@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/test/auth-routes.test.ts

@@ -16,7 +16,6 @@ import { configureJwt, generateAccessToken, hashRefreshToken } from "../src/auth
 // ── Mocks ───────────────────────────────────────────────────────────────────
 
 jest.mock("../src/auth/password");
-jest.mock("../src/auth/google-oauth");
 
 // Bypass rate limiters — they share state across tests and cause 429s
 jest.mock("../src/auth/rate-limiter", () => {
@@ -24,12 +23,12 @@ jest.mock("../src/auth/rate-limiter", () => {
     return {
         createRateLimiter: () => passthrough,
         defaultAuthLimiter: passthrough,
-        strictAuthLimiter: passthrough,
+        strictAuthLimiter: passthrough
     };
 });
 
 import { hashPassword, verifyPassword, validatePasswordStrength } from "../src/auth/password";
-import { verifyGoogleIdToken, isGoogleOAuthConfigured } from "../src/auth/google-oauth";
+import { z } from "zod";
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -42,36 +41,43 @@ function mockUser(overrides: Partial<{ id: string; email: string; passwordHash:
         passwordHash: "passwordHash" in overrides ? overrides.passwordHash : "salt:hash",
         displayName: overrides.displayName ?? "Test User",
         photoUrl: overrides.photoUrl ?? null,
-        provider: overrides.provider ?? "email",
-        googleId: null,
         emailVerified: overrides.emailVerified ?? false,
         emailVerificationToken: overrides.emailVerificationToken ?? null,
         emailVerificationSentAt: null,
         createdAt: new Date(),
-        updatedAt: new Date(),
+        updatedAt: new Date()
     };
 }
 
 function mockRole(id: string, isAdmin = false) {
-    return { id, name: id.charAt(0).toUpperCase() + id.slice(1), isAdmin, defaultPermissions: null, collectionPermissions: null, config: null };
+    return { id,
+name: id.charAt(0).toUpperCase() + id.slice(1),
+isAdmin,
+defaultPermissions: null,
+collectionPermissions: null,
+config: null };
 }
 
 let mockAuthRepo: jest.Mocked<AuthRepository>;
 let mockEmailService: { send: jest.Mock; isConfigured: jest.Mock };
 
-function createApp(opts: { allowRegistration?: boolean; withEmail?: boolean; defaultRole?: string } = {}) {
+function createApp(opts: { allowRegistration?: boolean; withEmail?: boolean; defaultRole?: string; isBootstrapCompleted?: () => Promise<boolean> } = {}) {
     // Re-create mocked service instances each time
-                
+
     // Wire constructor mocks to return our instances
-                
+
     // Default returns for mocked services
-    
+
     mockAuthRepo = {
         getUserByEmail: jest.fn().mockResolvedValue(null),
-        getUserByGoogleId: jest.fn().mockResolvedValue(null),
+        getUserByIdentity: jest.fn().mockResolvedValue(null),
+        linkUserIdentity: jest.fn().mockResolvedValue(undefined),
+        getUserIdentities: jest.fn().mockResolvedValue([]),
         getUserById: jest.fn().mockResolvedValue(null),
         createUser: jest.fn().mockImplementation((data) =>
-            Promise.resolve(mockUser({ email: data.email, displayName: data.displayName, passwordHash: data.passwordHash }))
+            Promise.resolve(mockUser({ email: data.email,
+displayName: data.displayName,
+passwordHash: data.passwordHash }))
         ),
         listUsers: jest.fn().mockResolvedValue([]),
         getUserRoles: jest.fn().mockResolvedValue([mockRole("editor")]),
@@ -79,7 +85,8 @@ function createApp(opts: { allowRegistration?: boolean; withEmail?: boolean; def
         assignDefaultRole: jest.fn().mockResolvedValue(undefined),
         setUserRoles: jest.fn().mockResolvedValue(undefined),
         updateUser: jest.fn().mockImplementation((id, data) =>
-            Promise.resolve(mockUser({ id, ...data }))
+            Promise.resolve(mockUser({ id,
+...data }))
         ),
         deleteUser: jest.fn().mockResolvedValue(undefined),
         updatePassword: jest.fn().mockResolvedValue(undefined),
@@ -88,7 +95,8 @@ function createApp(opts: { allowRegistration?: boolean; withEmail?: boolean; def
         getUserByVerificationToken: jest.fn().mockResolvedValue(null),
         getUserWithRoles: jest.fn().mockImplementation(async (userId) => {
             const user = mockUser({ id: userId });
-            return { user, roles: [mockRole("editor")] };
+            return { user,
+roles: [mockRole("editor")] };
         }),
         createRefreshToken: jest.fn().mockResolvedValue(undefined),
         findRefreshTokenByHash: jest.fn().mockResolvedValue(null),
@@ -101,28 +109,57 @@ function createApp(opts: { allowRegistration?: boolean; withEmail?: boolean; def
         markPasswordResetTokenUsed: jest.fn().mockResolvedValue(undefined),
         deleteExpiredPasswordResetTokens: jest.fn().mockResolvedValue(undefined)
     } as unknown as jest.Mocked<AuthRepository>;
-    
+
 
