@openparachute/hub 0.7.7-rc.6 → 0.7.7-rc.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.7-rc.6",
+  "version": "0.7.7-rc.8",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/account-api.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { checkAccountDescriptor, validateVaultScopes } from "@openparachute/door-contract";
 import {
   handleAccountCapabilities,
   handleAccountCreateVault,
@@ -12,7 +13,10 @@ import {
   handleAccountRoot,
   handleAccountSetVaultCaps,
 } from "../account-api.ts";
+import { handleCreateInvite } from "../api-invites.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { getSetting } from "../hub-settings.ts";
+import { findInviteByRawToken, recordInviteRedemption, revokeInvite } from "../invites.ts";
 import { signAccessToken, validateAccessToken } from "../jwt-sign.ts";
 import { upsertService } from "../services-manifest.ts";
 import { rotateSigningKey } from "../signing-keys.ts";
@@ -115,31 +119,251 @@ function jsonReq(path: string, token: string, method: string, body?: unknown): R
 // GET /.well-known/parachute-account — the capabilities descriptor
 // ===========================================================================
 describe("handleAccountCapabilities", () => {
-  test("descriptor is public and reports the self-host door honestly", async () => {
-    const res = handleAccountCapabilities(new Request(`${ISSUER}/.well-known/parachute-account`), {
-      issuer: `${ISSUER}/`,
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as Record<string, unknown>;
-    expect(body.door).toBe("self-host");
-    expect(body.issuer).toBe(ISSUER); // trailing slash trimmed
-    const features = body.features as Record<string, unknown>;
-    expect(features.billing).toBe(false); // no billing on self-host
-    expect(features.plans).toEqual([]);
-    expect(features.vault_create).toBe(true);
-    expect(features.vault_delete).toBe(true);
-    expect(features.modules).toBe(true);
-    expect(features.expose).toBe(true);
-    expect(body.caps_writable).toBe(true);
-    expect((body.limits as Record<string, unknown>).vaults_max).toBeNull();
+  test("descriptor is public, wildcard-CORS, and conforms to the shared door-contract canon", async () => {
+    const h = makeHarness();
+    try {
+      const res = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: `${ISSUER}/` },
+      );
+      expect(res.status).toBe(200);
+      expect(res.headers.get("access-control-allow-origin")).toBe("*");
+      expect(res.headers.get("access-control-allow-methods")).toBe("GET, OPTIONS");
+      const body = (await res.json()) as Record<string, unknown>;
+      // The shared conformance checker — empty issue list means the shape
+      // is byte-conformant with the canonical ParachuteAccountDescriptor.
+      expect(checkAccountDescriptor(body, { issuer: ISSUER, door: "hub" })).toEqual([]);
+      expect(body.issuer).toBe(ISSUER); // trailing slash trimmed
+      expect(body.door).toBe("hub");
+      expect(body.account_endpoint).toBe(`${ISSUER}/account`);
+      expect(body.auth).toEqual({ methods: ["password"], signin_path: "/login" });
+      expect(body.vault_url_template).toContain("{name}");
+      expect(body.vault_url_template).toBe(`${ISSUER}/vault/{name}`);
+      expect(body.capabilities).toEqual({
+        vault_create: true,
+        vault_rename: false,
+        vault_delete: true,
+      });
+      expect(body.plans).toEqual([]);
+      expect(body.signup_path).toBeUndefined(); // fresh hub, no active public invite
+      // Hub extras — additive, outside the shared contract (conformance
+      // walks expected keys only, so these ride along without breaking it).
