuth(c)
+    return c.json({ admin: true, user: auth.user })
+  })
+
+  return app
+}
+
+/**
+ * Helper to create a JWT-like token for testing
+ */
+function createTestJWT(
+  payload: Record<string, unknown>,
+  options: { header?: Record<string, unknown>; signature?: string } = {}
+): string {
+  const header = options.header ?? { alg: 'HS256', typ: 'JWT' }
+  const signature = options.signature ?? 'test-signature'
+
+  const headerB64 = btoa(JSON.stringify(header))
+  const payloadB64 = btoa(JSON.stringify(payload))
+
+  return `${headerB64}.${payloadB64}.${signature}`
+}
+
+// =============================================================================
+// 1. TOKEN VALIDATION - CRYPTOGRAPHIC VERIFICATION
+// =============================================================================
+
+describe('[RED] Token Cryptographic Validation', () => {
+  describe('Signature verification', () => {
+    it.fails('should reject tokens with forged signatures when using default validator', async () => {
+      // RED: Default oauth.do validator should verify signatures cryptographically
+      // Currently, if oauth.do returns success, the forged token is accepted
+      // This test FAILS because we need proper signature verification
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          user: { id: 'attacker', email: 'attacker@evil.com' },
+        }),
+      })
+
+      const app = createTestApp()
+
+      // Attacker creates a token with forged payload but mock oauth.do accepts it
+      const forgedToken = createTestJWT({
+        sub: 'admin',
+        role: 'super_admin',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${forgedToken}` },
+      })
+
+      // Should be 401 but currently returns 200 if oauth.do is mocked to accept
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should verify signature using the correct secret/public key', async () => {
+      // RED: Middleware should validate signatures locally before hitting oauth.do
+      // Currently relies entirely on external validation
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          // Simulates accepting any token without cryptographic verification
+          const parts = token.split('.')
+          if (parts.length !== 3) {
+            return { valid: false, error: 'Invalid format' }
+          }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token signed with wrong key should be rejected
+      const wrongKeyToken = createTestJWT({
+        sub: 'user123',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      }, { signature: 'signed-with-wrong-key' })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${wrongKeyToken}` },
+      })
+
+      // This should fail because signature is not verified
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject tokens with truncated signatures', async () => {
+      // RED: Truncated signatures should be rejected
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          // Does not check signature length
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Very short signature (truncated attack)
+      const truncatedSigToken = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: 'a' } // Truncated to 1 character
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${truncatedSigToken}` },
+      })
+
+      // Should reject truncated signatures
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject tokens with null signature (different from empty)', async () => {
+      // RED: null signature attack vector
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Signature that decodes to null
+      const nullSigToken = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: btoa('null') }
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${nullSigToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+  })
+
+  describe('Algorithm enforcement', () => {
+    it.fails('should only accept explicitly configured algorithms', async () => {
+      // RED: Should have allowlist of algorithms, not just blocklist of 'none'
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const header = JSON.parse(atob(parts[0]))
+          // Only blocks 'none', but accepts any other algorithm
+          if (header.alg === 'none') return { valid: false, error: 'Invalid algorithm' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Weak algorithms that should be rejected
+      const weakAlgorithms = ['HS1', 'MD5', 'SHA1', 'PS256-WEAK', 'CUSTOM']
+
+      for (const alg of weakAlgorithms) {
+        const token = createTestJWT(
+          { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+          { header: { alg, typ: 'JWT' } }
+        )
+
+        const res = await app.request('/api/protected', {
+          headers: { Authorization: `Bearer ${token}` },
+        })
+
+        // Should reject weak/unknown algorithms
+        expect(res.status).toBe(401)
+      }
+    })
+
+    it.fails('should reject jwk header injection attack', async () => {
+      // RED: JWK header injection allows attacker to specify their own key
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const header = JSON.parse(atob(parts[0]))
+          // Does not check for jwk header injection
+          if (header.alg === 'none') return { valid: false, error: 'Invalid algorithm' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token with embedded JWK (attacker's key)