     // Password mocks
-    (validatePasswordStrength as jest.Mock).mockReturnValue({ valid: true, errors: [] });
+    (validatePasswordStrength as jest.Mock).mockReturnValue({ valid: true,
+errors: [] });
     (hashPassword as jest.Mock).mockResolvedValue("hashed-pw");
     (verifyPassword as jest.Mock).mockResolvedValue(true);
 
-    // Google mocks
-    (isGoogleOAuthConfigured as jest.Mock).mockReturnValue(false);
-    (verifyGoogleIdToken as jest.Mock).mockResolvedValue(null);
-
     // Email mock
-    mockEmailService = { send: jest.fn().mockResolvedValue(undefined), isConfigured: jest.fn().mockReturnValue(opts.withEmail ?? false) };
+    mockEmailService = { send: jest.fn().mockResolvedValue(undefined),
+isConfigured: jest.fn().mockReturnValue(opts.withEmail ?? false) };
 
     const config: AuthModuleConfig = {
         authRepo: mockAuthRepo,
         allowRegistration: opts.allowRegistration ?? true,
         defaultRole: opts.defaultRole,
         emailService: opts.withEmail ? mockEmailService as any : undefined,
-        emailConfig: opts.withEmail ? { from: "test@test.com", appName: "TestApp", resetPasswordUrl: "https://app.test", verifyEmailUrl: "https://app.test" } : undefined,
+        emailConfig: opts.withEmail ? { from: "test@test.com",
+appName: "TestApp",
+resetPasswordUrl: "https://app.test",
+verifyEmailUrl: "https://app.test" } : undefined,
+        oauthProviders: opts.withEmail === false && opts.allowRegistration === false ? [] : [
+            {
+                id: "google",
+                schema: z.object({ idToken: z.string().min(1) }),
+                verify: async (payload: any) => {
+                    const idToken = payload.idToken;
+                    if (idToken === "bad-token") return null;
+                    if (idToken === "link-token") return { providerId: "g-456",
+email: "existing@test.com",
+displayName: "Existing",
+photoUrl: null };
+                    if (idToken === "returning-token") return { providerId: "g-789",
+email: "returning@test.com",
+displayName: "Updated Name",
+photoUrl: "https://new-photo.url" };
+                    if (idToken === "valid-token") return { providerId: "g-123",
+email: "google@test.com",
+displayName: "Google User",
+photoUrl: "https://photo.url" };
+                    return null;
+                }
+            }
+        ]
     };
 
+    if (opts.isBootstrapCompleted) {
+        config.isBootstrapCompleted = opts.isBootstrapCompleted;
+    }
+
+
     const app = new Hono<HonoEnv>();
     app.onError(errorHandler);
     app.route("/auth", createAuthRoutes(config));
@@ -133,7 +170,7 @@ function json(body: Record<string, unknown>) {
     return {
         method: "POST" as const,
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(body),
+        body: JSON.stringify(body)
     };
 }
 
@@ -147,23 +184,27 @@ function authHeader(userId = "user-1", roles = ["editor"]) {
 
 describe("Auth Routes (Integration)", () => {
     beforeAll(() => {
-        configureJwt({ secret: TEST_SECRET, accessExpiresIn: "1h" });
+        configureJwt({ secret: TEST_SECRET,
+accessExpiresIn: "1h" });
     });
 
     beforeEach(() => {
         jest.clearAllMocks();
     });
 
+    describe("Configuration Security", () => {
+        it("throws an error when defaultRole is set to 'admin'", () => {
+            expect(() => createApp({ defaultRole: "admin" })).toThrowError(/CRITICAL SECURITY ERROR/);
+        });
+    });
+
     // ── Registration ────────────────────────────────────────────────────
     describe("POST /auth/register", () => {
         it("registers a new user and returns 201 with tokens", async () => {
             const app = createApp();
-            // allowRegistration=true → isRegistrationAllowed() returns immediately
-            // Only the isFirstUser check calls listUsers
-            mockAuthRepo.listUsers
-                .mockResolvedValueOnce([mockUser()]); // isFirstUser check
 
-            const res = await app.request("/auth/register", json({ email: "new@test.com", password: "StrongPass1" }));
+            const res = await app.request("/auth/register", json({ email: "new@test.com",
+password: "StrongPass1" }));
             expect(res.status).toBe(201);
             const body = await res.json() as any;
             expect(body.tokens.accessToken).toBeTruthy();
@@ -171,34 +212,28 @@ describe("Auth Routes (Integration)", () => {
             expect(body.user.email).toBe("new@test.com");
         });
 
-        it("first user gets admin role", async () => {
+        it("first user does NOT get admin role (must use bootstrap)", async () => {
             const app = createApp();
-            // allowRegistration=true → isRegistrationAllowed() returns immediately
-            // Only the isFirstUser check calls listUsers (after createUser)
-            mockAuthRepo.listUsers
-                .mockResolvedValueOnce([mockUser()]); // allUsers.length === 1 → isFirstUser
 
