@openparachute/hub 0.7.4-rc.8 → 0.7.4

package/src/__tests__/oauth-handlers.test.ts

@@ -119,7 +119,9 @@ describe("authorizationServerMetadata", () => {
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
     expect(scopesSupported).toContain("scribe:transcribe"); // scribe is in the fixture manifest
-    expect(scopesSupported).toContain("hub:admin");
+    // hub:admin + scribe:admin are operator-only (non-requestable) — never advertised (2026-06-30)
+    expect(scopesSupported).not.toContain("hub:admin");
+    expect(scopesSupported).not.toContain("scribe:admin");
     // agent isn't in the fixture manifest → its scopes aren't advertised
     // (hub#…: optional-module scopes only surface when the module is installed).
     expect(scopesSupported).not.toContain("agent:send");
@@ -169,9 +171,10 @@ describe("authorizationServerMetadata", () => {
     // First-party still advertised — no regression
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
-    expect(scopesSupported).toContain("hub:admin");
-    // NON_REQUESTABLE filter still applies even when the scope is declared
+    // NON_REQUESTABLE filter applies even when the scope is declared:
+    // host-* AND the service-admin scopes (hub:admin/scribe:admin) are filtered.
     expect(scopesSupported).not.toContain("parachute:host:admin");
+    expect(scopesSupported).not.toContain("hub:admin");
   });
 
   test("advertises an optional module's scopes only when it's installed", async () => {
@@ -209,7 +212,8 @@ describe("authorizationServerMetadata", () => {
     // core scopes survive
     expect(scopes).toContain("vault:read");
     expect(scopes).toContain("vault:admin");
-    expect(scopes).toContain("hub:admin");
+    // hub:admin is operator-only (non-requestable) — never advertised
+    expect(scopes).not.toContain("hub:admin");
     // uninstalled optional-module scopes are dropped
     expect(scopes).not.toContain("scribe:transcribe");
     expect(scopes).not.toContain("scribe:admin");
@@ -241,6 +245,10 @@ describe("authorizationServerMetadata", () => {
     });
     const scopes2 = ((await res2.json()) as Record<string, unknown>).scopes_supported as string[];
     expect(scopes2).toContain("scribe:transcribe");
+    // scribe:admin stays dropped EVEN WITH scribe installed — proving it's the
+    // requestability gate (non-requestable, 2026-06-30) doing the work here, not
+    // the optional-module-not-installed gate that drops scribe:transcribe above.
+    expect(scopes2).not.toContain("scribe:admin");
     expect(scopes2).not.toContain("agent:send"); // agent still not installed
   });
 });
@@ -353,6 +361,88 @@ describe("handleAuthorizeGet", () => {
     }
   });
 