+      const features = body.features as Record<string, unknown>;
+      expect(features.billing).toBe(false);
+      expect(features.modules).toBe(true);
+      expect(features.expose).toBe(true);
+      expect(features.import).toBe(true);
+      expect(features.export).toBe(true);
+      expect(body.caps_writable).toBe(true);
+    } finally {
+      h.cleanup();
+    }
   });
 
   test("405 on non-GET", () => {
-    const res = handleAccountCapabilities(
-      new Request(`${ISSUER}/.well-known/parachute-account`, { method: "POST" }),
-      { issuer: ISSUER },
-    );
-    expect(res.status).toBe(405);
+    const h = makeHarness();
+    try {
+      const res = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`, { method: "POST" }),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(res.status).toBe(405);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // Q2 — the conditional `signup_path`. Present only while an active
+  // multi-use (public-signup) invite exists; absent on a fresh hub and
+  // absent again once the invite is revoked / exhausted / expired (the
+  // setting is lazily cleared on the next read, invites.ts's
+  // activePublicSignupPath).
+  // -------------------------------------------------------------------------
+  test("signup_path appears after minting a max_uses:3 invite, disappears on revoke", async () => {
+    const h = makeHarness();
+    try {
+      const admin = await createUser(h.db, "operator", "any-password", {
+        allowMulti: true,
+        passwordChanged: true,
+      });
+      const adminToken = await bearer(h, [HOST_ADMIN_SCOPE], admin.id);
+      const mintRes = await handleCreateInvite(
+        jsonReq("/api/invites", adminToken, "POST", { max_uses: 3 }),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(mintRes.status).toBe(201);
+      const minted = (await mintRes.json()) as { token: string };
+
+      const afterMint = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER },
+      );
+      const afterMintBody = (await afterMint.json()) as Record<string, unknown>;
+      expect(afterMintBody.signup_path).toBe(`/account/setup/${minted.token}`);
+
+      const invite = findInviteByRawToken(h.db, minted.token);
+      expect(invite).not.toBeNull();
+      expect(revokeInvite(h.db, invite?.tokenHash ?? "")).toBe(true);
+
+      const afterRevoke = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(((await afterRevoke.json()) as Record<string, unknown>).signup_path).toBeUndefined();
+      expect(getSetting(h.db, "public_signup_token")).toBeUndefined(); // lazily cleared
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("signup_path disappears once the invite is exhausted (used_count == max_uses)", async () => {
+    const h = makeHarness();
+    try {
+      const admin = await createUser(h.db, "operator", "any-password", {
+        allowMulti: true,
+        passwordChanged: true,
+      });
+      const adminToken = await bearer(h, [HOST_ADMIN_SCOPE], admin.id);
+      const mintRes = await handleCreateInvite(
+        jsonReq("/api/invites", adminToken, "POST", { max_uses: 2 }),
+        { db: h.db, issuer: ISSUER },
+      );
+      const minted = (await mintRes.json()) as { token: string };
+      const invite = findInviteByRawToken(h.db, minted.token);
+      expect(invite).not.toBeNull();
+
+      // Redeem both seats directly (invites.ts core — the redeem HTTP flow
+      // itself is out of scope here). `redeemed_user_id` FKs to `users`, so
+      // reuse the admin row as the redeemer stand-in — the test only cares
+      // that TWO redemptions land, not who they belong to.