-            await app.request("/auth/register", json({ email: "first@test.com", password: "StrongPass1" }));
-            expect(mockAuthRepo.assignDefaultRole).toHaveBeenCalledWith(expect.any(String), "admin");
+            await app.request("/auth/register", json({ email: "first@test.com",
+password: "StrongPass1" }));
+            // No admin assignment — users must bootstrap via POST /admin/bootstrap
+            expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalled();
         });
 
-        it("second user gets configured default role", async () => {
+        it("assigns configured default role to new users", async () => {
             const app = createApp({ defaultRole: "editor" });
-            // allowRegistration=true → isRegistrationAllowed() returns immediately
-            // isFirstUser check: 2 users → not first
-            mockAuthRepo.listUsers
-                .mockResolvedValueOnce([mockUser(), mockUser({ id: "user-2" })]);
 
-            await app.request("/auth/register", json({ email: "second@test.com", password: "StrongPass1" }));
+            await app.request("/auth/register", json({ email: "second@test.com",
+password: "StrongPass1" }));
             expect(mockAuthRepo.assignDefaultRole).toHaveBeenCalledWith(expect.any(String), "editor");
         });
 
-        it("second user gets no role by default when not configured", async () => {
+        it("does not assign role when defaultRole is not configured", async () => {
             const app = createApp();
-            mockAuthRepo.listUsers
-                .mockResolvedValueOnce([mockUser(), mockUser({ id: "user-2" })]);
 
-            await app.request("/auth/register", json({ email: "third@test.com", password: "StrongPass1" }));
+            await app.request("/auth/register", json({ email: "third@test.com",
+password: "StrongPass1" }));
             expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalled();
         });
 
@@ -206,7 +241,8 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser());
 
-            const res = await app.request("/auth/register", json({ email: "existing@test.com", password: "StrongPass1" }));
+            const res = await app.request("/auth/register", json({ email: "existing@test.com",
+password: "StrongPass1" }));
             expect(res.status).toBe(409);
             const body = await res.json() as any;
             expect(body.error.code).toBe("EMAIL_EXISTS");
@@ -214,9 +250,11 @@ describe("Auth Routes (Integration)", () => {
 
         it("returns 400 for weak password", async () => {
             const app = createApp();
-            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false, errors: ["Too short"] });
+            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false,
+errors: ["Too short"] });
 
-            const res = await app.request("/auth/register", json({ email: "new@test.com", password: "weak" }));
+            const res = await app.request("/auth/register", json({ email: "new@test.com",
+password: "weak" }));
             expect(res.status).toBe(400);
             const body = await res.json() as any;
             expect(body.error.code).toBe("WEAK_PASSWORD");
@@ -224,7 +262,8 @@ describe("Auth Routes (Integration)", () => {
 
         it("returns 400 for invalid email (Zod)", async () => {
             const app = createApp();
-            const res = await app.request("/auth/register", json({ email: "not-an-email", password: "StrongPass1" }));
+            const res = await app.request("/auth/register", json({ email: "not-an-email",
+password: "StrongPass1" }));
             expect(res.status).toBe(400);
             const body = await res.json() as any;
             expect(body.error.code).toBe("INVALID_INPUT");
@@ -236,31 +275,33 @@ describe("Auth Routes (Integration)", () => {
             expect(res.status).toBe(400);
         });
 
-        it("returns 403 when registration is disabled and users exist", async () => {
+        it("returns 403 when registration is disabled", async () => {
             const app = createApp({ allowRegistration: false });
-            mockAuthRepo.listUsers.mockResolvedValueOnce([mockUser()]); // users exist
 
-            const res = await app.request("/auth/register", json({ email: "new@test.com", password: "StrongPass1" }));
+            const res = await app.request("/auth/register", json({ email: "new@test.com",
+password: "StrongPass1" }));
             expect(res.status).toBe(403);
             const body = await res.json() as any;
             expect(body.error.code).toBe("REGISTRATION_DISABLED");
         });
 
-        it("allows first-user registration even when registration is disabled", async () => {
+        it("blocks registration even on empty database when allowRegistration=false", async () => {
             const app = createApp({ allowRegistration: false });
-            mockAuthRepo.listUsers
-                .mockResolvedValueOnce([])   // isRegistrationAllowed → empty = allow
-                .mockResolvedValueOnce([mockUser()]); // isFirstUser
+            // Even with no users, registration should be denied
+            mockAuthRepo.listUsers.mockResolvedValueOnce([]);
 
-            const res = await app.request("/auth/register", json({ email: "first@test.com", password: "StrongPass1" }));
-            expect(res.status).toBe(201);
+            const res = await app.request("/auth/register", json({ email: "first@test.com",
+password: "StrongPass1" }));
+            expect(res.status).toBe(403);
+            const body = await res.json() as any;
+            expect(body.error.code).toBe("REGISTRATION_DISABLED");
         });
 
         it("stores refresh token after registration", async () => {
             const app = createApp();
-            mockAuthRepo.listUsers.mockResolvedValueOnce([mockUser()]);
 