+      const jwkToken = createTestJWT(
+        { sub: 'admin', role: 'admin', exp: Math.floor(Date.now() / 1000) + 3600 },
+        {
+          header: {
+            alg: 'RS256',
+            typ: 'JWT',
+            jwk: {
+              kty: 'RSA',
+              n: 'attacker-public-key-n',
+              e: 'AQAB',
+            },
+          },
+        }
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${jwkToken}` },
+      })
+
+      // Should reject tokens with embedded JWK
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject jku header injection attack', async () => {
+      // RED: JKU header injection allows attacker to specify key URL
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const header = JSON.parse(atob(parts[0]))
+          if (header.alg === 'none') return { valid: false, error: 'Invalid algorithm' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token with JKU pointing to attacker's server
+      const jkuToken = createTestJWT(
+        { sub: 'admin', role: 'admin', exp: Math.floor(Date.now() / 1000) + 3600 },
+        {
+          header: {
+            alg: 'RS256',
+            typ: 'JWT',
+            jku: 'https://attacker.com/jwks.json',
+          },
+        }
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${jkuToken}` },
+      })
+
+      // Should reject tokens with jku header
+      expect(res.status).toBe(401)
+    })
+  })
+})
+
+// =============================================================================
+// 2. EXPIRED TOKENS - EDGE CASES
+// =============================================================================
+
+describe('[RED] Expired Token Edge Cases', () => {
+  describe('Expiration boundary conditions', () => {
+    it.fails('should reject tokens that expire during request processing', async () => {
+      // RED: Race condition - token valid at start but expires during processing
+      const nowSeconds = Math.floor(Date.now() / 1000)
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          // Simulate slow validation (100ms)
+          await new Promise((resolve) => setTimeout(resolve, 100))
+
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+
+          // Check expiration AFTER delay - token may have expired
+          const currentTime = Math.floor(Date.now() / 1000)
+          if (payload.exp && payload.exp < currentTime) {
+            return { valid: false, error: 'Token expired' }
+          }
+
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token that expires in 50ms (before validation completes)
+      const expiringToken = createTestJWT({
+        sub: 'user123',
+        exp: nowSeconds + 0.05, // Expires in 50ms
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${expiringToken}` },
+      })
+
+      // Should be rejected because token expired during processing
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject tokens with exp exactly at current time (boundary)', async () => {
+      // RED: Boundary condition - exp === now should be treated as expired
+      const nowSeconds = Math.floor(Date.now() / 1000)
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Bug: Uses >= instead of > allowing exp === now
+          if (payload.exp && payload.exp >= Math.floor(Date.now() / 1000)) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // Token that expires exactly now
+      const boundaryToken = createTestJWT({
+        sub: 'user123',
+        exp: nowSeconds,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${boundaryToken}` },
+      })
+
+      // Should be rejected - exp === now means expired
+      expect(res.status).toBe(401)
+    })
+
+    it('should reject tokens with exp as string instead of number', async () => {
+      // RED: Type coercion attack - exp as string
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Bug: Doesn't validate exp is a number
+          if (payload.exp && payload.exp > Math.floor(Date.now() / 1000)) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // exp as string that coerces to large number
+      const stringExpToken = createTestJWT({
+        sub: 'user123',
+        exp: '9999999999', // String, not number
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${stringExpToken}` },
+      })
+
+      // Should reject - exp must be a number
+      expect(res.status).toBe(401)
+    })
+
+    it('should reject tokens with exp as array', async () => {
+      // RED: Type confusion - exp as array
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Bug: Doesn't check if exp is actually a number
+          if (payload.exp > Math.floor(Date.now() / 1000)) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // exp as array
+      const arrayExpToken = createTestJWT({
+        sub: 'user123',
+        exp: [9999999999],
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${arrayExpToken}` },
+      })
+
+      // Should reject - exp must be a number
+      expect(res.status).toBe(401)
+    })
+
+    it('should reject tokens with exp as object', async () => {
+      // RED: Type confusion - exp as object
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          if (payload.exp > Math.floor(Date.now() / 1000)) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // exp as object with valueOf
+      const objectExpToken = createTestJWT({
+        sub: 'user123',
+        exp: { valueOf: 9999999999 },
