@johnnyboy11234/esg-idea-contest 0.2.0 → 0.2.2

package/backend/internal/auth/csrf_test.go

@@ -0,0 +1,281 @@
+package auth_test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const (
+	keyA = "0123456789abcdef0123456789abcdef"
+	keyB = "fedcba9876543210fedcba9876543210"
+)
+
+func sid(t *testing.T) string {
+	t.Helper()
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		t.Fatal(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+func mustCSRF(t *testing.T, cur string, prev ...string) *auth.CSRF {
+	t.Helper()
+	c, err := auth.NewCSRF(cur, prev...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+type denial struct{ action, reason string }
+
+// csrfChain mirrors production order: session middleware, then CSRF, then router.
+func csrfChain(c *auth.CSRF, v auth.Validator, got *denial) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(web.NotFound)
+	r.MethodNotAllowed(web.MethodNotAllowed)
+	ok := func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }
+	r.Get("/auth/csrf", auth.Handler{CSRF: c, Log: slog.New(slog.DiscardHandler)}.GetCsrfToken)
+	r.Post("/w", ok)
+	r.Put("/w", ok)
+	r.Delete("/w", ok)
+	r.Post("/auth/logout", ok)
+	fail := func(w http.ResponseWriter, req *http.Request, err error) {
+		var e *web.Error
+		if errors.As(err, &e) && got != nil {
+			*got = denial{e.AuditAction, e.AuditReason}
+		}
+		web.WriteError(w, req, err)
+	}
+	action := func(req *http.Request) string {
+		if req.URL.Path == "/auth/logout" {
+			return "AUTH_LOGOUT"
+		}
+		return ""
+	}
+	public := func(req *http.Request) bool { return req.URL.Path == "/auth/csrf" || req.URL.Path == "/auth/logout" }
+	log := slog.New(slog.DiscardHandler)
+	return web.RequestID(auth.Middleware(v, public, log)(c.Middleware(fail, action)(r)))
+}
+
+func fetch(t *testing.T, h http.Handler, session string) string {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("GET /auth/csrf = %d %s", rec.Code, rec.Body)
+	}
+	var body struct{ Token string }
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil || body.Token == "" {
+		t.Fatalf("body %s: %v", rec.Body, err)
+	}
+	var ck *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == auth.CSRFCookie {
+			ck = c
+		}
+	}
+	if ck == nil || ck.Value != body.Token {
+		t.Fatalf("cookie %v does not match body token", ck)
+	}
+	if !ck.HttpOnly || !ck.Secure || ck.Path != "/" || ck.Domain != "" || ck.SameSite != http.SameSiteLaxMode {
+		t.Errorf("cookie attributes: %+v", ck)
+	}
+	if rec.Header().Get("Cache-Control") != "no-store" {
+		t.Errorf("Cache-Control = %q", rec.Header().Get("Cache-Control"))
+	}
+	return body.Token
+}
+
+func write(method, path, session, cookie, header string) *http.Request {
+	req := httptest.NewRequest(method, path, strings.NewReader("ignored"))
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: auth.CSRFCookie, Value: cookie})
+	}
+	if header != "" {
+		req.Header.Set(auth.CSRFHeader, header)
+	}
+	return req
+}
+
+func TestCSRFWrites(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	s1, s2 := sid(t), sid(t)
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	v := &fakeValidator{live: map[string]security.Principal{s1: user, s2: user}}
+	h := csrfChain(c, v, nil)
+
+	anon, tok1, tok2 := fetch(t, h, ""), fetch(t, h, s1), fetch(t, h, s2)
+	other := mustCSRF(t, keyB)
+	foreign, _ := other.Issue([]byte("x"))
+
+	tests := []struct {
+		name                    string
+		method, path            string
+		session, cookie, header string
+		status                  int
+	}{
+		{"session token, own session", "POST", "/w", s1, tok1, tok1, 204},
+		{"anonymous token, no session", "POST", "/auth/logout", "", anon, anon, 204},
+		{"PUT and DELETE are checked", "PUT", "/w", s1, "", "", 403},
+		{"DELETE with token", "DELETE", "/w", s1, tok1, tok1, 204},
+		{"no header", "POST", "/w", s1, tok1, "", 403},
+		{"no cookie", "POST", "/w", s1, "", tok1, 403},
+		{"cookie and header differ", "POST", "/w", s1, tok1, tok2, 403},
+		{"other session's token", "POST", "/w", s1, tok2, tok2, 403},
+		{"anonymous token against a session", "POST", "/w", s1, anon, anon, 403},
+		{"session token without a session (logout)", "POST", "/auth/logout", "", tok1, tok1, 403},