+  // hub#314 — same-hub vs external trust marker reaches the rendered consent
+  // screen via `client.sameHub`. An unnamed `vault:read` request from a
+  // same-hub client falls through to consent (the auto-approve gate requires
+  // `!hasUnnamedVault`), so we can assert the marker on the GET render.
+  test("renders the EXTERNAL trust marker for a third-party DCR client", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      // registerClient defaults sameHub:false → external (third-party DCR).
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        clientName: "ThirdPartyApp",
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          scope: "vault:read",
+        }),
+        {
+          headers: {
+            cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000))}`,
+          },
+        },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      // Element form — the `.badge-trust-*` CSS class names are always in the
+      // inlined <style>; the rendered ELEMENT only appears when the marker fires.
+      expect(html).toContain('class="badge badge-trust-external"');
+      expect(html).toContain("third-party app that registered itself");
+      expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("renders the FIRST-PARTY trust marker for a same-hub client", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        clientName: "FirstPartyApp",
+        sameHub: true,
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          // Unnamed vault verb → bypasses the same-hub auto-approve gate
+          // (`!hasUnnamedVault`) and falls through to the consent render.
+          scope: "vault:read",
+        }),
+        {
+          headers: {
+            cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000))}`,
+          },
+        },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).toContain('class="badge badge-trust-same-hub"');
+      expect(html).toContain("Registered through this hub");
+      expect(html).not.toContain('class="badge badge-trust-external"');
+    } finally {
+      cleanup();
+    }
+  });
+
   test("rejects unknown client_id with 400", async () => {
     const { db, cleanup } = await makeDb();
     try {
@@ -2914,6 +3004,75 @@ describe("handleToken — full OAuth dance", () => {
         notes: { url: `${ISSUER}/notes`, version: "0.3.0" },
       });
     });
+
+    // closes #478 — an empty-paths vault row ("installed but no servable
+    // instance"; vault's self-register emits `paths: []` at zero vaults) must
+    // NOT synthesize a phantom `vault` / `vault:default` entry pointing at
+    // root in the /oauth/token services catalog. Pre-fix the `["/"]` fallback
+    // resolved `vaultInstanceNameFor(name, "/")` → "default" and advertised
+    // `${ISSUER}/` as the vault. Mirrors the skip in well-known.ts /
+    // admin-vaults.ts / vault-names.ts.
+    test("empty-paths vault row produces NO catalog entry — no phantom default (#478)", () => {
+      const emptyPathsManifest: ServicesManifest = {
+        services: [
+          {
+            name: "parachute-vault",
+            port: 1940,
+            paths: [],
+            health: "/vault/default/health",
+            version: "0.7.0",
+          },
+        ],
+      };
+      // Broad scope: would have leaked `vault` + `vault:default` at `/`.
+      expect(buildServicesCatalog(emptyPathsManifest, ISSUER, ["vault:read"])).toEqual({});
+      // Per-vault-narrowed scope for the phantom name: also nothing.
+      expect(buildServicesCatalog(emptyPathsManifest, ISSUER, ["vault:default:read"])).toEqual({});
+    });
+
+    test("positive control: a vault row WITH a path is still cataloged (#478)", () => {
+      const realManifest: ServicesManifest = {
+        services: [
+          {
+            name: "parachute-vault",
+            port: 1940,
+            paths: ["/vault/default"],
+            health: "/vault/default/health",
+            version: "0.7.0",
+          },
+        ],
+      };
+      expect(buildServicesCatalog(realManifest, ISSUER, ["vault:read"])).toEqual({
+        vault: { url: `${ISSUER}/vault/default`, version: "0.7.0" },
+      });
+    });
+
+    test("empty-paths vault row alongside a real vault: only the real one is cataloged (#478)", () => {
+      // A transitional manifest could carry both a path-less bare row and a
+      // real instance row. The empty-paths row must contribute nothing; the
+      // real vault is unaffected.
+      const mixedManifest: ServicesManifest = {
+        services: [
+          {
+            name: "parachute-vault",
+            port: 1940,
+            paths: [],
+            health: "/vault/default/health",
+            version: "0.7.0",
+          },
+          {
+            name: "parachute-vault-work",
+            port: 1941,
+            paths: ["/vault/work"],
+            health: "/vault/work/health",
+            version: "0.7.0",
+          },
+        ],
+      };
+      expect(buildServicesCatalog(mixedManifest, ISSUER, ["vault:read"])).toEqual({
+        vault: { url: `${ISSUER}/vault/work`, version: "0.7.0" },
+      });
+    });
   });
 });
 
@@ -7215,12 +7374,12 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
     }
   });
 
-  test("authorize: same_hub=true + admin scope → consent screen (high-power sanity gate)", async () => {
-    // hub:admin is requestable via DCR (only `parachute:host:admin` and
-    // per-vault `vault:*:admin` are non-requestable). For same-hub
-    // clients we DO still show consent on admin scopes — the operator
-    // who registered the client may not want to grant their own session
-    // hub-wide admin access without an explicit click.
+  test("authorize: same_hub=true + hub:admin → invalid_scope (operator-only, even for same-hub) (2026-06-30)", async () => {
+    // hub:admin is now non-requestable via /oauth/authorize (a vault MCP
+    // connector pointed at the hub-level AS would otherwise be offered
+    // hub-wide admin). Even a trusted same-hub client with an owner session
+    // is rejected with invalid_scope — fails closed before consent. The
+    // legit hub-admin paths are operator-bearer/session, not authorize-flow.
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7239,24 +7398,24 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      // Consent rendered, not silent-approve.
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
-      const html = await res.text();
-      expect(html).toContain("hub:admin");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
     } finally {
       cleanup();
     }
   });
 
