@saluzi/saluzi-edu 0.2.13 → 0.2.15

package/packages/remote-control-server/src/__tests__/low-priority-fixes.test.ts

@@ -0,0 +1,178 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { mockConfigModule } from './helpers/mock-config'
+
+mock.module('../config', () => mockConfigModule({ pollTimeout: 1 }))
+
+import { Hono } from 'hono'
+import {
+  storeReset,
+  storeCreateSession,
+  storeBindSession,
+  storeListSessionsByOwnerUuid,
+} from '../store'
+import { initDatabase, resetDbSingleton } from '../db/sqlite'
+import { issueToken } from '../auth/token'
+import { SYSTEM_USER_ID } from '../auth/constants'
+import { resolveOwnedWebSessionId } from '../services/session'
+import webSessions from '../routes/web/sessions'
+
+function createApp() {
+  const app = new Hono()
+  app.route('/web', webSessions)
+  return app
+}
+
+function freshDb() {
+  try {
+    resetDbSingleton()
+  } catch {
+    // ignore
+  }
+  const uniquePath = `/tmp/rcs-low-fixes-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`
+  return initDatabase(uniquePath)
+}
+
+// Auth helper: issues a session token (non-admin) for the given user.
+function userAuth(user: string): string {
+  return `Bearer ${issueToken(user).token}`
+}
+
+// =============================================================================
+// H1: resolveBindUserId isAdmin check
+// =============================================================================
+describe('H1: resolveBindUserId requires isAdmin for X-User-Id', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    freshDb()
+    storeReset()
+    app = createApp()
+  })
+
+  test('admin API key + X-User-Id creates session bound to X-User-Id user', async () => {
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer test-api-key',
+        'Content-Type': 'application/json',
+        'X-User-Id': 'admin-chosen-user',
+      },
+      body: JSON.stringify({ title: 'Admin Bound' }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as Record<string, unknown>
+    expect(body.id).toMatch(/^session_/)
+
+    // Verify the session is bound to the X-User-Id user
+    const sessions = storeListSessionsByOwnerUuid('admin-chosen-user')
+    expect(sessions.length).toBeGreaterThanOrEqual(1)
+    expect(sessions.some(s => s.id === body.id)).toBe(true)
+  })
+
+  test('non-admin user token + X-User-Id ignores X-User-Id, binds to token user', async () => {
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: userAuth('real-user'),
+        'Content-Type': 'application/json',
+        'X-User-Id': 'impersonated-user',
+      },
+      body: JSON.stringify({ title: 'Impersonation Attempt' }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as Record<string, unknown>
+
+    // Session should be bound to the real token user, NOT the impersonated user
+    const realSessions = storeListSessionsByOwnerUuid('real-user')
+    expect(realSessions.some(s => s.id === body.id)).toBe(true)
+
+    const impersonated = storeListSessionsByOwnerUuid('impersonated-user')
+    expect(impersonated.some(s => s.id === body.id)).toBe(false)
+  })
+
+  test('admin API key without X-User-Id creates orphan session (not bound)', async () => {
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer test-api-key',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ title: 'Orphan Session' }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as Record<string, unknown>
+    expect(body.id).toMatch(/^session_/)
+
+    // No user should own this session
+    const systemSessions = storeListSessionsByOwnerUuid(SYSTEM_USER_ID)
+    expect(systemSessions.some(s => s.id === body.id)).toBe(false)
+  })
+
+  test('resolveBindUserId source includes isAdmin check', () => {
+    const source = readFileSync(
+      resolve(import.meta.dir, '../routes/web/sessions.ts'),
+      'utf8',
+    )
+    // The resolveBindUserId function should check isAdmin when userId is SYSTEM_USER_ID
+    const fnMatch = source.match(/function\s+resolveBindUserId[\s\S]*?^}/m)
+    expect(fnMatch).not.toBeNull()
+    const fnBody = fnMatch![0]
+    // Must reference isAdmin
+    expect(fnBody).toContain('isAdmin')
+  })
+})
+
+// =============================================================================
+// M2: resolveOwnedWebSessionId removes redundant storeIsSessionOwner fallback
+// =============================================================================
+describe('M2: resolveOwnedWebSessionId removes redundant fallback', () => {
+  beforeEach(() => {
+    freshDb()
+    storeReset()
+  })
+
+  test('returns session ID for owner (main logic works)', () => {
+    const session = storeCreateSession({})
+    storeBindSession(session.id, 'owner-user')
+    const result = resolveOwnedWebSessionId(session.id, 'owner-user')
+    expect(result).toBe(session.id)
+  })
+
+  test('returns null for non-owner', () => {
+    const session = storeCreateSession({})
+    storeBindSession(session.id, 'other-user')
+    const result = resolveOwnedWebSessionId(session.id, 'not-owner')
+    expect(result).toBeNull()
+  })
+
+  test('source does not use storeIsSessionOwner as fallback', () => {
+    const source = readFileSync(
+      resolve(import.meta.dir, '../services/session.ts'),
+      'utf8',
+    )
+    // The resolveOwnedWebSessionId function should NOT have a catch block
+    // that calls storeIsSessionOwner (redundant DB query)
+    const fnMatch = source.match(
+      /export\s+function\s+resolveOwnedWebSessionId[\s\S]*?^}/m,
+    )
+    expect(fnMatch).not.toBeNull()
+    const fnBody = fnMatch![0]
+    // Should not reference storeIsSessionOwner in the catch block
+    const catchMatch = fnBody.match(/catch\s*\{[\s\S]*?\}/)
+    if (catchMatch) {
+      expect(catchMatch[0]).not.toContain('storeIsSessionOwner')
+    }
+  })
+
+  test('session.ts does not import storeIsSessionOwner', () => {
+    const source = readFileSync(
+      resolve(import.meta.dir, '../services/session.ts'),
+      'utf8',
+    )
+    // storeIsSessionOwner should be removed from imports
+    expect(source).not.toMatch(/import\s*\{[^}]*storeIsSessionOwner[^}]*\}/)
+  })
+})