+		{"session token, stale session cookie (logout)", "POST", "/auth/logout", sid(t), tok1, tok1, 403},
+		{"signed by an unknown key", "POST", "/w", s1, foreign, foreign, 403},
+		{"garbage", "POST", "/w", s1, "abc", "abc", 403},
+		{"truncated signature", "POST", "/w", s1, tok1[:len(tok1)-2], tok1[:len(tok1)-2], 403},
+		{"no dot", "POST", "/w", s1, strings.ReplaceAll(tok1, ".", ""), strings.ReplaceAll(tok1, ".", ""), 403},
+		{"403 beats 404 on unknown path", "POST", "/nope", s1, "", "", 403},
+		{"unknown path, valid token, is 404", "POST", "/nope", s1, tok1, tok1, 404},
+		{"401 beats 403", "POST", "/w", "", "", "", 401},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, write(tc.method, tc.path, tc.session, tc.cookie, tc.header))
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d (%s)", rec.Code, tc.status, rec.Body)
+			}
+			if tc.status == 403 && !strings.Contains(rec.Body.String(), `"code":"CSRF_INVALID"`) {
+				t.Errorf("body %s", rec.Body)
+			}
+		})
+	}
+}
+
+func TestCSRFSafeMethodsAreNotChecked(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	for _, m := range []string{"GET", "HEAD", "OPTIONS"} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(m, "/auth/csrf", nil))
+		if rec.Code == 403 {
+			t.Errorf("%s was CSRF-checked", m)
+		}
+	}
+}
+
+func TestCSRFNeverReadsBody(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	req := write("POST", "/auth/logout", "", "", "")
+	req.Body = failReader{t}
+	h.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+type failReader struct{ t *testing.T }
+
+func (f failReader) Read([]byte) (int, error) { f.t.Error("body was read"); return 0, context.Canceled }
+func (failReader) Close() error               { return nil }
+
+func TestCSRFDenialAuditFields(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	anon := fetch(t, csrfChain(c, &fakeValidator{}, nil), "")
+	for _, tc := range []struct{ name, cookie, header, reason string }{
+		{"missing", "", "", "csrf_missing"},
+		{"mismatch", anon, anon + "x", "csrf_mismatch"},
+		{"bad signature", "a.b", "a.b", "csrf_invalid_binding"},
+	} {
+		var d denial
+		rec := httptest.NewRecorder()
+		csrfChain(c, &fakeValidator{}, &d).ServeHTTP(rec, write("POST", "/auth/logout", "", tc.cookie, tc.header))
+		if rec.Code != 403 || d != (denial{"AUTH_LOGOUT", tc.reason}) {
+			t.Errorf("%s: status %d, audit %+v", tc.name, rec.Code, d)
+		}
+	}
+	// Unrouted write: denied, but nothing to audit.
+	var d denial
+	csrfChain(c, &fakeValidator{live: map[string]security.Principal{"x": {}}}, &d).
+		ServeHTTP(httptest.NewRecorder(), write("POST", "/w", "", "", ""))
+	if d != (denial{}) {
+		t.Errorf("unknown action was audited: %+v", d)
+	}
+}
+
+func TestCSRFTokensAreFresh(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	first, second := fetch(t, h, ""), fetch(t, h, "")
+	if first == second {
+		t.Error("two tokens are equal")
+	}
+}
+
+func TestCSRFKeyRotation(t *testing.T) {
+	b := []byte("binding")
+	old := mustCSRF(t, keyA)
+	tok, _ := old.Issue(b)
+
+	rotated := mustCSRF(t, keyB, keyA)
+	if !rotated.Verify(tok, b) {
+		t.Error("previous key must still verify")
+	}
+	if fresh, _ := rotated.Issue(b); !mustCSRF(t, keyB).Verify(fresh, b) || old.Verify(fresh, b) {
+		t.Error("new tokens must be signed by the current key only")
+	}
+	if mustCSRF(t, keyB).Verify(tok, b) {
+		t.Error("after the previous key is dropped the old token must fail")
+	}
+	if !mustCSRF(t, keyB, "").Verify(mustTok(t, mustCSRF(t, keyB), b), b) {
+		t.Error("empty previous key means none")
+	}
+	if old.Verify(tok, []byte("other")) {
+		t.Error("binding must be part of the signature")
+	}
+}
+
+func mustTok(t *testing.T, c *auth.CSRF, b []byte) string {
+	t.Helper()
+	tok, err := c.Issue(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tok
+}
+
+func TestNewCSRFRejectsShortKeys(t *testing.T) {
+	if _, err := auth.NewCSRF("short"); err == nil {
+		t.Error("short current key accepted")
+	}
+	if _, err := auth.NewCSRF(keyA, "short"); err == nil {
+		t.Error("short previous key accepted")
+	}
+}
+
+func TestCSRFSessionWithUnbindableIDIs500(t *testing.T) {
+	// A validator that accepts an ID Binding cannot parse is a wiring bug: fail closed.