-  test("authorize: same_hub=true + mixed admin+non-admin → consent screen (any admin scope shows consent)", async () => {
-    // Defensive: a request asking for `vault:default:read hub:admin` must
-    // NOT silent-approve on the strength of the non-admin scope. Any
-    // admin scope present forces consent.
+  test("authorize: same_hub=true + mixed vault + hub:admin → invalid_scope (a non-requestable scope rejects the whole request) (2026-06-30)", async () => {
+    // A request mixing a requestable scope with hub:admin must NOT slip the
+    // non-requestable scope through on the strength of the others — the whole
+    // request is rejected with invalid_scope (same as parachute:host:admin).
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7275,12 +7434,52 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "vault:default:read hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("authorize: explicit scribe:admin → invalid_scope (service-admin, operator-only) (2026-06-30)", async () => {
+    // Symmetry with hub:admin: the other service-admin scope is non-requestable
+    // too. Scribe's admin UI gets scribe:admin via the cookie-gated
+    // /admin/module-token/scribe path, never /oauth/authorize — so rejecting it
+    // here breaks no first-party path.
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+        sameHub: true,
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          scope: "scribe:admin",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          state: "abc",
+        }),
+        { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("scribe:admin");
     } finally {
       cleanup();
     }
@@ -10073,6 +10272,62 @@ describe("hub#689 — owner-on-own-vault verb selector + widening", () => {
     }
   });
 
+  // GET render (hub#703, folded into hub#314): a user with MIXED authority —
+  // admin on vault A (role=write → holds admin) but only read on vault B
+  // (direct INSERT role=read) — does NOT see the selector. The user could pick
+  // either vault, but doesn't own (hold admin on) EVERY pickable vault, so the
+  // `userHoldsAdminOnPickable` predicate (`assignedVaults.every(v => verbs
+  // includes "admin")`) fails on vault B and the selector is suppressed. The
+  // suppression logic already ships + is correct (oauth-handlers.ts ~2963 +
+  // ~1226); this test closes the coverage gap with no code change.
+  test("selector NOT rendered for a mixed-authority user (admin on A, read-only on B)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw");
+      const mixed = await createUser(db, "mixed", "pw", { allowMulti: true });
+      // Vault A ("work"): role=write → vaultVerbsForRole maps to [read,write,
+      // admin], so the user holds admin on A. (setUserVaults hardcodes write.)
+      setUserVaults(db, mixed.id, ["work"]);
+      // Vault B ("other"): direct INSERT role=read → holds read only, NOT admin.
+      // setUserVaults DELETEs first, so this INSERT must come after it to keep A.
+      db.prepare(
+        "INSERT INTO user_vaults (user_id, vault_name, role, created_at) VALUES (?, ?, 'read', ?)",
+      ).run(mixed.id, "other", new Date().toISOString());
+      const session = createSession(db, { userId: mixed.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = handleAuthorizeGet(
+        db,
+        new Request(
+          authorizeUrl({
+            client_id: reg.client.clientId,
+            redirect_uri: "https://app.example/cb",
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            scope: "vault:read",
+          }),
+          { headers: { cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, TTL_S)}` } },
+        ),
+        selDeps,
+      );
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      // Suppressed: the `.every(v => verbs includes "admin")` check fails on B.
+      expect(html).not.toContain("Access level");
+      expect(html).not.toContain('name="verb_select"');
+      // Sanity: the multi-vault picker DID render (two assigned vaults), so the
+      // suppression is specifically the verb selector, not the whole flow.
+      expect(html).toContain('name="vault_pick" value="work"');
+      expect(html).toContain('name="vault_pick" value="other"');
+    } finally {
+      cleanup();
+    }
+  });
+
   // GET render: a non-owner (non-admin with ZERO assigned vaults) does NOT
   // see the selector — they can't authorize a vault scope at all.
   test("selector NOT rendered for a non-owner (zero-vault non-admin)", async () => {