-            await app.request("/auth/register", json({ email: "a@b.com", password: "StrongPass1" }));
+            await app.request("/auth/register", json({ email: "a@b.com",
+password: "StrongPass1" }));
             expect(mockAuthRepo.createRefreshToken).toHaveBeenCalledTimes(1);
         });
     });
@@ -272,7 +313,8 @@ describe("Auth Routes (Integration)", () => {
             const user = mockUser({ passwordHash: "salt:hash" });
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(user);
 
-            const res = await app.request("/auth/login", json({ email: "test@example.com", password: "ValidPass1" }));
+            const res = await app.request("/auth/login", json({ email: "test@example.com",
+password: "ValidPass1" }));
             expect(res.status).toBe(200);
             const body = await res.json() as any;
             expect(body.tokens.accessToken).toBeTruthy();
@@ -283,7 +325,8 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(null);
 
-            const res = await app.request("/auth/login", json({ email: "nobody@test.com", password: "Any1" }));
+            const res = await app.request("/auth/login", json({ email: "nobody@test.com",
+password: "Any1" }));
             expect(res.status).toBe(401);
             const body = await res.json() as any;
             expect(body.error.code).toBe("INVALID_CREDENTIALS");
@@ -294,7 +337,8 @@ describe("Auth Routes (Integration)", () => {
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser());
             (verifyPassword as jest.Mock).mockResolvedValueOnce(false);
 
-            const res = await app.request("/auth/login", json({ email: "test@example.com", password: "Wrong1" }));
+            const res = await app.request("/auth/login", json({ email: "test@example.com",
+password: "Wrong1" }));
             expect(res.status).toBe(401);
         });
 
@@ -302,7 +346,8 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser({ passwordHash: null }));
 
-            const res = await app.request("/auth/login", json({ email: "google@test.com", password: "Any1" }));
+            const res = await app.request("/auth/login", json({ email: "google@test.com",
+password: "Any1" }));
             expect(res.status).toBe(401);
         });
 
@@ -316,25 +361,23 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser());
 
-            await app.request("/auth/login", json({ email: "test@example.com", password: "ValidPass1" }));
+            await app.request("/auth/login", json({ email: "test@example.com",
+password: "ValidPass1" }));
             expect(mockAuthRepo.createRefreshToken).toHaveBeenCalledTimes(1);
         });
     });
 
     // ── Google OAuth ────────────────────────────────────────────────────
     describe("POST /auth/google", () => {
-        it("returns 503 when Google OAuth is not configured", async () => {
-            const app = createApp();
+        it("returns 404 when OAuth provider is not injected", async () => {
+            const app = createApp({ allowRegistration: false,
+withEmail: false }); // Hack to pass empty list of providers
             const res = await app.request("/auth/google", json({ idToken: "google-token" }));
-            expect(res.status).toBe(503);
-            const body = await res.json() as any;
-            expect(body.error.code).toBe("NOT_CONFIGURED");
+            expect(res.status).toBe(404);
         });
 
         it("returns 401 for invalid Google token", async () => {
             const app = createApp();
-            (isGoogleOAuthConfigured as jest.Mock).mockReturnValueOnce(true);
-            (verifyGoogleIdToken as jest.Mock).mockResolvedValueOnce(null);
 
             const res = await app.request("/auth/google", json({ idToken: "bad-token" }));
             expect(res.status).toBe(401);
@@ -344,64 +387,40 @@ describe("Auth Routes (Integration)", () => {
 
         it("creates a new user for new Google sign-in", async () => {
             const app = createApp();
-            (isGoogleOAuthConfigured as jest.Mock).mockReturnValue(true);
-            (verifyGoogleIdToken as jest.Mock).mockResolvedValueOnce({
-                googleId: "g-123",
-                email: "google@test.com",
-                displayName: "Google User",
-                photoUrl: "https://photo.url",
-                emailVerified: true,
-            });
-            mockAuthRepo.getUserByGoogleId.mockResolvedValueOnce(null);
+            mockAuthRepo.getUserByIdentity.mockResolvedValueOnce(null);
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(null);
-            mockAuthRepo.listUsers.mockResolvedValueOnce([mockUser()]); // not first user
 
             const res = await app.request("/auth/google", json({ idToken: "valid-token" }));
             expect(res.status).toBe(200);
             expect(mockAuthRepo.createUser).toHaveBeenCalledWith(expect.objectContaining({
-                email: "google@test.com",
-                provider: "google",
-                googleId: "g-123",
+                email: "google@test.com"
             }));
+            expect(mockAuthRepo.linkUserIdentity).toHaveBeenCalledWith(expect.any(String), "google", "g-123", expect.any(Object));
+            // Verify no admin auto-assignment
+            expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalled();
         });
 
         it("links Google to existing account by email", async () => {
             const app = createApp();
-            (isGoogleOAuthConfigured as jest.Mock).mockReturnValue(true);
-            (verifyGoogleIdToken as jest.Mock).mockResolvedValueOnce({
-                googleId: "g-456",
-                email: "existing@test.com",
-                displayName: "Existing",
-                photoUrl: null,
-                emailVerified: true,
-            });
             const existing = mockUser({ email: "existing@test.com" });
-            mockAuthRepo.getUserByGoogleId.mockResolvedValueOnce(null);
+            mockAuthRepo.getUserByIdentity.mockResolvedValueOnce(null);
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(existing);
 