+	v := &fakeValidator{live: map[string]security.Principal{"not-an-id": {Role: security.RoleUser}}}
+	h := csrfChain(mustCSRF(t, keyA), v, nil)
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: "not-an-id"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 500 {
+		t.Errorf("status = %d", rec.Code)
+	}
+}

package/backend/internal/auth/internal/store/session.go

@@ -0,0 +1,111 @@
+// Package store holds the SQL of the auth module. Only the auth module may
+// import it (Go's internal rule); no other module touches the session table.
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+// Limits are the session timeouts in seconds (PRD §6.5).
+type Limits struct {
+	IdleSeconds     int
+	AbsoluteSeconds int
+	RefreshSeconds  int
+}
+
+// Insert stores a new session row. hash is SHA-256 of the session ID.
+func Insert(ctx context.Context, db *sql.DB, hash []byte, userID uuid.UUID) error {
+	_, err := db.ExecContext(ctx,
+		`INSERT INTO session (id_hash, user_id) VALUES (?, ?)`, hash, userID.String())
+	if err != nil {
+		return fmt.Errorf("insert session: %w", err)
+	}
+	return nil
+}
+
+// Touch validates and refreshes a session in ONE statement on database time.
+// It reports true when the row matched: the session exists, is inside both
+// timeouts and its account is enabled. RowsAffected counts matched rows
+// (clientFoundRows=true in the DSN), so a row that needs no refresh still
+// counts; a test locks this. last_access_at is written only when older than
+// the refresh interval (OI-11).
+func Touch(ctx context.Context, db *sql.DB, hash []byte, l Limits) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE session s JOIN app_user u ON u.id = s.user_id
+		    SET s.last_access_at = IF(s.last_access_at < NOW(6) - INTERVAL ? SECOND, NOW(6), s.last_access_at)
+		  WHERE s.id_hash = ?
+		    AND u.enabled
+		    AND s.last_access_at > NOW(6) - INTERVAL ? SECOND
+		    AND s.created_at     > NOW(6) - INTERVAL ? SECOND`,
+		l.RefreshSeconds, hash, l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return false, fmt.Errorf("touch session: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("touch session rows: %w", err)
+	}
+	return n == 1, nil
+}
+
+// Principal reads the caller behind a session. The role comes from app_user,
+// never from the session. found is false when the session vanished between
+// Touch and this read (logout, revoke, purge).
+func Principal(ctx context.Context, db *sql.DB, hash []byte) (p security.Principal, found bool, err error) {
+	var id, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT u.id, u.emp_no, u.role
+		   FROM session s JOIN app_user u ON u.id = s.user_id
+		  WHERE s.id_hash = ? AND u.enabled`, hash).Scan(&id, &p.EmpNo, &role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return security.Principal{}, false, nil
+	}
+	if err != nil {
+		return security.Principal{}, false, fmt.Errorf("read session principal: %w", err)
+	}
+	if p.UserID, err = uuid.Parse(id); err != nil {
+		return security.Principal{}, false, fmt.Errorf("parse user id %q: %w", id, err)
+	}
+	p.Role = security.Role(role)
+	return p, true, nil
+}
+
+// Delete removes one session; deleting a missing one is not an error.
+func Delete(ctx context.Context, db *sql.DB, hash []byte) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
+		return fmt.Errorf("delete session: %w", err)
+	}
+	return nil
+}
+
+// DeleteByUser removes every session of one account.