package/src/__tests__/oauth-ui.test.ts

@@ -306,6 +306,58 @@ describe("renderConsent", () => {
     expect(html).not.toContain("Access level");
     expect(html).not.toContain('name="verb_select"');
   });
+
+  // hub#314 — same-hub vs external trust marker. The `.badge-trust-*` class
+  // names are always present in the inlined <style> block, so assertions target
+  // the RENDERED ELEMENT form (`class="badge badge-trust-*"`) + the copy text,
+  // which only appear in the consent body when the marker actually renders.
+  test("renders the first-party trust marker for a same-hub client", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      sameHub: true,
+    });
+    expect(html).toContain('class="badge badge-trust-same-hub"');
+    expect(html).toContain(">First-party<");
+    expect(html).toContain("Registered through this hub");
+    // The external badge / copy must NOT appear for a same-hub client.
+    expect(html).not.toContain('class="badge badge-trust-external"');
+    expect(html).not.toContain("third-party app that registered itself");
+  });
+
+  test("renders the external trust marker for a third-party DCR client", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      sameHub: false,
+    });
+    expect(html).toContain('class="badge badge-trust-external"');
+    expect(html).toContain(">External<");
+    expect(html).toContain("third-party app that registered itself");
+    // The first-party badge / copy must NOT appear for an external client.
+    expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    expect(html).not.toContain("Registered through this hub");
+  });
+
+  test("renders no trust marker when provenance is unknown (sameHub omitted)", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      // sameHub omitted → undefined → no badge
+    });
+    expect(html).not.toContain('class="trust-marker');
+    expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    expect(html).not.toContain('class="badge badge-trust-external"');
+  });
 });
 
 describe("renderError", () => {

package/src/__tests__/scope-explanations.test.ts

@@ -129,11 +129,15 @@ describe("NON_REQUESTABLE_SCOPES (#96)", () => {
     expect(NON_REQUESTABLE_SCOPES.has("parachute:host:admin")).toBe(true);
   });
 
-  test("does NOT contain hub:admin (intentional asymmetry)", () => {
-    // hub:admin is service management an operator may legitimately delegate
-    // to a tooling app. parachute:host:admin is cross-vault data sovereignty
-    // and stays operator-only-mintable.
-    expect(NON_REQUESTABLE_SCOPES.has("hub:admin")).toBe(false);
+  test("contains the service-admin scopes hub:admin and scribe:admin (2026-06-30 over-permissioning fix)", () => {
+    // A vault MCP connector (e.g. Claude) is pointed at the hub-level AS by the
+    // vault's protected-resource metadata, so hub:admin/scribe:admin would be
+    // advertised on its consent screen + minted if approved — wildly
+    // over-privileged for a vault reader. Every legit use is operator-bearer /
+    // session (operator token, DCR self-registration, admin SPA), never
+    // /oauth/authorize — so these fail closed without breaking operator paths.
+    expect(NON_REQUESTABLE_SCOPES.has("hub:admin")).toBe(true);
+    expect(NON_REQUESTABLE_SCOPES.has("scribe:admin")).toBe(true);
   });
 
   test("every non-requestable scope is a known first-party scope", () => {
@@ -148,11 +152,16 @@ describe("isRequestableScope", () => {
     expect(isRequestableScope("parachute:host:admin")).toBe(false);
   });
 