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${objectExpToken}` },
+      })
+
+      // Should reject - exp must be a number
+      expect(res.status).toBe(401)
+    })
+
+    it('should reject tokens with exp as Infinity', async () => {
+      // RED: Never-expiring token attack
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          if (!isFinite(payload.exp)) {
+            return { valid: false, error: 'Invalid expiration' }
+          }
+          if (payload.exp > Math.floor(Date.now() / 1000)) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // This test would need special handling since JSON doesn't support Infinity
+      // We test with a very large number instead
+      const infinityLikeToken = createTestJWT({
+        sub: 'user123',
+        exp: Number.MAX_SAFE_INTEGER,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${infinityLikeToken}` },
+      })
+
+      // Should reject tokens with unreasonably far future exp
+      expect(res.status).toBe(401)
+    })
+
+    it('should enforce maximum token lifetime', async () => {
+      // RED: Tokens with exp too far in the future should be rejected
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          const now = Math.floor(Date.now() / 1000)
+          const maxLifetime = 24 * 60 * 60 // 24 hours max
+
+          // Bug: No maximum lifetime check
+          if (payload.exp && payload.exp > now) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // Token valid for 1 year (should be rejected)
+      const longLivedToken = createTestJWT({
+        sub: 'user123',
+        exp: Math.floor(Date.now() / 1000) + 365 * 24 * 60 * 60,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${longLivedToken}` },
+      })
+
+      // Should reject - token lifetime exceeds maximum
+      expect(res.status).toBe(401)
+    })
+  })
+})
+
+// =============================================================================
+// 3. INVALID SIGNATURES - COMPREHENSIVE
+// =============================================================================
+
+describe('[RED] Invalid Signature Handling', () => {
+  describe('Signature manipulation attacks', () => {
+    it.fails('should reject signature with appended data', async () => {
+      // RED: Appending data to valid signature
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const payload = JSON.parse(atob(parts[1]))
+          // Bug: Doesn't verify signature integrity
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const tokenWithAppendedSig = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: 'valid-signature-APPENDED_DATA' }
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${tokenWithAppendedSig}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject signature with prepended data', async () => {
+      // RED: Prepending data to valid signature
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const tokenWithPrependedSig = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: 'PREPENDED_DATA-valid-signature' }
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${tokenWithPrependedSig}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject signature with modified byte', async () => {
+      // RED: Single byte modification in signature
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Signature with one character changed
+      const modifiedSigToken = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: 'valid-signaturX' } // X instead of e
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${modifiedSigToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should reject base64url vs base64 confusion in signature', async () => {
+      // RED: Base64 encoding confusion attack
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          if (parts.length !== 3) return { valid: false, error: 'Invalid' }
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Use standard base64 characters instead of base64url
+      const base64ConfusionToken = createTestJWT(
+        { sub: 'user123', exp: Math.floor(Date.now() / 1000) + 3600 },
+        { signature: 'sig+with/base64+chars==' } // + and / instead of - and _
+      )
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${base64ConfusionToken}` },
+      })
+
+      // Should normalize and reject if doesn't match
+      expect(res.status).toBe(401)
+    })
+  })
+})
+
+// =============================================================================
+// 4. RATE LIMITING - BRUTE FORCE PREVENTION
+// =============================================================================
+
+describe('[RED] Rate Limiting Brute Force Prevention', () => {
+  describe('Rate limit bypass attempts', () => {
+    it('should rate limit by IP address, not just by token', async () => {
+      // RED: Current implementation rate limits by token prefix
+      // Attacker can bypass by using different tokens from same IP
+      const requestsFromIP = new Map<string, number>()
+      const ipRateLimit = 100
+
+      const app = new Hono<{ Variables: { auth: AuthContext } }>()
+      app.use('*', async (c, next) => {
+        const ip = c.req.header('CF-Connecting-IP') || '127.0.0.1'
+        const count = (requestsFromIP.get(ip) || 0) + 1
+        requestsFromIP.set(ip, count)
+
+        if (count > ipRateLimit) {
+          return c.json({ error: true, code: 'RATE_LIMITED' }, 429)
+        }
+        return next()