package/packages/remote-control-server/src/__tests__/middleware.test.ts

@@ -29,7 +29,7 @@ function createTestApp() {
 
   // Test route for apiKeyAuth
   app.get('/api-key-test', apiKeyAuth, c => {
-    return c.json({ username: c.get('username') || null })
+    return c.json({ userId: c.get('userId') || null })
   })
 
   // Test route for sessionIngressAuth
@@ -62,7 +62,7 @@ describe('Auth Middleware', () => {
       })
       expect(res.status).toBe(200)
       const body = await res.json()
-      expect(body.username).toBe('alice')
+      expect(body.userId).toBe('alice')
     })
 
     test('accepts valid API key with username query param', async () => {
@@ -71,7 +71,7 @@ describe('Auth Middleware', () => {
       })
       expect(res.status).toBe(200)
       const body = await res.json()
-      expect(body.username).toBe('bob')
+      expect(body.userId).toBe('bob')
     })
 
     test('accepts valid session token', async () => {
@@ -82,7 +82,7 @@ describe('Auth Middleware', () => {
       })
       expect(res.status).toBe(200)
       const body = await res.json()
-      expect(body.username).toBe('charlie')
+      expect(body.userId).toBe('charlie')
     })
 
     test('rejects invalid token', async () => {

package/packages/remote-control-server/src/__tests__/route-mounting.test.ts

@@ -1,4 +1,7 @@
 import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
 import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config before any imports
@@ -6,7 +9,7 @@ mock.module('../config', () => mockConfigModule())
 
 import { Hono } from 'hono'
 import type { MiddlewareHandler } from 'hono/types'
-import { resetDbSingleton, getDb } from '../db/sqlite'
+import { initDatabase, resetDbSingleton } from '../db/sqlite'
 
