@sixb/core 0.1.19 → 0.1.21

package/src/testing/auth-storage-contract.ts

@@ -24,12 +24,10 @@ function at(value: string): Date {
 function sessionInput(
   id: string,
   tokenHash = `${id}-hash`,
-  audience: CompleteAuthSessionInput["audience"] = "atlas",
   absoluteExpiresAt?: Date
 ): CompleteAuthSessionInput {
   return {
     id,
-    audience,
     tokenHash,
     createdAt: at("2026-05-14T10:10:00.000Z"),
     expiresAt: at("2026-05-21T10:10:00.000Z"),
@@ -43,7 +41,6 @@ function bearerSessionInput(id: string) {
     projectId,
     userId: "usr_1",
     strategyId: "magic-link",
-    audience: "atlas" as const,
     tokenHash: "access-1",
     createdAt: at("2026-05-14T10:00:00.000Z"),
     expiresAt: at("2026-06-14T10:00:00.000Z"),
@@ -89,7 +86,6 @@ async function completeOidcSignInForAva(
     id: "oidc_directory",
     projectId,
     strategyId: "entra",
-    audience: "atlas",
     stateHash: "directory-state",
     nonceHash: "nonce-hash",
     codeVerifier: "verifier",
@@ -201,7 +197,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -211,13 +206,12 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-2",
           createdAt: at("2026-05-14T10:05:00.000Z"),
           expiresAt: at("2026-05-21T10:05:00.000Z"),
         })
 
-        // Creating a second session in the same audience no longer revokes the
+        // Creating a second session no longer revokes the
         // first: both stay active and authenticate independently.
         expect(first.revokedAt).toBeUndefined()
         expect(second.revokedAt).toBeUndefined()
@@ -228,7 +222,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_1",
-            audience: "atlas",
             tokenHash: "hash-1",
             now: at("2026-05-14T10:06:00.000Z"),
           })
@@ -237,7 +230,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "hash-2",
             now: at("2026-05-14T10:06:00.000Z"),
           })
@@ -246,22 +238,11 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "wrong",
             now: at("2026-05-14T10:06:00.000Z"),
           })
         ).resolves.toBeNull()
 
-        // getActiveByUserId returns the most recently created active session.
-        await expect(
-          storage.sessions.getActiveByUserId({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            now: at("2026-05-14T10:06:00.000Z"),
-          })
-        ).resolves.toMatchObject({ id: "ses_2" })
-
         const touched = await storage.sessions.touch({
           projectId,
           id: second.id,
@@ -270,28 +251,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         expect(touched.lastSeenAt?.toISOString()).toBe("2026-05-15T10:00:00.000Z")
         expect(touched.expiresAt.toISOString()).toBe("2026-05-21T10:05:00.000Z")
 
-        // A session in a different audience coexists and is cookie-scoped.
-        const appSession = await storage.sessions.create({
-          id: "ses_app",
-          projectId,
-          userId: "usr_1",
-          strategyId: "magic-link",
-          audience: "app",
-          tokenHash: "hash-app",
-          createdAt: at("2026-05-14T10:06:00.000Z"),
-          expiresAt: at("2026-05-21T10:06:00.000Z"),
-        })
-        expect(appSession.revokedAt).toBeUndefined()
-        await expect(
-          storage.sessions.findValidByTokenHash({
-            projectId,
-            id: "ses_app",
-            audience: "atlas",
-            tokenHash: "hash-app",
-            now: at("2026-05-14T10:07:00.000Z"),
-          })
-        ).resolves.toBeNull()
-
         // Revoking a single session leaves the user's other sessions active.
         await storage.sessions.revoke({
           projectId,
@@ -302,7 +261,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_1",
-            audience: "atlas",
             tokenHash: "hash-1",
             now: at("2026-05-14T10:09:00.000Z"),
           })
@@ -311,28 +269,73 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "hash-2",
             now: at("2026-05-14T10:09:00.000Z"),
           })
         ).resolves.toMatchObject({ id: "ses_2" })
 