+      expect(recordInviteRedemption(h.db, invite?.tokenHash ?? "", admin.id)).toBe(true);
+      expect(recordInviteRedemption(h.db, invite?.tokenHash ?? "", admin.id)).toBe(true);
+
+      const res = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(((await res.json()) as Record<string, unknown>).signup_path).toBeUndefined();
+      expect(getSetting(h.db, "public_signup_token")).toBeUndefined();
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("signup_path disappears once the invite expires (injected clock)", async () => {
+    const h = makeHarness();
+    try {
+      const admin = await createUser(h.db, "operator", "any-password", {
+        allowMulti: true,
+        passwordChanged: true,
+      });
+      const adminToken = await bearer(h, [HOST_ADMIN_SCOPE], admin.id);
+      const mintTime = new Date("2026-01-01T00:00:00.000Z");
+      const mintRes = await handleCreateInvite(
+        jsonReq("/api/invites", adminToken, "POST", { max_uses: 5, expires_in: 60 }),
+        { db: h.db, issuer: ISSUER, now: () => mintTime },
+      );
+      expect(mintRes.status).toBe(201);
+
+      const stillLive = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER, now: () => new Date(mintTime.getTime() + 30_000) },
+      );
+      expect(((await stillLive.json()) as Record<string, unknown>).signup_path).toBeDefined();
+
+      const afterExpiry = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER, now: () => new Date(mintTime.getTime() + 120_000) },
+      );
+      expect(((await afterExpiry.json()) as Record<string, unknown>).signup_path).toBeUndefined();
+      expect(getSetting(h.db, "public_signup_token")).toBeUndefined();
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("signup_path is NOT set for a multi-use NON-provisioning invite (B1: a team link must never leak on the public descriptor)", async () => {
+    const h = makeHarness();
+    try {
+      const admin = await createUser(h.db, "operator", "any-password", {
+        allowMulti: true,
+        passwordChanged: true,
+      });
+      const adminToken = await bearer(h, [HOST_ADMIN_SCOPE], admin.id);
+      // A multi-use link with provision_vault=false is a team invite (here
+      // account-only; a shared-vault one additionally pins an existing
+      // vault_name and would hand out team-vault WRITE) — NOT a public signup
+      // that gives each redeemer their own fresh vault. It must never be
+      // persisted to public_signup_token nor advertised via the anonymous,
+      // wildcard-CORS descriptor. Same `provisionVault` guard covers both the
+      // account-only and shared-vault non-provisioning shapes.
+      const mintRes = await handleCreateInvite(
+        jsonReq("/api/invites", adminToken, "POST", { max_uses: 3, provision_vault: false }),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(mintRes.status).toBe(201);
+      // The raw token was NOT persisted (the write-side guard)...
+      expect(getSetting(h.db, "public_signup_token")).toBeUndefined();
+      // ...and the public descriptor advertises no signup_path.
+      const desc = handleAccountCapabilities(
+        new Request(`${ISSUER}/.well-known/parachute-account`),
+        { db: h.db, issuer: ISSUER },
+      );
+      expect(((await desc.json()) as Record<string, unknown>).signup_path).toBeUndefined();
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+// ===========================================================================
+// The shared door-contract validateVaultScopes — behavioral no-op proof
+// (hub-parity P2, item 5). These are the SAME fixtures the hub's prior local
+// `parseScopesBody` scope-shape logic was exercised against (see the
+// `handleAccountMintVaultToken` describe block below for the HTTP-level
+// equivalents); asserting them directly against the shared validator proves
+// the swap didn't change hub's wire behavior.
+// ===========================================================================
+describe("validateVaultScopes (shared door-contract validator) — hub's prior fixtures", () => {
+  test("undefined / null / [] all default to read+write for the named vault", () => {
+    for (const requested of [undefined, null, []]) {
+      expect(validateVaultScopes(requested, "field-notes")).toEqual({
+        ok: true,
+        scopes: ["vault:field-notes:read", "vault:field-notes:write"],
+      });
+    }
+  });
+
+  test("an explicit single-scope array is honored verbatim", () => {
+    expect(validateVaultScopes(["vault:field-notes:read"], "field-notes")).toEqual({
+      ok: true,
+      scopes: ["vault:field-notes:read"],
+    });
+  });
+
+  test("a scope naming another vault is invalid_scope", () => {
+    expect(validateVaultScopes(["vault:other:read"], "field-notes")).toEqual({
+      ok: false,
+      reason: "invalid_scope",
+    });
+  });
+
+  test("a non-array requested value is invalid_request", () => {
+    expect(validateVaultScopes("not-an-array", "field-notes")).toEqual({
+      ok: false,
+      reason: "invalid_request",
+    });
+  });
+
+  test("a mixed array with a non-string entry is invalid_request, even when a valid scope leads", () => {
+    // The whole-array pre-scan (byte-exact with hub's prior parseScopesBody):
+    // a non-string entry anywhere rejects the WHOLE request as
+    // invalid_request, never a positional invalid_scope.