-  test("true for hub:admin and other first-party scopes", () => {
-    expect(isRequestableScope("hub:admin")).toBe(true);
+  test("false for service-admin scopes hub:admin and scribe:admin (operator-only, 2026-06-30)", () => {
+    expect(isRequestableScope("hub:admin")).toBe(false);
+    expect(isRequestableScope("scribe:admin")).toBe(false);
+  });
+
+  test("true for non-admin first-party scopes", () => {
     expect(isRequestableScope("vault:read")).toBe(true);
     expect(isRequestableScope("vault:admin")).toBe(true);
     expect(isRequestableScope("agent:send")).toBe(true);
+    expect(isRequestableScope("scribe:transcribe")).toBe(true);
   });
 
   test("true for unknown scopes (third-party module scopes pass through)", () => {
@@ -194,8 +203,10 @@ describe("isRequestableScope", () => {
     expect(isNonRequestableScope("parachute:Host:Install")).toBe(true);
     // Canonical lowercase still works unchanged.
     expect(isNonRequestableScope("parachute:host:auth")).toBe(true);
-    // A non-host scope (even uppercased) stays requestable.
-    expect(isNonRequestableScope("HUB:ADMIN")).toBe(false);
+    // Service-admin scopes are non-requestable too, case-insensitively (2026-06-30).
+    expect(isNonRequestableScope("HUB:ADMIN")).toBe(true);
+    // A genuinely requestable scope (even uppercased) stays requestable.
+    expect(isNonRequestableScope("VAULT:READ")).toBe(false);
   });
 });
 

package/src/__tests__/sessions.test.ts

@@ -5,12 +5,14 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   SESSION_COOKIE_NAME,
+  SESSION_MAX_LIFETIME_MS,
   buildSessionClearCookie,
   buildSessionCookie,
   createSession,
   deleteSession,
   findSession,
   parseSessionCookie,
+  touchSession,
 } from "../sessions.ts";
 import { createUser } from "../users.ts";
 
@@ -67,6 +69,84 @@ describe("createSession + findSession", () => {
   });
 });
 
+describe("touchSession (sliding renewal)", () => {
+  const HOUR = 3600 * 1000;
+  const DAY = 24 * HOUR;
+
+  test("slides expires_at forward to now + TTL", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Original expiry: t0 + 24h.
+      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + DAY);
+      // Touch 1h later → expiry becomes (t0 + 1h) + 24h.
+      const t1 = new Date(t0.getTime() + HOUR);
+      touchSession(db, s.id, () => t1);
+      const found = findSession(db, s.id, () => t1);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + DAY);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a touched session outlives the ORIGINAL 24h expiry", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Activity at +12h slides expiry to +36h.
+      touchSession(db, s.id, () => new Date(t0.getTime() + 12 * HOUR));
+      // At +30h — PAST the original +24h — the session is still alive.
+      const at30h = new Date(t0.getTime() + 30 * HOUR);
+      expect(findSession(db, s.id, () => at30h)?.id).toBe(s.id);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("an UNtouched session still expires at the original 24h", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // No touch — at +25h it's gone (today's absolute-TTL behavior preserved
+      // for idle / closed tabs that stop re-minting).
+      const at25h = new Date(t0.getTime() + 25 * HOUR);
+      expect(findSession(db, s.id, () => at25h)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("caps at created_at + SESSION_MAX_LIFETIME_MS (sliding can't run forever)", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      const ceiling = t0.getTime() + SESSION_MAX_LIFETIME_MS;
+      // A touch near the ceiling would slide to now + 24h, but the cap pins it.
+      const nearCeiling = new Date(ceiling - HOUR); // raw slide would be ceiling + 23h
+      touchSession(db, s.id, () => nearCeiling);
+      const found = findSession(db, s.id, () => nearCeiling);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(ceiling);
+      // Past the ceiling the session is dead even though it was just "active".
+      expect(findSession(db, s.id, () => new Date(ceiling + 1000))).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("no-op on an unknown session id (does not throw)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      expect(() => touchSession(db, "no-such-session")).not.toThrow();
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("deleteSession", () => {
   test("removes the session row", async () => {
     const { db, userId, cleanup } = await makeDb();