         // "Sign out everywhere": revokeActiveForUser clears every remaining
-        // active session for the user, across audiences.
+        // active session for the user.
         const revoked = await storage.sessions.revokeActiveForUser({
           projectId,
           userId: "usr_1",
           revokedAt: at("2026-05-14T10:10:00.000Z"),
         })
-        expect(revoked.map((entry) => entry.id).sort()).toEqual(["ses_2", "ses_app"])
+        expect(revoked.map((entry) => entry.id).sort()).toEqual(["ses_2"])
         await expect(
-          storage.sessions.getActiveByUserId({
+          storage.sessions.listActiveByUserId({
             projectId,
             userId: "usr_1",
-            audience: "atlas",
             now: at("2026-05-14T10:11:00.000Z"),
           })
-        ).resolves.toBeNull()
+        ).resolves.toEqual([])
+      })
+    })
+
+    test("lists all of a user's sessions, revoked and expired ones too, newest first", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await createUser(storage, { id: "usr_2", email: "ben@acme.com" })
+
+        const session = (id: string, createdAt: string, userId = "usr_1") =>
+          storage.sessions.create({
+            id,
+            projectId,
+            userId,
+            strategyId: "magic-link",
+            tokenHash: `hash-${id}`,
+            createdAt: at(createdAt),
+            expiresAt: at("2026-05-15T10:00:00.000Z"),
+          })
+
+        await session("ses_oldest", "2026-05-14T10:00:00.000Z")
+        await session("ses_revoked", "2026-05-14T10:01:00.000Z")
+        // Created at the same instant as the one above: the cursor skips within the tie.
+        await session("ses_also", "2026-05-14T10:01:00.000Z")
+        await session("ses_newest", "2026-05-14T10:02:00.000Z")
+        await session("ses_other", "2026-05-14T10:03:00.000Z", "usr_2")
+        await storage.sessions.revoke({
+          projectId,
+          id: "ses_revoked",
+          revokedAt: at("2026-05-14T10:05:00.000Z"),
+        })
+
+        const first = await storage.sessions.listByUserId({ projectId, userId: "usr_1", limit: 2 })
+        expect(first.hasMore).toBe(true)
+        expect(first.sessions.map((entry) => entry.id)).toEqual(["ses_newest", "ses_revoked"])
+        expect(first.sessions[1]?.revokedAt?.toISOString()).toBe("2026-05-14T10:05:00.000Z")
+
+        const rest = await storage.sessions.listByUserId({
+          projectId,
+          userId: "usr_1",
+          limit: 2,
+          before: { createdAt: at("2026-05-14T10:01:00.000Z"), skip: 1 },
+        })
+        expect(rest.hasMore).toBe(false)
+        expect(rest.sessions.map((entry) => entry.id)).toEqual(["ses_also", "ses_oldest"])
+        await expect(
+          storage.sessions.listByUserId({ projectId: otherProjectId, userId: "usr_1", limit: 2 })
+        ).resolves.toEqual({ sessions: [], hasMore: false })
       })
     })
 
@@ -344,7 +347,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-capped",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -355,7 +357,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-uncapped",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -367,7 +368,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: capped.id,
-            audience: "atlas",
             tokenHash: "hash-capped",
             now: at("2026-05-16T09:59:59.999Z"),
           })
@@ -376,7 +376,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: capped.id,
-            audience: "atlas",
             tokenHash: "hash-capped",
             now: at("2026-05-16T10:00:00.000Z"),
           })
@@ -387,22 +386,13 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           now: at("2026-05-16T10:00:00.000Z"),
         })
         expect(active.map((session) => session.id)).toEqual([uncapped.id])
-        await expect(
-          storage.sessions.getActiveByUserId({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            now: at("2026-05-16T10:00:00.000Z"),
-          })
-        ).resolves.toBeNull()
-        await expect(
-          storage.sessions.revokeActiveForUser({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            revokedAt: at("2026-05-16T10:00:00.000Z"),
-          })
-        ).resolves.toEqual([])
+        // A session past its absolute deadline is no longer active, so there is nothing to revoke.
+        const revoked = await storage.sessions.revokeActiveForUser({
+          projectId,
+          userId: "usr_1",
+          revokedAt: at("2026-05-16T10:00:00.000Z"),
+        })
+        expect(revoked.map((session) => session.id)).toEqual([uncapped.id])
       })
     })
 