+func DeleteByUser(ctx context.Context, db *sql.DB, userID uuid.UUID) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE user_id = ?`, userID.String()); err != nil {
+		return fmt.Errorf("delete sessions of user: %w", err)
+	}
+	return nil
+}
+
+// DeleteExpired removes sessions past either timeout and returns how many.
+func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
+	res, err := db.ExecContext(ctx,
+		`DELETE FROM session
+		  WHERE last_access_at <= NOW(6) - INTERVAL ? SECOND
+		     OR created_at     <= NOW(6) - INTERVAL ? SECOND`,
+		l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions rows: %w", err)
+	}
+	return n, nil
+}

package/backend/internal/auth/middleware.go

@@ -0,0 +1,66 @@
+package auth
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// SessionCookie is the session cookie name (openapi sessionCookie). The
+// __Host- prefix forces Secure, Path=/ and no Domain.
+const SessionCookie = "__Host-session"
+
+// Validator resolves a cookie value to its caller. *Sessions implements it.
+type Validator interface {
+	Validate(ctx context.Context, id string) (p security.Principal, ok bool, err error)
+}
+
+// Public reports whether a request may be served without a session. It is
+// decided on method and path before routing, so unknown paths are not public.
+type Public func(r *http.Request) bool
+
+// Middleware is the session middleware (Backend.md §3, §6). It must wrap the
+// router, not sit inside it, so that an unknown path without a session answers
+// 401 and only a caller with a session learns it is a 404 (PRD §6.1).
+//
+//   - Public request: a valid session is still resolved (the principal is then
+//     in the context for the audit actor and the session-bound CSRF token); a
+//     missing or invalid one is simply anonymous.
+//   - Any other request: no valid session → 401 UNAUTHENTICATED. With a valid
+//     session the principal is stored in the context and routing continues, so
+//     404 and 405 come from the router.
+//
+// It never reads the body. A database failure answers 500, never a guess.
+func Middleware(v Validator, public Public, log *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			isPublic := public != nil && public(r)
+
+			var (
+				p  security.Principal
+				ok bool
+			)
+			if c, err := r.Cookie(SessionCookie); err == nil && c.Value != "" {
+				var verr error
+				if p, ok, verr = v.Validate(r.Context(), c.Value); verr != nil {
+					log.ErrorContext(r.Context(), "session validation failed",
+						"requestId", web.RequestIDFrom(r.Context()), "error", verr)
+					web.WriteProblem(w, r, web.NewError(web.CodeInternalError, ""))
+					return
+				}
+			}
+
+			switch {
+			case ok:
+				r = r.WithContext(security.WithPrincipal(r.Context(), p))
+			case !isPublic:
+				web.WriteProblem(w, r, web.NewError(web.CodeUnauthenticated, "Authentication required."))
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}

package/backend/internal/auth/middleware_test.go

@@ -0,0 +1,153 @@
+package auth_test
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+type fakeValidator struct {
+	live  map[string]security.Principal
+	err   error
+	calls int
+}
+
+func (f *fakeValidator) Validate(_ context.Context, id string) (security.Principal, bool, error) {
+	f.calls++
+	if f.err != nil {
+		return security.Principal{}, false, f.err
+	}
+	p, ok := f.live[id]
+	return p, ok, nil
+}
+
+func isPublic(r *http.Request) bool {
+	return r.Method == "GET" && r.URL.Path == "/open"
+}
+
+// chain mirrors production: middleware wraps the router, whose NotFound and
+// MethodNotAllowed hooks are the web ones.