+    expect(validateVaultScopes(["vault:field-notes:read", 123], "field-notes")).toEqual({
+      ok: false,
+      reason: "invalid_request",
+    });
   });
 });
 
@@ -327,6 +551,26 @@ describe("handleAccountCreateVault", () => {
       h.cleanup();
     }
   });
+
+  // Q6 (hub-parity P2): create-existing-name converges on 409 vault_taken —
+  // this facade no longer answers 200-idempotent. `provisionVault` itself
+  // stays idempotent (the invite-redeem caller doesn't route through here).
+  test("409 vault_taken on an existing vault name (Q6 — no longer 200-idempotent)", async () => {
+    const h = makeHarness(["beta", "personal"]);
+    try {
+      const token = await bearer(h, [ACCOUNT_ADMIN_SCOPE]);
+      const res = await handleAccountCreateVault(
+        jsonReq("/account/vaults", token, "POST", { name: "beta" }),
+        deps(h),
+      );
+      expect(res.status).toBe(409);
+      const body = (await res.json()) as { error: string; message: string };
+      expect(body.error).toBe("vault_taken");
+      expect(body.message).toBe("That vault name is already taken.");
+    } finally {
+      h.cleanup();
+    }
+  });
 });
 
 // ===========================================================================
@@ -489,7 +733,7 @@ describe("account caps", () => {
 // GET /account — bootstrap
 // ===========================================================================
 describe("handleAccountRoot", () => {
-  test("returns account_id=self, door=self-host, and the operator email", async () => {
+  test("returns the contract's AccountBootstrap — {id:self, door:hub, email}", async () => {
     const h = makeHarness();
     try {
       const user = await createUser(h.db, "operator", "any-password", {
@@ -500,10 +744,26 @@ describe("handleAccountRoot", () => {
       const token = await bearer(h, [ACCOUNT_READ_SCOPE], user.id);
       const res = await handleAccountRoot(withBearer("/account", token), deps(h));
       expect(res.status).toBe(200);
-      const body = (await res.json()) as { account_id: string; email: string | null; door: string };
-      expect(body.account_id).toBe("self");
-      expect(body.door).toBe("self-host");
-      expect(body.email).toBe("op@example.com");
+      const body = (await res.json()) as { id: string; email?: string; door: string };
+      expect(body).toEqual({ id: "self", door: "hub", email: "op@example.com" });
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("omits email when the operator row has none", async () => {
+    const h = makeHarness();
+    try {
+      const user = await createUser(h.db, "operator", "any-password", {
+        allowMulti: true,
+        passwordChanged: true,
+      });
+      const token = await bearer(h, [ACCOUNT_READ_SCOPE], user.id);
+      const res = await handleAccountRoot(withBearer("/account", token), deps(h));
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { id: string; email?: string; door: string };
+      expect(body).toEqual({ id: "self", door: "hub" });
+      expect(body.email).toBeUndefined();
     } finally {
       h.cleanup();
     }

package/src/__tests__/account-session.test.ts

@@ -0,0 +1,244 @@
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkAccountSessionResponse } from "@openparachute/door-contract";
+import { handleAccountSession } from "../account-session.ts";
+import { CSRF_COOKIE_NAME, buildCsrfCookie, generateCsrfToken, parseCsrfCookie } from "../csrf.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import {
+  SESSION_COOKIE_NAME,
+  SESSION_SLIDE_THRESHOLD_MS,
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  findSession,
+} from "../sessions.ts";
+import { createUser } from "../users.ts";
+
+/**
+ * Tests for `GET /account/session` — the same-origin boot oracle (hub-parity
+ * P1, the twin of cloud's `account-session.ts`). Covers:
+ *   - both branches' body shape (signed-out / signed-in).
+ *   - CSRF minted when absent, reused (no re-Set-Cookie) when present — on
+ *     BOTH branches (the G2 anonymous-CSRF invariant).
+ *   - a deleted-user session row falls back to signed-out.
+ *   - the bounded slide: an old-but-live session rolls + re-issues the
+ *     cookie; a fresh session does neither.
+ *   - 405 on non-GET, `cache-control: no-store`, no CORS headers.
+ *   - drift: `checkAccountSessionResponse` reports zero issues against the
+ *     live handler on both branches.