@@ -414,7 +404,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-renew",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-15T10:00:00.000Z"),
@@ -424,7 +413,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         const renewed = await storage.sessions.renewIfValid({
           projectId,
           id: "ses_renew",
-          audience: "atlas",
           tokenHash: "hash-renew",
           now: at("2026-05-14T11:00:00.000Z"),
           expiresAt: at("2026-05-25T10:00:00.000Z"),
@@ -435,7 +423,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         const monotonic = await storage.sessions.renewIfValid({
           projectId,
           id: "ses_renew",
-          audience: "atlas",
           tokenHash: "hash-renew",
           now: at("2026-05-14T12:00:00.000Z"),
           expiresAt: at("2026-05-18T10:00:00.000Z"),
@@ -446,7 +433,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_renew",
-            audience: "atlas",
             tokenHash: "wrong-hash",
             now: at("2026-05-14T13:00:00.000Z"),
             expiresAt: at("2026-05-19T10:00:00.000Z"),
@@ -456,7 +442,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_renew",
-            audience: "atlas",
             tokenHash: "hash-renew",
             now: at("2026-05-20T10:00:00.000Z"),
             expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -468,7 +453,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-concurrent",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-15T10:00:00.000Z"),
@@ -477,7 +461,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_concurrent",
-            audience: "atlas",
             tokenHash: "hash-concurrent",
             now: at("2026-05-14T11:00:00.000Z"),
             expiresAt: at("2026-05-18T10:00:00.000Z"),
@@ -485,7 +468,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_concurrent",
-            audience: "atlas",
             tokenHash: "hash-concurrent",
             now: at("2026-05-14T11:00:00.000Z"),
             expiresAt: at("2026-05-19T10:00:00.000Z"),
@@ -505,7 +487,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-device",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -527,7 +508,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-plain",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -537,7 +517,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("lists a user's active sessions across audiences, newest activity first", async () => {
+    test("lists a user's active sessions, newest activity first", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)
 
@@ -546,7 +526,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-a",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -556,7 +535,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-b",
           createdAt: at("2026-05-14T10:05:00.000Z"),
           expiresAt: at("2026-05-21T10:05:00.000Z"),
@@ -568,7 +546,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-revoked",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -586,7 +563,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_2",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-other",
           createdAt: at("2026-05-14T10:03:00.000Z"),
           expiresAt: at("2026-05-21T10:03:00.000Z"),
@@ -984,7 +960,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_creator",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-creator",
           createdAt: at("2026-05-14T10:00:30.000Z"),
           expiresAt: at("2026-05-21T10:00:30.000Z"),
@@ -1251,7 +1226,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
@@ -1261,7 +1235,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_2",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: " ava@acme.com ",
           tokenHash: "hash-2",
           returnTo: "/dashboard",
@@ -1290,7 +1263,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             consumedAt: at("2026-05-14T10:02:00.000Z"),
           })
         ).resolves.toMatchObject({
-          audience: "atlas",
           returnTo: "/dashboard",
           consumedAt: at("2026-05-14T10:02:00.000Z"),
         })
@@ -1312,7 +1284,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1338,7 +1309,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             consumedAt: at("2026-05-14T10:01:00.000Z"),
           })
         ).resolves.toMatchObject({
-          audience: "atlas",
           codeVerifier: "verifier",
           consumedAt: at("2026-05-14T10:01:00.000Z"),
         })
@@ -1362,7 +1332,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "session-hash",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1433,7 +1402,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_cli",
-            audience: "atlas",
             tokenHash: "access-1",
             now,
           })
@@ -1524,7 +1492,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "old-hash",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1533,7 +1500,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1546,7 +1512,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           tokenHash: "link-hash",
           completedAt: at("2026-05-14T10:02:00.000Z"),
           newUserId: "usr_unused",
-          session: sessionInput("ses_new", "session-hash", "atlas", at("2026-06-21T10:10:00.000Z")),
+          session: sessionInput("ses_new", "session-hash", at("2026-06-21T10:10:00.000Z")),
         })
 
         expect(result.user.id).toBe("usr_1")
@@ -1588,7 +1554,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:02:00.000Z"),
@@ -1643,7 +1608,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:02:00.000Z"),
@@ -1683,7 +1647,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1721,7 +1684,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "founder@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1756,7 +1718,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1795,7 +1756,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1834,7 +1794,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1873,7 +1832,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1919,7 +1877,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1952,7 +1909,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_bootstrap",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "bootstrap-state",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -2057,7 +2013,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -2067,7 +2022,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-app",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),