+func chain(v auth.Validator, seen *security.Principal) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(web.NotFound)
+	r.MethodNotAllowed(web.MethodNotAllowed)
+	h := func(w http.ResponseWriter, req *http.Request) {
+		if p, ok := security.PrincipalFrom(req.Context()); ok && seen != nil {
+			*seen = p
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+	r.Get("/open", h)
+	r.Get("/closed", h)
+	return web.RequestID(auth.Middleware(v, isPublic, slog.New(slog.DiscardHandler))(r))
+}
+
+func request(method, path, cookie string) *http.Request {
+	req := httptest.NewRequest(method, path, nil)
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: cookie})
+	}
+	return req
+}
+
+func TestMiddlewareCombinations(t *testing.T) {
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	v := &fakeValidator{live: map[string]security.Principal{"good": user}}
+
+	tests := []struct {
+		name         string
+		method, path string
+		cookie       string
+		status       int
+		code         string
+		principal    bool
+	}{
+		{"public, no session", "GET", "/open", "", 204, "", false},
+		{"public, valid session", "GET", "/open", "good", 204, "", true},
+		{"public, invalid session is anonymous", "GET", "/open", "stale", 204, "", false},
+		{"public path, other method, no session", "POST", "/open", "", 401, "UNAUTHENTICATED", false},
+		{"public path, other method, session", "POST", "/open", "good", 405, "METHOD_NOT_ALLOWED", false},
+		{"protected, no session", "GET", "/closed", "", 401, "UNAUTHENTICATED", false},
+		{"protected, invalid session", "GET", "/closed", "stale", 401, "UNAUTHENTICATED", false},
+		{"protected, valid session", "GET", "/closed", "good", 204, "", true},
+		{"unknown path, no session", "GET", "/nope", "", 401, "UNAUTHENTICATED", false},
+		{"unknown path, invalid session", "GET", "/nope", "stale", 401, "UNAUTHENTICATED", false},
+		{"unknown path, session", "GET", "/nope", "good", 404, "NOT_FOUND", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var seen security.Principal
+			rec := httptest.NewRecorder()
+			chain(v, &seen).ServeHTTP(rec, request(tc.method, tc.path, tc.cookie))
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d (%s)", rec.Code, tc.status, rec.Body)
+			}
+			if tc.code != "" && !strings.Contains(rec.Body.String(), `"code":"`+tc.code+`"`) {
+				t.Errorf("body %s lacks code %s", rec.Body, tc.code)
+			}
+			if tc.code != "" && rec.Header().Get("Content-Type") != web.ProblemContentType {
+				t.Errorf("Content-Type = %q", rec.Header().Get("Content-Type"))
+			}
+			if got := seen == user; got != tc.principal {
+				t.Errorf("principal in context = %v, want %v", got, tc.principal)
+			}
+		})
+	}
+}
+
+func TestMiddlewareNoCookieSkipsStore(t *testing.T) {
+	v := &fakeValidator{}
+	chain(v, nil).ServeHTTP(httptest.NewRecorder(), request("GET", "/open", ""))
+	// An empty cookie value is the same as none.
+	req := httptest.NewRequest("GET", "/open", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: ""})
+	chain(v, nil).ServeHTTP(httptest.NewRecorder(), req)
+	if v.calls != 0 {
+		t.Errorf("store called %d times without a cookie value", v.calls)
+	}
+}
+
+func TestMiddlewareIgnoresOtherCookies(t *testing.T) {
+	v := &fakeValidator{live: map[string]security.Principal{"good": {Role: security.RoleUser}}}
+	req := httptest.NewRequest("GET", "/closed", nil)
+	req.AddCookie(&http.Cookie{Name: "session", Value: "good"})
+	rec := httptest.NewRecorder()
+	chain(v, nil).ServeHTTP(rec, req)
+	if rec.Code != 401 || v.calls != 0 {
+		t.Errorf("status %d, store calls %d", rec.Code, v.calls)
+	}
+}
+
+func TestMiddlewareStoreFailureIs500NotPublicFallthrough(t *testing.T) {
+	v := &fakeValidator{err: errors.New("db down")}
+	for _, path := range []string{"/open", "/closed", "/nope"} {
+		rec := httptest.NewRecorder()
+		chain(v, nil).ServeHTTP(rec, request("GET", path, "good"))
+		if rec.Code != 500 || !strings.Contains(rec.Body.String(), "INTERNAL_ERROR") {
+			t.Errorf("%s: status %d body %s", path, rec.Code, rec.Body)
+		}
+		if strings.Contains(rec.Body.String(), "db down") {
+			t.Errorf("%s: cause leaked: %s", path, rec.Body)
+		}
+	}
+}
+
+func TestMiddlewareNilPublicMeansAllProtected(t *testing.T) {
+	h := auth.Middleware(&fakeValidator{}, nil, slog.New(slog.DiscardHandler))(http.NotFoundHandler())
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, request("GET", "/open", ""))
+	if rec.Code != 401 {
+		t.Errorf("status = %d", rec.Code)
+	}
+}