+      })
+      app.use('*', createAuthMiddleware({
+        validateToken: async () => ({ valid: false, error: 'Invalid' }),
+      }))
+      app.get('/api/protected', (c) => c.json({ success: true }))
+
+      // Attacker tries many different tokens from same IP
+      for (let i = 0; i < ipRateLimit + 10; i++) {
+        clearTokenCache()
+        const uniqueToken = createTestJWT({ sub: `attempt-${i}` })
+        const res = await app.request('/api/protected', {
+          headers: {
+            Authorization: `Bearer ${uniqueToken}`,
+            'CF-Connecting-IP': '192.168.1.100',
+          },
+        })
+
+        if (i >= ipRateLimit) {
+          // Should be rate limited by IP
+          expect(res.status).toBe(429)
+        }
+      }
+    })
+
+    it.fails('should implement exponential backoff for repeated failures', async () => {
+      // RED: Should increase delay between allowed attempts after failures
+      const failureCount = new Map<string, { count: number; lastAttempt: number }>()
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const key = token.slice(0, 20)
+          const entry = failureCount.get(key) || { count: 0, lastAttempt: 0 }
+          const now = Date.now()
+
+          // Exponential backoff: 2^failures seconds
+          const requiredDelay = Math.pow(2, entry.count) * 1000
+          if (now - entry.lastAttempt < requiredDelay) {
+            return { valid: false, error: 'Rate limited - exponential backoff' }
+          }
+
+          entry.count++
+          entry.lastAttempt = now
+          failureCount.set(key, entry)
+
+          return { valid: false, error: 'Invalid token' }
+        },
+      })
+
+      const token = createTestJWT({ sub: 'brute-force-attempt' })
+
+      // Rapid sequential requests should be blocked with increasing delays
+      const results: number[] = []
+      for (let i = 0; i < 5; i++) {
+        clearTokenCache()
+        const res = await app.request('/api/protected', {
+          headers: { Authorization: `Bearer ${token}` },
+        })
+        results.push(res.status)
+      }
+
+      // After several attempts, should see rate limiting
+      expect(results.filter((s) => s === 429).length).toBeGreaterThan(0)
+    })
+
+    it('should prevent distributed brute force from multiple IPs', async () => {
+      // RED: Should detect patterns across multiple IPs targeting same account
+      const targetUser = 'victim@example.com'
+      const attemptsByTarget = new Map<string, number>()
+      const distributedLimit = 50
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          const targetEmail = payload.email
+
+          if (targetEmail) {
+            const count = (attemptsByTarget.get(targetEmail) || 0) + 1
+            attemptsByTarget.set(targetEmail, count)
+
+            if (count > distributedLimit) {
+              return { valid: false, error: 'Account locked due to suspicious activity' }
+            }
+          }
+
+          return { valid: false, error: 'Invalid credentials' }
+        },
+      })
+
+      // Distributed attack from different IPs
+      for (let i = 0; i < distributedLimit + 10; i++) {
+        clearTokenCache()
+        const token = createTestJWT({
+          sub: 'unknown',
+          email: targetUser,
+          password_attempt: `password${i}`,
+        })
+
+        const res = await app.request('/api/protected', {
+          headers: {
+            Authorization: `Bearer ${token}`,
+            'CF-Connecting-IP': `192.168.${Math.floor(i / 255)}.${i % 255}`,
+          },
+        })
+
+        if (i >= distributedLimit) {
+          // Should detect distributed attack and lock account
+          expect(res.status).toBe(429)
+        }
+      }
+    })
+
+    it('should apply stricter rate limits for sensitive operations', async () => {
+      // RED: Different rate limits for different endpoints
+      const requestCounts = new Map<string, number>()
+
+      const app = new Hono<{ Variables: { auth: AuthContext } }>()
+      app.use('*', createAuthMiddleware({
+        validateToken: async () => ({
+          valid: true,
+          user: { id: 'user123', email: 'test@test.com' },
+        }),
+      }))
+
+      // Stricter rate limit for sensitive endpoint
+      app.get('/api/admin', async (c, next) => {
+        const key = 'admin'
+        const count = (requestCounts.get(key) || 0) + 1
+        requestCounts.set(key, count)
+
+        if (count > 5) { // Only 5 requests allowed
+          return c.json({ error: true, code: 'RATE_LIMITED' }, 429)
+        }
+        return c.json({ admin: true })
+      })
+
+      const token = createTestJWT({ sub: 'user123' })
+
+      // Should hit rate limit quickly for admin endpoint
+      for (let i = 0; i < 10; i++) {
+        clearTokenCache()
+        const res = await app.request('/api/admin', {
+          headers: { Authorization: `Bearer ${token}` },
+        })
+
+        if (i >= 5) {
+          expect(res.status).toBe(429)
+        }
+      }
+    })
+  })
+})
+
+// =============================================================================
+// 5. SQL INJECTION IN CLAIMS
+// =============================================================================
+
+describe('[RED] SQL Injection in Claims', () => {
+  describe('SQL injection vectors in user ID', () => {