             const res = await app.request("/auth/google", json({ idToken: "link-token" }));
             expect(res.status).toBe(200);
-            expect(mockAuthRepo.updateUser).toHaveBeenCalledWith(existing.id, { googleId: "g-456" });
+            expect(mockAuthRepo.linkUserIdentity).toHaveBeenCalledWith(existing.id, "google", "g-456", expect.any(Object));
         });
 
         it("updates profile for returning Google user", async () => {
             const app = createApp();
-            (isGoogleOAuthConfigured as jest.Mock).mockReturnValue(true);
             const existingUser = mockUser({ id: "g-user-1" });
-            (verifyGoogleIdToken as jest.Mock).mockResolvedValueOnce({
-                googleId: "g-789",
-                email: "returning@test.com",
-                displayName: "Updated Name",
-                photoUrl: "https://new-photo.url",
-                emailVerified: true,
-            });
-            mockAuthRepo.getUserByGoogleId.mockResolvedValueOnce(existingUser);
+            mockAuthRepo.getUserByIdentity.mockResolvedValueOnce(existingUser);
 
             const res = await app.request("/auth/google", json({ idToken: "returning-token" }));
             expect(res.status).toBe(200);
             expect(mockAuthRepo.updateUser).toHaveBeenCalledWith(existingUser.id, expect.objectContaining({
                 displayName: "Updated Name",
-                photoUrl: "https://new-photo.url",
+                photoUrl: "https://new-photo.url"
             }));
         });
     });
@@ -417,7 +436,7 @@ describe("Auth Routes (Integration)", () => {
                 expiresAt: new Date(Date.now() + 86400000),
                 createdAt: new Date(),
                 userAgent: "",
-                ipAddress: "",
+                ipAddress: ""
             });
             mockAuthRepo.getUserRoles.mockResolvedValueOnce([mockRole("editor")]);
 
@@ -437,7 +456,7 @@ describe("Auth Routes (Integration)", () => {
                 expiresAt: new Date(Date.now() + 86400000),
                 createdAt: new Date(),
                 userAgent: "",
-                ipAddress: "",
+                ipAddress: ""
             });
 
             await app.request("/auth/refresh", json({ refreshToken: "the-token" }));
@@ -466,7 +485,7 @@ describe("Auth Routes (Integration)", () => {
                 expiresAt: new Date(Date.now() - 1000), // expired
                 createdAt: new Date(),
                 userAgent: "",
-                ipAddress: "",
+                ipAddress: ""
             });
 
             const res = await app.request("/auth/refresh", json({ refreshToken: "expired-token" }));
@@ -545,10 +564,11 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.findValidPasswordResetToken.mockResolvedValueOnce({
                 userId: "user-1",
-                expiresAt: new Date(Date.now() + 3600000),
+                expiresAt: new Date(Date.now() + 3600000)
             });
 
-            const res = await app.request("/auth/reset-password", json({ token: "valid-reset-token", password: "NewStrong1" }));
+            const res = await app.request("/auth/reset-password", json({ token: "valid-reset-token",
+password: "NewStrong1" }));
             expect(res.status).toBe(200);
             expect(mockAuthRepo.updatePassword).toHaveBeenCalledWith("user-1", "hashed-pw");
             expect(mockAuthRepo.markPasswordResetTokenUsed).toHaveBeenCalled();
@@ -558,10 +578,11 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.findValidPasswordResetToken.mockResolvedValueOnce({
                 userId: "user-1",
-                expiresAt: new Date(Date.now() + 3600000),
+                expiresAt: new Date(Date.now() + 3600000)
             });
 
-            await app.request("/auth/reset-password", json({ token: "token", password: "NewStrong1" }));
+            await app.request("/auth/reset-password", json({ token: "token",
+password: "NewStrong1" }));
             expect(mockAuthRepo.deleteAllRefreshTokensForUser).toHaveBeenCalledWith("user-1");
         });
 
@@ -569,7 +590,8 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             mockAuthRepo.findValidPasswordResetToken.mockResolvedValueOnce(null);
 
-            const res = await app.request("/auth/reset-password", json({ token: "expired", password: "NewStrong1" }));
+            const res = await app.request("/auth/reset-password", json({ token: "expired",
+password: "NewStrong1" }));
             expect(res.status).toBe(400);
             const body = await res.json() as any;
             expect(body.error.code).toBe("INVALID_TOKEN");
@@ -577,9 +599,11 @@ describe("Auth Routes (Integration)", () => {
 
         it("returns 400 for weak new password", async () => {
             const app = createApp();
-            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false, errors: ["Too weak"] });
+            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false,
+errors: ["Too weak"] });
 