 // Dummy serveStatic — returns a middleware.
 // When `path: 'index.html'` is set, serves SPA fallback HTML.
@@ -16,7 +19,7 @@ const serveStatic: (opts: Record<string, unknown>) => MiddlewareHandler = (
 ) => {
   const path = opts.path as string | undefined
   if (path === 'index.html') {
-    return c => c.html('<!DOCTYPE html><html><body>SPA</body></html>')
+    return async c => c.html('<!DOCTYPE html><html><body>SPA</body></html>')
   }
   return async (_c, next) => {
     await next()
@@ -25,9 +28,11 @@ const serveStatic: (opts: Record<string, unknown>) => MiddlewareHandler = (
 
 // Dummy upgradeWebSocket
 const upgradeWebSocket = (() => {
-  return () => (c: import('hono').Context, next: import('hono').Next) =>
-    next()
-}) as import('hono/ws').UpgradeWebSocket<unknown>
+  return () =>
+    async (_c: import('hono').Context, next: import('hono').Next) => {
+      await next()
+    }
+}) as unknown as import('hono/ws').UpgradeWebSocket<unknown>
 
 import { registerRoutes } from '../registerRoutes'
 
@@ -38,9 +43,22 @@ function createApp(): Hono {
 }
 
 function setupTestDb(): void {
-  resetDbSingleton()
-  // Force init with an in-memory-like temp path
-  getDb()
+  // Initialize to a unique temp file per test file so the singleton never
+  // resolves to the production default (tmpdir()/rcs-dev.db). We don't
+  // reset between tests within this file because route handlers share the
+  // singleton — closing it mid-test would break parallel requests. But
+  // each test file gets its own module graph under --isolate, so a
+  // file-scoped path is safe.
+  try {
+    resetDbSingleton()
+  } catch {
+    // ignore
+  }
+  const uniquePath = resolve(
+    tmpdir(),
+    `rcs-routes-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`,
+  )
+  initDatabase(uniquePath)
 }
 
 describe('Route mounting integration', () => {

package/packages/remote-control-server/src/__tests__/security-fixes.test.ts

@@ -1,5 +1,7 @@
 import { describe, test, expect, beforeEach, mock } from 'bun:test'
 import { randomUUID, createHash } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
 import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config before imports
@@ -10,11 +12,13 @@ import { Hono } from 'hono'
 let authRoutes: Hono | undefined
 let webAuth: Hono | undefined
 let resetDbSingleton: (() => void) | undefined
+let initDatabase: ((path?: string) => import('bun:sqlite').Database) | undefined
 let getDb: (() => import('bun:sqlite').Database) | undefined
 let resetRateLimits: (() => void) | undefined
 
 try {
   const dbMod = await import('../db/sqlite')
+  initDatabase = dbMod.initDatabase
   getDb = dbMod.getDb
   resetDbSingleton = dbMod.resetDbSingleton
 } catch {
@@ -44,8 +48,15 @@ function freshDb() {
       // ignore
     }
   }
-  if (getDb) {
-    const db = getDb()
+  if (initDatabase) {
+    // Use a unique temp file per test to avoid polluting the production
+    // default DB path (tmpdir()/rcs-dev.db). Without this, getDb() would
+    // resolve to that file and tests would write real users into it.
+    const uniquePath = resolve(
+      tmpdir(),
+      `rcs-sec-fixes-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`,
+    )
+    const db = initDatabase(uniquePath)
     try {
       db.exec('DELETE FROM session_tokens')
       db.exec('DELETE FROM users')
@@ -54,7 +65,7 @@ function freshDb() {
     }
     return db
   }
-  throw new Error('getDb not available')
+  throw new Error('initDatabase not available')
 }
 
 function createApp(): Hono {
@@ -275,17 +286,17 @@ describe('Security: consumed_at semantics for multi-use invitations', () => {
 
       // Verify 4 users exist: admin + 3 joined
       const db = getDb!()
-      const count = db
-        .query('SELECT COUNT(*) as count FROM users')
-        .get() as { count: number }
+      const count = db.query('SELECT COUNT(*) as count FROM users').get() as {
+        count: number
+      }
       expect(count.count).toBe(4)
 