+    it('should block union-based SQL injection in sub claim', async () => {
+      // RED: UNION injection in user ID
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Returns user with potentially malicious ID
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const unionInjectionToken = createTestJWT({
+        sub: "1' UNION SELECT * FROM users--",
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${unionInjectionToken}` },
+      })
+
+      // Should reject SQL injection patterns
+      expect(res.status).toBe(401)
+    })
+
+    it('should block time-based blind SQL injection', async () => {
+      // RED: Time-based blind injection
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const blindInjectionToken = createTestJWT({
+        sub: "1'; WAITFOR DELAY '00:00:05'--",
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${blindInjectionToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it('should block stacked queries injection', async () => {
+      // RED: Stacked queries
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const stackedToken = createTestJWT({
+        sub: "1'; DROP TABLE users; SELECT '1",
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${stackedToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it('should block SQL injection in email claim', async () => {
+      // RED: Injection via email claim
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return {
+            valid: true,
+            user: { id: payload.sub, email: payload.email },
+          }
+        },
+      })
+
+      const emailInjectionToken = createTestJWT({
+        sub: 'user123',
+        email: "test@test.com'; DELETE FROM logs--",
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${emailInjectionToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should block SQL injection in custom metadata claims', async () => {
+      // RED: Injection via custom claims
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return {
+            valid: true,
+            user: {
+              id: payload.sub,
+              email: 'test@test.com',
+              metadata: { tenantId: payload.tenant_id },
+            },
+          }
+        },
+      })
+
+      const metadataInjectionToken = createTestJWT({
+        sub: 'user123',
+        tenant_id: "tenant-a' OR '1'='1",
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${metadataInjectionToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it('should block NoSQL injection in claims', async () => {
+      // RED: NoSQL/MongoDB-style injection
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const nosqlInjectionToken = createTestJWT({
+        sub: { $gt: '' }, // MongoDB injection
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${nosqlInjectionToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+
+    it.fails('should block LDAP injection in claims', async () => {
+      // RED: LDAP injection if claims are used in LDAP queries
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      const ldapInjectionToken = createTestJWT({
+        sub: '*)(uid=*))(|(uid=*',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${ldapInjectionToken}` },
+      })
+
+      expect(res.status).toBe(401)
+    })
+  })
+
+  describe('Database ID generation security', () => {
+    it('should sanitize all SQL metacharacters in generateDatabaseId', async () => {
+      // RED: generateDatabaseId may not sanitize all dangerous patterns
+      const dangerousInputs = [
+        "user'; DROP TABLE--",
+        'user/**/UNION/**/SELECT',
+        'user%00admin',
+        'user\x00admin',
+        'user\nadmin',
+        'user\radmin',
+        "user\\'admin",
+        'user\\admin',
+        'user`admin`',
+        'user$(whoami)',
+        'user|cat /etc/passwd',
+        'user&& ls',
+        'user; ls',
+      ]
+
+      for (const input of dangerousInputs) {
+        const dbId = generateDatabaseId(input)
+
+        // Should not contain any dangerous characters
+        expect(dbId).not.toMatch(/[';"\-\-\/\*\x00\n\r\\`$|&;]/)
+        // Should be alphanumeric with underscores only
+        expect(dbId).toMatch(/^[a-zA-Z0-9_]+$/)
+      }
+    })
+  })
+})
+
+// =============================================================================
+// 6. CLOCK SKEW HANDLING
+// =============================================================================
+
+describe('[RED] Clock Skew Handling', () => {
+  describe('Clock skew edge cases', () => {
+    it('should reject tokens with exp exactly at clock skew boundary', async () => {
+      // RED: Boundary condition at exactly MAX_CLOCK_SKEW_SECONDS
+      const MAX_CLOCK_SKEW = 60 // From auth.ts
+      const now = Math.floor(Date.now() / 1000)
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Uses <= which allows tokens at exactly the boundary
+          if (payload.exp + MAX_CLOCK_SKEW >= now) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // Token expired exactly MAX_CLOCK_SKEW seconds ago (boundary)
+      const boundaryToken = createTestJWT({
+        sub: 'user123',
+        exp: now - MAX_CLOCK_SKEW,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${boundaryToken}` },
+      })
+
+      // Should be rejected at exactly the boundary
+      expect(res.status).toBe(401)
+    })
+
+    it('should reject tokens with nbf exactly at clock skew boundary', async () => {