+ */
+const ISSUER = "https://hub.test";
+
+interface Harness {
+  db: Database;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-account-session-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+function getReq(cookie?: string, method = "GET"): Request {
+  return new Request(`${ISSUER}/account/session`, {
+    method,
+    ...(cookie ? { headers: { cookie } } : {}),
+  });
+}
+
+function sessionCookiePair(sid: string): string {
+  return buildSessionCookie(sid, Math.floor(SESSION_TTL_MS / 1000));
+}
+
+describe("handleAccountSession — signed-out branch", () => {
+  test("no cookie at all → {signed_in:false, csrf} + CSRF Set-Cookie minted", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean; csrf: string };
+    expect(body.signed_in).toBe(false);
+    expect(typeof body.csrf).toBe("string");
+    expect(body.csrf.length).toBeGreaterThan(0);
+
+    const setCookie = res.headers.getSetCookie();
+    const csrfSet = setCookie.find((c) => c.includes(CSRF_COOKIE_NAME));
+    expect(csrfSet).toBeDefined();
+    expect(parseCsrfCookie(csrfSet ?? null)).toBe(body.csrf);
+  });
+
+  test("reuses an existing CSRF cookie without re-minting (no Set-Cookie)", async () => {
+    const existing = generateCsrfToken();
+    const cookie = buildCsrfCookie(existing).split(";")[0] ?? "";
+    const res = handleAccountSession(getReq(cookie), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean; csrf: string };
+    expect(body.signed_in).toBe(false);
+    expect(body.csrf).toBe(existing);
+    expect(res.headers.get("set-cookie")).toBeNull();
+  });
+
+  test("a session cookie naming a deleted user → signed-out", async () => {
+    // The on-disk FK normally guards against a session outliving its user, so
+    // forge the orphaned row directly with `PRAGMA foreign_keys=OFF` (the
+    // `api-account.test.ts` precedent) — simulating a delete-user-via-SQL-shell
+    // race, not something reachable through the app's own APIs.
+    const sessionId = "test-orphaned-session-id-base64url";
+    harness.db.exec("PRAGMA foreign_keys = OFF");
+    try {
+      harness.db
+        .prepare("INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
+        .run(
+          sessionId,
+          "nonexistent-user-uuid",
+          new Date(Date.now() + SESSION_TTL_MS).toISOString(),
+          new Date().toISOString(),
+        );
+    } finally {
+      harness.db.exec("PRAGMA foreign_keys = ON");
+    }
+    const cookie = sessionCookiePair(sessionId);
+    const res = handleAccountSession(getReq(cookie), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean };
+    expect(body.signed_in).toBe(false);
+  });
+
+  test("drift: checkAccountSessionResponse reports zero issues (signed-out)", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(checkAccountSessionResponse(body, { signedIn: false })).toEqual([]);
+  });
+});
+
+describe("handleAccountSession — signed-in branch", () => {
+  test("username always present; no email when the user row has none", async () => {
+    const user = await createUser(harness.db, "operator", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.signed_in).toBe(true);
+    expect(body.username).toBe("operator");
+    expect(body.email).toBeUndefined();
+    expect(body.account_created_at).toBe(user.createdAt);
+    expect(body.password_change_required).toBeUndefined();
+  });
+
+  test("email present when the user row has one", async () => {
+    const user = await createUser(harness.db, "withmail", "pw", {
+      passwordChanged: true,
+      email: "friend@example.com",
+    });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.email).toBe("friend@example.com");
+    expect(body.username).toBe("withmail");
+  });
+
+  test("password_change_required:true for a not-yet-rotated (passwordChanged:false) user", async () => {
+    // createUser defaults passwordChanged to false — the admin-created-user
+    // posture (force-redirect on first sign-in).