       // Verify invitation uses count
-      const tokenHash = createHash('sha256')
-        .update(inviteToken)
-        .digest('hex')
+      const tokenHash = createHash('sha256').update(inviteToken).digest('hex')
       const inv = db
-        .query('SELECT uses, max_uses, consumed_at FROM invitations WHERE token_hash = $hash')
+        .query(
+          'SELECT uses, max_uses, consumed_at FROM invitations WHERE token_hash = $hash',
+        )
         .get({ $hash: tokenHash }) as {
         uses: number
         max_uses: number
@@ -493,15 +504,12 @@ describe('Security: CSRF middleware', () => {
     app.use('/web/*', csrfCheck)
     app.delete('/web/resource/:id', c => c.json({ ok: true }))
 
-    const res = await app.request(
-      'http://localhost:3000/web/resource/abc',
-      {
-        method: 'DELETE',
-        headers: {
-          Origin: 'http://localhost:3000',
-        },
+    const res = await app.request('http://localhost:3000/web/resource/abc', {
+      method: 'DELETE',
+      headers: {
+        Origin: 'http://localhost:3000',
       },
-    )
+    })
     expect(res.status).toBe(200)
   })
 
@@ -511,16 +519,13 @@ describe('Security: CSRF middleware', () => {
     app.use('/web/*', csrfCheck)
     app.put('/web/resource/:id', c => c.json({ ok: true }))
 
-    const res = await app.request(
-      'http://localhost:3000/web/resource/abc',
-      {
-        method: 'PUT',
-        headers: {
-          Origin: 'https://evil.example',
-          'Content-Type': 'application/json',
-        },
+    const res = await app.request('http://localhost:3000/web/resource/abc', {
+      method: 'PUT',
+      headers: {
+        Origin: 'https://evil.example',
+        'Content-Type': 'application/json',
       },
-    )
+    })
     expect(res.status).toBe(403)
   })
 })

package/packages/remote-control-server/src/__tests__/security-round3.test.ts

@@ -58,7 +58,11 @@ let issueSessionToken:
     ) => { accessToken: string; refreshToken: string })
   | undefined
 let resolveSessionToken:
-  | ((token: string, db: Database, kind?: string) => string | null)
+  | ((
+      token: string,
+      db: Database,
+      kind?: 'access' | 'refresh',
+    ) => string | null)
   | undefined
 