-            const res = await app.request("/auth/reset-password", json({ token: "token", password: "weak" }));
+            const res = await app.request("/auth/reset-password", json({ token: "token",
+password: "weak" }));
             expect(res.status).toBe(400);
             const body = await res.json() as any;
             expect(body.error.code).toBe("WEAK_PASSWORD");
@@ -593,8 +617,10 @@ describe("Auth Routes (Integration)", () => {
             mockAuthRepo.getUserById.mockResolvedValue(mockUser());
 
             const res = await app.request("/auth/change-password", {
-                ...json({ oldPassword: "OldPass1", newPassword: "NewPass1" }),
-                headers: { ...json({}).headers, ...authHeader() },
+                ...json({ oldPassword: "OldPass1",
+newPassword: "NewPass1" }),
+                headers: { ...json({}).headers,
+...authHeader() }
             });
             expect(res.status).toBe(200);
             expect(mockAuthRepo.updatePassword).toHaveBeenCalled();
@@ -605,8 +631,10 @@ describe("Auth Routes (Integration)", () => {
             mockAuthRepo.getUserById.mockResolvedValue(mockUser());
 
             await app.request("/auth/change-password", {
-                ...json({ oldPassword: "Old1", newPassword: "New1Pass" }),
-                headers: { ...json({}).headers, ...authHeader() },
+                ...json({ oldPassword: "Old1",
+newPassword: "New1Pass" }),
+                headers: { ...json({}).headers,
+...authHeader() }
             });
             expect(mockAuthRepo.deleteAllRefreshTokensForUser).toHaveBeenCalledWith("user-1");
         });
@@ -617,8 +645,10 @@ describe("Auth Routes (Integration)", () => {
             (verifyPassword as jest.Mock).mockResolvedValueOnce(false);
 
             const res = await app.request("/auth/change-password", {
-                ...json({ oldPassword: "Wrong1", newPassword: "New1Pass" }),
-                headers: { ...json({}).headers, ...authHeader() },
+                ...json({ oldPassword: "Wrong1",
+newPassword: "New1Pass" }),
+                headers: { ...json({}).headers,
+...authHeader() }
             });
             expect(res.status).toBe(401);
         });
@@ -626,18 +656,22 @@ describe("Auth Routes (Integration)", () => {
         it("returns 400 for weak new password", async () => {
             const app = createApp();
             mockAuthRepo.getUserById.mockResolvedValue(mockUser());
-            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false, errors: ["Too short"] });
+            (validatePasswordStrength as jest.Mock).mockReturnValueOnce({ valid: false,
+errors: ["Too short"] });
 
             const res = await app.request("/auth/change-password", {
-                ...json({ oldPassword: "Old1", newPassword: "x" }),
-                headers: { ...json({}).headers, ...authHeader() },
+                ...json({ oldPassword: "Old1",
+newPassword: "x" }),
+                headers: { ...json({}).headers,
+...authHeader() }
             });
             expect(res.status).toBe(400);
         });
 
         it("returns 401 without auth", async () => {
             const app = createApp();
-            const res = await app.request("/auth/change-password", json({ oldPassword: "Old1", newPassword: "New1Pass" }));
+            const res = await app.request("/auth/change-password", json({ oldPassword: "Old1",
+newPassword: "New1Pass" }));
             expect(res.status).toBe(401);
         });
 
@@ -646,8 +680,10 @@ describe("Auth Routes (Integration)", () => {
             mockAuthRepo.getUserById.mockResolvedValue(mockUser({ passwordHash: null }));
 
             const res = await app.request("/auth/change-password", {
-                ...json({ oldPassword: "Old1", newPassword: "New1Pass" }),
-                headers: { ...json({}).headers, ...authHeader() },
+                ...json({ oldPassword: "Old1",
+newPassword: "New1Pass" }),
+                headers: { ...json({}).headers,
+...authHeader() }
             });
             expect(res.status).toBe(400);
             const body = await res.json() as any;
@@ -664,7 +700,7 @@ describe("Auth Routes (Integration)", () => {
 
                 const res = await app.request("/auth/send-verification", {
                     method: "POST",
-                    headers: { ...authHeader() },
+                    headers: { ...authHeader() }
                 });
                 expect(res.status).toBe(200);
                 expect(mockAuthRepo.setVerificationToken).toHaveBeenCalled();
@@ -677,7 +713,7 @@ describe("Auth Routes (Integration)", () => {
 
                 const res = await app.request("/auth/send-verification", {
                     method: "POST",
-                    headers: { ...authHeader() },
+                    headers: { ...authHeader() }
                 });
                 expect(res.status).toBe(400);
                 const body = await res.json() as any;
@@ -694,7 +730,7 @@ describe("Auth Routes (Integration)", () => {
                 const app = createApp({ withEmail: false });
                 const res = await app.request("/auth/send-verification", {
                     method: "POST",
-                    headers: { ...authHeader() },
+                    headers: { ...authHeader() }
                 });
                 expect(res.status).toBe(503);
             });
@@ -733,7 +769,7 @@ describe("Auth Routes (Integration)", () => {
         it("returns authenticated user with roles", async () => {
             const app = createApp();
             const res = await app.request("/auth/me", {
-                headers: { ...authHeader("user-1", ["admin"]) },
+                headers: { ...authHeader("user-1", ["admin"]) }
             });
             expect(res.status).toBe(200);
             const body = await res.json() as any;
@@ -752,7 +788,7 @@ describe("Auth Routes (Integration)", () => {
             mockAuthRepo.getUserWithRoles.mockResolvedValueOnce(null);
 