+    const user = await createUser(harness.db, "temp", "pw");
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.signed_in).toBe(true);
+    expect(body.password_change_required).toBe(true);
+  });
+
+  test("mints CSRF when absent even on the signed-in branch", async () => {
+    const user = await createUser(harness.db, "operator2", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as { csrf: string };
+    expect(typeof body.csrf).toBe("string");
+    expect(body.csrf.length).toBeGreaterThan(0);
+    const setCookie = res.headers.getSetCookie();
+    expect(setCookie.some((c) => c.includes(CSRF_COOKIE_NAME))).toBe(true);
+  });
+
+  test("drift: checkAccountSessionResponse reports zero issues (signed-in)", async () => {
+    const user = await createUser(harness.db, "driftcheck", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(checkAccountSessionResponse(body, { signedIn: true })).toEqual([]);
+  });
+});
+
+describe("handleAccountSession — bounded slide", () => {
+  test("an old-but-live session (within the slide threshold of expiry) rolls + re-issues the cookie", async () => {
+    const user = await createUser(harness.db, "slider", "pw", { passwordChanged: true });
+    const t0 = new Date();
+    // Created far enough in the past that remaining life < TTL - threshold.
+    const createdAt = new Date(
+      t0.getTime() - (SESSION_TTL_MS - SESSION_SLIDE_THRESHOLD_MS + 60_000),
+    );
+    const session = createSession(harness.db, { userId: user.id, now: () => createdAt });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.getSetCookie();
+    const sessionSet = setCookie.find((c) => c.includes(SESSION_COOKIE_NAME));
+    expect(sessionSet).toBeDefined();
+    expect(sessionSet).toContain("HttpOnly");
+    expect(sessionSet).toContain("SameSite=Lax");
+
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+
+  test("a fresh session does NOT slide — no session Set-Cookie, no DB write", async () => {
+    const user = await createUser(harness.db, "fresh", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const originalExpiry = session.expiresAt;
+
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.getSetCookie();
+    expect(setCookie.some((c) => c.includes(SESSION_COOKIE_NAME))).toBe(false);
+
+    const found = findSession(harness.db, session.id);
+    expect(found?.expiresAt).toBe(originalExpiry);
+  });
+});
+
+describe("handleAccountSession — method + headers", () => {
+  test("405 on POST", async () => {
+    const res = handleAccountSession(getReq(undefined, "POST"), { db: harness.db });
+    expect(res.status).toBe(405);
+    expect(res.headers.get("allow")).toBe("GET");
+  });
+
+  test("cache-control: no-store on the 200 path", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    expect(res.headers.get("cache-control")).toBe("no-store");
+  });
+
+  test("no access-control-allow-origin (same-origin only, no CORS)", async () => {
+    const req = new Request(`${ISSUER}/account/session`, {
+      headers: { origin: "https://evil.example" },
+    });
+    const res = handleAccountSession(req, { db: harness.db });
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});

package/src/__tests__/admin-handlers.test.ts

@@ -603,4 +603,29 @@ describe("handleAdminLogoutPost (#113)", () => {
     expect(res.headers.get("location")).toBe("/login");
     expect(res.headers.get("set-cookie") ?? "").toContain("parachute_hub_session=;");
   });
+
+  // App-wire pin (hub-parity P1, §8-M4): the app's `logout()` posts form-
+  // encoded, not JSON (`parachute-app/src/lib/account/client.ts:246-258`:
+  // `content-type: application/x-www-form-urlencoded`, body
+  // `new URLSearchParams({ __csrf: csrf }).toString()`, credentials included).
+  // No hub code changed for this — the existing formData()-based handler
+  // already accepts exactly this shape; this test freezes the byte-shape so a
+  // future refactor of the handler can't silently drop form-body support out
+  // from under the app.
+  test("app-wire pin — form-encoded body matching client.ts's exact logout() shape", async () => {
+    const cookie = await cookieForUser(harness.db, "appuser", "pw");
+    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
+    const req = new Request("http://hub.test/logout", {
+      method: "POST",
+      headers: {
+        cookie,
+        "content-type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams({ [CSRF_FIELD_NAME]: TEST_CSRF }).toString(),
+    });
+    const res = await handleAdminLogoutPost(harness.db, req);
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toBe("/login");
+    expect(findSession(harness.db, sid)).toBeNull();
+  });
 });