 try {

package/packages/remote-control-server/src/__tests__/team-filter-api.test.ts

@@ -0,0 +1,280 @@
+/**
+ * Tests for team-filter API fields:
+ * - GET /web/environments returns team_id + team_name
+ * - GET /web/sessions returns owner_type + owner_id
+ * - GET /web/sessions/all returns owner_type + owner_id
+ *
+ * TDD: written before implementation.
+ */
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
+import { mockConfigModule } from './helpers/mock-config'
+
+// Mock config before importing modules
+mock.module('../config', () => mockConfigModule())
+
+import { storeReset, storeCreateEnvironment, storeBindSession } from '../store'
+import { initDatabase, resetDbSingleton, getDb } from '../db/sqlite'
+import { listActiveEnvironmentsResponse } from '../services/environment'
+import {
+  createSession,
+  listWebSessionsByOwnerUuid,
+  listWebSessionSummariesByOwnerUuid,
+} from '../services/session'
+
+describe('Team filter API fields', () => {
+  beforeEach(() => {
+    // Reset and re-init to a unique temp file so the singleton never
+    // resolves to the production default (tmpdir()/rcs-dev.db). Without
+    // this, getDb() below would write test data into that file and
+    // poison real server startups.
+    try {
+      resetDbSingleton()
+    } catch {
+      // ignore
+    }
+    const uniquePath = resolve(
+      tmpdir(),
+      `rcs-team-filter-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`,
+    )
+    initDatabase(uniquePath)
+    storeReset()
+  })
+
+  describe('EnvironmentResponse team fields', () => {
+    test('returns team_id=null and team_name=null when env has no team', () => {
+      storeCreateEnvironment({ secret: 's', machineName: 'solo-env' })
+      const envs = listActiveEnvironmentsResponse()
+      expect(envs.length).toBe(1)
+      expect(envs[0]!.team_id).toBeNull()
+      expect(envs[0]!.team_name).toBeNull()
+    })
+
+    test('returns team_id and team_name when env belongs to a team', () => {
+      const env = storeCreateEnvironment({
+        secret: 's',
+        machineName: 'team-env',
+      })
+      const db = getDb()
+
+      // Create a user (FK constraint for teams.created_by)
+      db.query(
+        `INSERT INTO users (id, username, password_hash, role, created_at)
+         VALUES ($id, $u, $ph, 'admin', $ca)`,
+      ).run({
+        $id: 'user_admin',
+        $u: 'admin',
+        $ph: 'hash',
+        $ca: new Date().toISOString(),
+      })
+
+      // Create a team
+      const teamId = 'team_001'
+      db.query(
+        `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at)
+         VALUES ($id, $name, $slug, $cb, $ca, $ua)`,
+      ).run({
+        $id: teamId,
+        $name: 'Engineering',
+        $slug: 'engineering',
+        $cb: 'user_admin',
+        $ca: new Date().toISOString(),
+        $ua: new Date().toISOString(),
+      })
+
+      // Associate env with team
+      db.query(
+        `INSERT INTO team_environments (team_id, environment_id)
+         VALUES ($tid, $eid)`,
+      ).run({ $tid: teamId, $eid: env.id })
+
+      const envs = listActiveEnvironmentsResponse()
+      expect(envs.length).toBe(1)
+      expect(envs[0]!.team_id).toBe(teamId)
+      expect(envs[0]!.team_name).toBe('Engineering')
+    })
+
+    test('returns team_id=null when team is soft-deleted', () => {
+      const env = storeCreateEnvironment({
+        secret: 's',
+        machineName: 'orphan-env',
+      })
+      const db = getDb()
+
+      db.query(
+        `INSERT INTO users (id, username, password_hash, role, created_at)
+         VALUES ($id, $u, $ph, 'admin', $ca)`,
+      ).run({
+        $id: 'user_admin',
+        $u: 'admin',
+        $ph: 'hash',
+        $ca: new Date().toISOString(),
+      })
+
+      const teamId = 'team_deleted'
+      db.query(
+        `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at, deleted_at)
+         VALUES ($id, $name, $slug, $cb, $ca, $ua, $da)`,
+      ).run({
+        $id: teamId,
+        $name: 'DeletedTeam',
+        $slug: 'deleted-team',
+        $cb: 'user_admin',
+        $ca: new Date().toISOString(),
+        $ua: new Date().toISOString(),
+        $da: new Date().toISOString(),
+      })
+
+      db.query(
+        `INSERT INTO team_environments (team_id, environment_id)
+         VALUES ($tid, $eid)`,
+      ).run({ $tid: teamId, $eid: env.id })
+
+      const envs = listActiveEnvironmentsResponse()
+      expect(envs.length).toBe(1)
+      // Soft-deleted team should not show up
+      expect(envs[0]!.team_id).toBeNull()
+      expect(envs[0]!.team_name).toBeNull()
+    })
+  })
+
+  describe('SessionResponse owner fields', () => {