             const res = await app.request("/auth/me", {
-                headers: { ...authHeader() },
+                headers: { ...authHeader() }
             });
             expect(res.status).toBe(404);
         });
@@ -765,12 +801,13 @@ describe("Auth Routes (Integration)", () => {
 
             const res = await app.request("/auth/me", {
                 method: "PATCH",
-                headers: { "Content-Type": "application/json", ...authHeader() },
-                body: JSON.stringify({ displayName: "New Name" }),
+                headers: { "Content-Type": "application/json",
+...authHeader() },
+                body: JSON.stringify({ displayName: "New Name" })
             });
             expect(res.status).toBe(200);
             expect(mockAuthRepo.updateUser).toHaveBeenCalledWith("user-1", expect.objectContaining({
-                displayName: "New Name",
+                displayName: "New Name"
             }));
         });
 
@@ -779,7 +816,7 @@ describe("Auth Routes (Integration)", () => {
             const res = await app.request("/auth/me", {
                 method: "PATCH",
                 headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ displayName: "Name" }),
+                body: JSON.stringify({ displayName: "Name" })
             });
             expect(res.status).toBe(401);
         });
@@ -790,7 +827,13 @@ describe("Auth Routes (Integration)", () => {
         it("GET /auth/sessions lists active sessions", async () => {
             const app = createApp();
             mockAuthRepo.listRefreshTokensForUser.mockResolvedValueOnce([
-                { id: "s1", userId: "user-1", tokenHash: "h1", expiresAt: new Date(), createdAt: new Date(), userAgent: "Chrome", ipAddress: "1.2.3.4" },
+                { id: "s1",
+userId: "user-1",
+tokenHash: "h1",
+expiresAt: new Date(),
+createdAt: new Date(),
+userAgent: "Chrome",
+ipAddress: "1.2.3.4" }
             ]);
 
             const res = await app.request("/auth/sessions", { headers: { ...authHeader() } });
@@ -804,7 +847,7 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             const res = await app.request("/auth/sessions", {
                 method: "DELETE",
-                headers: { ...authHeader() },
+                headers: { ...authHeader() }
             });
             expect(res.status).toBe(200);
             expect(mockAuthRepo.deleteAllRefreshTokensForUser).toHaveBeenCalledWith("user-1");
@@ -814,7 +857,7 @@ describe("Auth Routes (Integration)", () => {
             const app = createApp();
             const res = await app.request("/auth/sessions/s123", {
                 method: "DELETE",
-                headers: { ...authHeader() },
+                headers: { ...authHeader() }
             });
             expect(res.status).toBe(200);
             expect(mockAuthRepo.deleteRefreshTokenById).toHaveBeenCalledWith("s123", "user-1");
@@ -832,7 +875,27 @@ describe("Auth Routes (Integration)", () => {
 
     // ── Auth Config ─────────────────────────────────────────────────────
     describe("GET /auth/config", () => {
-        it("returns setup status when no users exist", async () => {
+        it("returns needsSetup=true when isBootstrapCompleted returns false", async () => {
+            const app = createApp({ isBootstrapCompleted: async () => false });
+
+            const res = await app.request("/auth/config");
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.needsSetup).toBe(true);
+            expect(body.registrationEnabled).toBe(true); // always true when needsSetup
+        });
+
+        it("returns needsSetup=false when isBootstrapCompleted returns true", async () => {
+            const app = createApp({ allowRegistration: false, isBootstrapCompleted: async () => true });
+
+            const res = await app.request("/auth/config");
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.needsSetup).toBe(false);
+            expect(body.registrationEnabled).toBe(false);
+        });
+
+        it("falls back to user-count check when no isBootstrapCompleted callback", async () => {
             const app = createApp();
             mockAuthRepo.listUsers.mockResolvedValueOnce([]);
 
@@ -840,11 +903,12 @@ describe("Auth Routes (Integration)", () => {
             expect(res.status).toBe(200);
             const body = await res.json() as any;
             expect(body.needsSetup).toBe(true);
-            expect(body.registrationEnabled).toBe(true); // always true when needsSetup
+            expect(body.registrationEnabled).toBe(true);
         });
 