+      // RED: Boundary condition for not-before claim
+      const MAX_CLOCK_SKEW = 60
+      const now = Math.floor(Date.now() / 1000)
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+          // Uses >= which allows tokens at exactly the boundary
+          if (payload.nbf - MAX_CLOCK_SKEW <= now) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token not yet valid' }
+        },
+      })
+
+      // Token becomes valid exactly MAX_CLOCK_SKEW seconds in the future (boundary)
+      const boundaryToken = createTestJWT({
+        sub: 'user123',
+        nbf: now + MAX_CLOCK_SKEW,
+        exp: now + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${boundaryToken}` },
+      })
+
+      // Should be rejected at exactly the boundary
+      expect(res.status).toBe(401)
+    })
+
+    it('should handle clock skew when iat is in the future', async () => {
+      // RED: iat (issued at) in the future indicates clock issues or forgery
+      const now = Math.floor(Date.now() / 1000)
+      const MAX_CLOCK_SKEW = 60
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+
+          // Check if iat is unreasonably in the future
+          if (payload.iat && payload.iat > now + MAX_CLOCK_SKEW) {
+            return { valid: false, error: 'Token issued in the future' }
+          }
+
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token with iat 5 minutes in the future
+      const futureIatToken = createTestJWT({
+        sub: 'user123',
+        iat: now + 300,
+        exp: now + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${futureIatToken}` },
+      })
+
+      // Should reject - iat too far in future
+      expect(res.status).toBe(401)
+    })
+
+    it('should apply clock skew consistently across all time claims', async () => {
+      // RED: Clock skew should be applied to exp, nbf, and iat consistently
+      const now = Math.floor(Date.now() / 1000)
+      const MAX_CLOCK_SKEW = 60
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+
+          // Check all time claims with consistent skew
+          const effectiveNow = now
+
+          // exp check (with skew)
+          if (payload.exp && payload.exp + MAX_CLOCK_SKEW < effectiveNow) {
+            return { valid: false, error: 'Token expired' }
+          }
+
+          // nbf check (with skew)
+          if (payload.nbf && payload.nbf - MAX_CLOCK_SKEW > effectiveNow) {
+            return { valid: false, error: 'Token not yet valid' }
+          }
+
+          // iat check (with skew)
+          if (payload.iat && payload.iat - MAX_CLOCK_SKEW > effectiveNow) {
+            return { valid: false, error: 'Token from future' }
+          }
+
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Token with slightly future iat but within skew
+      const slightlyFutureToken = createTestJWT({
+        sub: 'user123',
+        iat: now + 30, // 30 seconds in future (within 60s skew)
+        nbf: now - 10,
+        exp: now + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${slightlyFutureToken}` },
+      })
+
+      // Should accept - within clock skew tolerance
+      expect(res.status).toBe(200)
+    })
+
+    it('should not allow clock skew to extend token lifetime', async () => {
+      // RED: Clock skew should not effectively extend token lifetime
+      const now = Math.floor(Date.now() / 1000)
+      const MAX_CLOCK_SKEW = 60
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+
+          // Token lifetime should be measured from iat to exp
+          const lifetime = payload.exp - payload.iat
+          const maxLifetime = 24 * 60 * 60 // 24 hours
+
+          // Bug: Attacker can set iat in the past to extend effective lifetime
+          if (lifetime > maxLifetime) {
+            return { valid: false, error: 'Token lifetime too long' }
+          }
+
+          return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+        },
+      })
+
+      // Attacker sets iat far in past to get longer effective lifetime
+      const extendedToken = createTestJWT({
+        sub: 'user123',
+        iat: now - 365 * 24 * 60 * 60, // 1 year ago
+        exp: now + 3600,
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${extendedToken}` },
+      })
+
+      // Should reject - effective lifetime exceeds maximum
+      expect(res.status).toBe(401)
+    })
+
+    it('should validate that exp > nbf', async () => {
+      // RED: Invalid token where exp is before nbf
+      const now = Math.floor(Date.now() / 1000)
+
+      const app = createTestApp({
+        validateToken: async (token: string) => {
+          const parts = token.split('.')
+          const payload = JSON.parse(atob(parts[1]))
+
+          // Bug: Doesn't check that exp > nbf
+          if (payload.exp > now) {
+            return { valid: true, user: { id: payload.sub, email: 'test@test.com' } }
+          }
+          return { valid: false, error: 'Token expired' }
+        },
+      })
+
+      // Invalid: exp before nbf
+      const invalidToken = createTestJWT({
+        sub: 'user123',
+        nbf: now + 7200,
+        exp: now + 3600, // exp before nbf
+      })
+
+      const res = await app.request('/api/protected', {
+        headers: { Authorization: `Bearer ${invalidToken}` },
+      })
+
+      // Should reject - logically invalid time claims
+      expect(res.status).toBe(401)
+    })
+  })
+})