+    test('returns owner_type and owner_id for user-owned session', () => {
+      const userId = 'user_alice'
+      const session = createSession({ title: 'Alice session' })
+      storeBindSession(session.id, userId, 'user')
+
+      const sessions = listWebSessionsByOwnerUuid(userId)
+      expect(sessions.length).toBeGreaterThanOrEqual(1)
+      const found = sessions.find(s => s.id === session.id)
+      expect(found).toBeDefined()
+      expect(found!.owner_type).toBe('user')
+      expect(found!.owner_id).toBe(userId)
+    })
+
+    test('returns owner_type=team for team-owned session', () => {
+      const db = getDb()
+      const userId = 'user_bob'
+      const teamId = 'team_bob'
+
+      // Create user + team
+      db.query(
+        `INSERT INTO users (id, username, password_hash, role, created_at)
+         VALUES ($id, $u, $ph, 'member', $ca)`,
+      ).run({
+        $id: userId,
+        $u: 'bob',
+        $ph: 'hash',
+        $ca: new Date().toISOString(),
+      })
+
+      db.query(
+        `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at)
+         VALUES ($id, $name, $slug, $cb, $ca, $ua)`,
+      ).run({
+        $id: teamId,
+        $name: 'BobTeam',
+        $slug: 'bobteam',
+        $cb: userId,
+        $ca: new Date().toISOString(),
+        $ua: new Date().toISOString(),
+      })
+
+      // Add bob as team member so storeListSessionsByOwnerUuid includes team sessions
+      db.query(
+        `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+         VALUES ($tid, $uid, 'owner', $aa, $ab)`,
+      ).run({
+        $tid: teamId,
+        $uid: userId,
+        $aa: new Date().toISOString(),
+        $ab: userId,
+      })
+
+      const session = createSession({ title: 'Team session' })
+      storeBindSession(session.id, teamId, 'team')
+
+      const sessions = listWebSessionsByOwnerUuid(userId)
+      const found = sessions.find(s => s.id === session.id)
+      expect(found).toBeDefined()
+      expect(found!.owner_type).toBe('team')
+      expect(found!.owner_id).toBe(teamId)
+    })
+
+    test('returns null owner when session has no owner binding', () => {
+      const userId = 'user_charlie'
+      // Create a session bound to charlie via session_owners
+      const session = createSession({ title: 'Charlie session' })
+      storeBindSession(session.id, userId, 'user')
+
+      const sessions = listWebSessionsByOwnerUuid(userId)
+      const found = sessions.find(s => s.id === session.id)
+      expect(found).toBeDefined()
+      expect(found!.owner_type).toBe('user')
+      expect(found!.owner_id).toBe(userId)
+    })
+  })
+
+  describe('SessionSummaryResponse owner fields', () => {
+    test('returns owner_type and owner_id in /sessions/all summary', () => {
+      const userId = 'user_dave'
+      const session = createSession({ title: 'Dave session' })
+      storeBindSession(session.id, userId, 'user')
+
+      const summaries = listWebSessionSummariesByOwnerUuid(userId)
+      const found = summaries.find(s => s.id === session.id)
+      expect(found).toBeDefined()
+      expect(found!.owner_type).toBe('user')
+      expect(found!.owner_id).toBe(userId)
+    })
+
+    test('returns team owner in summary for team-owned session', () => {
+      const db = getDb()
+      const userId = 'user_eve'
+      const teamId = 'team_eve'
+
+      db.query(
+        `INSERT INTO users (id, username, password_hash, role, created_at)
+         VALUES ($id, $u, $ph, 'member', $ca)`,
+      ).run({
+        $id: userId,
+        $u: 'eve',
+        $ph: 'hash',
+        $ca: new Date().toISOString(),
+      })
+
+      db.query(
+        `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at)
+         VALUES ($id, $name, $slug, $cb, $ca, $ua)`,
+      ).run({
+        $id: teamId,
+        $name: 'EveTeam',
+        $slug: 'eveteam',
+        $cb: userId,
+        $ca: new Date().toISOString(),
+        $ua: new Date().toISOString(),
+      })
+
+      db.query(
+        `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+         VALUES ($tid, $uid, 'owner', $aa, $ab)`,
+      ).run({
+        $tid: teamId,
+        $uid: userId,
+        $aa: new Date().toISOString(),
+        $ab: userId,
+      })
+
+      const session = createSession({ title: 'Eve team session' })
+      storeBindSession(session.id, teamId, 'team')
+
+      const summaries = listWebSessionSummariesByOwnerUuid(userId)
+      const found = summaries.find(s => s.id === session.id)
+      expect(found).toBeDefined()
+      expect(found!.owner_type).toBe('team')
+      expect(found!.owner_id).toBe(teamId)
+    })
+  })
+})