-        it("returns correct flags when users exist", async () => {
-            const app = createApp({ allowRegistration: false });
+        it("returns correct flags when users exist and no callback", async () => {
+            const app = createApp({ allowRegistration: false,
+withEmail: false });
             mockAuthRepo.listUsers.mockResolvedValueOnce([mockUser()]);
 
             const res = await app.request("/auth/config");
@@ -857,7 +921,6 @@ describe("Auth Routes (Integration)", () => {
 
         it("reports Google enabled when configured", async () => {
             const app = createApp();
-            (isGoogleOAuthConfigured as jest.Mock).mockReturnValue(true);
             mockAuthRepo.listUsers.mockResolvedValueOnce([mockUser()]);
 
             const res = await app.request("/auth/config");
@@ -865,4 +928,120 @@ describe("Auth Routes (Integration)", () => {
             expect(body.googleEnabled).toBe(true);
         });
     });
+
+    // ═════════════════════════════════════════════════════════════════════
+    // SECURITY REGRESSION TESTS — CVE: First-User Admin Privilege Escalation
+    // These tests directly verify the exploit scenarios from the security audit.
+    // ═════════════════════════════════════════════════════════════════════
+
+    describe("Security: privilege escalation prevention", () => {
+        it("CVE-FIX: registration NEVER assigns admin role, even for first user", async () => {
+            const app = createApp({ allowRegistration: true });
+            // Simulate first user (empty database before, one user after create)
+            mockAuthRepo.listUsers.mockResolvedValueOnce([]);
+
+            const res = await app.request("/auth/register", json({
+                email: "hacker@evil.com",
+                password: "HackRebase2026!",
+                displayName: "Hacker"
+            }));
+
+            expect(res.status).toBe(201);
+            const body = await res.json() as any;
+
+            // The critical assertion: admin must NOT be in the roles
+            expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalledWith(
+                expect.any(String), "admin"
+            );
+            // Verify the user was created but NOT given admin
+            expect(mockAuthRepo.createUser).toHaveBeenCalledTimes(1);
+        });
+
+        it("CVE-FIX: OAuth registration NEVER assigns admin role, even for first user", async () => {
+            const app = createApp({ allowRegistration: true });
+            mockAuthRepo.getUserByIdentity.mockResolvedValueOnce(null);
+            mockAuthRepo.getUserByEmail.mockResolvedValueOnce(null);
+
+            const res = await app.request("/auth/google", json({ idToken: "valid-token" }));
+            expect(res.status).toBe(200);
+
+            // The critical assertion: admin must NOT be assigned
+            expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalledWith(
+                expect.any(String), "admin"
+            );
+        });
+
+        it("CVE-FIX: empty database does NOT bypass allowRegistration=false", async () => {
+            const app = createApp({ allowRegistration: false });
+            // Even with zero users, the registration endpoint must reject
+            mockAuthRepo.listUsers.mockResolvedValueOnce([]);
+
+            const res = await app.request("/auth/register", json({
+                email: "hacker@evil.com",
+                password: "HackRebase2026!",
+                displayName: "Hacker"
+            }));
+
+            expect(res.status).toBe(403);
+            const body = await res.json() as any;
+            expect(body.error.code).toBe("REGISTRATION_DISABLED");
+            // createUser must NOT have been called
+            expect(mockAuthRepo.createUser).not.toHaveBeenCalled();
+        });
+
+        it("CVE-FIX: registration is blocked when allowRegistration defaults to false", async () => {
+            const app = createApp({ allowRegistration: false });
+
+            const res = await app.request("/auth/register", json({
+                email: "hacker@evil.com",
+                password: "HackRebase2026!",
+                displayName: "Hacker"
+            }));
+
+            expect(res.status).toBe(403);
+            const body = await res.json() as any;
+            expect(body.error.code).toBe("REGISTRATION_DISABLED");
+            expect(mockAuthRepo.createUser).not.toHaveBeenCalled();
+        });
+
+        it("CVE-FIX: concurrent registration attempts cannot produce multiple admins", async () => {
+            const app = createApp({ allowRegistration: true });
+
+            // Simulate 5 concurrent registration requests
+            const requests = Array.from({ length: 5 }, (_, i) =>
+                app.request("/auth/register", json({
+                    email: `concurrent-${i}@evil.com`,
+                    password: "StrongPass1",
+                    displayName: `Concurrent ${i}`
+                }))
+            );
+
+            const responses = await Promise.all(requests);
+            const successfulRegistrations = responses.filter(r => r.status === 201);
+
+            // Even if multiple registrations succeed, NONE should get admin
+            expect(mockAuthRepo.assignDefaultRole).not.toHaveBeenCalledWith(
+                expect.any(String), "admin"
+            );
+        });
+
+        it("CVE-FIX: defaultRole cannot be set to 'admin' to grant admin via registration", async () => {
+            // Even if someone misconfigures defaultRole as 'admin',
+            // this test documents the current behavior — it would assign admin.
+            // The fix is in the config validation at startup (outside routes).
+            // Here we verify the defaultRole IS what's passed, and the auto-escalation is gone.
+            const app = createApp({ allowRegistration: true, defaultRole: "viewer" });
+
+            await app.request("/auth/register", json({
+                email: "new@test.com",
+                password: "StrongPass1"
+            }));
+
+            // Only the configured default role is assigned, never auto-admin
+            expect(mockAuthRepo.assignDefaultRole).toHaveBeenCalledWith(
+                expect.any(String), "viewer"
+            );
+            expect(mockAuthRepo.assignDefaultRole).toHaveBeenCalledTimes(1);
+        });
+    });
 });