@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.44.17

package/__tests__/server-step-chain.test.ts

@@ -0,0 +1,222 @@
+import { generateServerSegmentAPIRoute } from '../src'
+import { splitIntoSegments } from '../src/segment-splitter'
+import { buildSegmentTrust } from '../src/segment-trust'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+
+// A run of server segments is ONE chain: every reply signs the results the
+// caller may hand on, and a later call accepts a relayed result only with the
+// very signature its link lists. A crafted client that calls a segment twice in
+// one run (a cheap cart and a big one, a refused payment method and an
+// accepted one) can continue either fork, never a mix of the two — which used
+// to reach an underpriced or unpaid "settled" order (Task 4 review, X1).
+
+type Context = Record<string, any>
+
+const runtime = loadServerRuntime()
+const savedSecret = process.env.NEXTAUTH_SECRET
+beforeAll(() => {
+  process.env.NEXTAUTH_SECRET = 'step-chain-test-secret'
+})
+afterAll(() => {
+  if (savedSecret === undefined) {
+    delete process.env.NEXTAUTH_SECRET
+  } else {
+    process.env.NEXTAUTH_SECRET = savedSecret
+  }
+})
+
+const script = (body: string) => `function customHandler(params) { ${body} }`
+const server = (
+  id: string,
+  stepNumber: number,
+  body: string,
+  params?: Record<string, unknown>
+) => ({
+  id,
+  type: 'general-custom-js',
+  label: id,
+  stepNumber,
+  config: { context: 'server', code: script(body), ...(params ? { params } : {}) },
+})
+const browser = (id: string, stepNumber: number) => ({
+  id,
+  type: 'state-update-local-state',
+  label: id,
+  stepNumber,
+  config: { property: id, value: true },
+})
+const ref = (nodeId: string, ...path: string[]) => ({
+  type: 'workflowContext',
+  nodeId,
+  path: [nodeId, ...path],
+})
+const named = 'var named = params[params.length - 1] || {};'
+
+function bootWorkflow(id: string, nodes: any[]) {
+  const edges = nodes
+    .slice(1)
+    .map((node, i) => ({ id: `e${i}`, source: nodes[i].id, target: node.id }))
+  const workflow = { id, nodes, edges, trigger: { type: 'event-element-clicked' } } as any
+  const segments = splitIntoSegments(workflow)
+  const routes: Record<string, (context: Context) => Promise<{ status: number; body: any }>> = {}
+  for (const segment of segments.filter((s) => s.env === 'server') as WorkflowSegment[]) {
+    const source = generateServerSegmentAPIRoute(segment, id, undefined, {
+      trust: buildSegmentTrust(segment, { id, nodes, edges, segments }),
+    })
+    const routeModule: { exports: any } = { exports: {} }
+    const requireStub = (name: string) => (name.endsWith('server-runtime') ? runtime : {})
+    // eslint-disable-next-line @typescript-eslint/no-implied-eval
+    new Function('module', 'exports', 'require', source)(
+      routeModule,
+      routeModule.exports,
+      requireStub
+    )
+    routes[segment.nodes[0].id] = async (context: Context) => {
+      const reply = { status: 0, body: null as any }
+      const res = {
+        setHeader: (): undefined => undefined,
+        status(code: number) {
+          reply.status = code
+          return this
+        },
+        json(payload: unknown) {
+          reply.body = payload
+          return this
+        },
+      }
+      await routeModule.exports(
+        {
+          method: 'POST',
+          body: { context: JSON.parse(JSON.stringify(context)) },
+          headers: { host: 'shop.test' },
+        },
+        res
+      )
+      return reply
+    }
+  }
+  return routes
+}
+
+const merge = (context: Context, results: Context = {}): Context => ({ ...context, ...results })
+
+describe('the reviewer probe: one segment called twice in a run', () => {
+  // open → (browser) → price → (browser) → use
+  const routes = bootWorkflow('wf-mix', [
+    server('open', 1, 'return { opened: true }'),
+    browser('cart', 2),
+    server('price', 3, `${named} return { value: named.cart }`, { cart: ref('trigger', 'cart') }),
+    browser('gap', 4),
+    server('use', 5, `${named} return { used: named.value }`, { value: ref('price', 'value') }),
+  ])
+
+  it('lets a later step continue one fork, never a mix of two', async () => {
+    const opened = merge({}, (await routes.open({})).body.results)
+    const cheap = merge(
+      merge(opened, { trigger: { cart: 'CHEAP' }, cart: {} }),
+      (await routes.price(merge(opened, { trigger: { cart: 'CHEAP' }, cart: {} }))).body.results
+    )
+    const big = merge(
+      merge(opened, { trigger: { cart: 'BIG' }, cart: {} }),
+      (await routes.price(merge(opened, { trigger: { cart: 'BIG' }, cart: {} }))).body.results
+    )
+    expect(cheap.__sigRun.id).toBe(big.__sigRun.id)
+
+    // The crafted client continues the CHEAP fork with the BIG result and its signature.
+    const crafted = {
+      ...cheap,
+      gap: {},
+      price: big.price,
+      __sig: { ...cheap.__sig, price: big.__sig.price },
+    }
+    const mixed = await routes.use(crafted)
+    expect(mixed.status).toBe(200)
+    expect(mixed.body.results.use).toEqual({})
+    expect(JSON.stringify(mixed.body.results)).not.toContain('BIG')
+
+    // Each fork, continued whole, is a run of its own.
+    expect((await routes.use({ ...cheap, gap: {} })).body.results.use).toEqual({ used: 'CHEAP' })
+    expect((await routes.use({ ...big, gap: {} })).body.results.use).toEqual({ used: 'BIG' })
+  })
+
+  it('also refuses the BIG result presented under the CHEAP link with its own order', async () => {
+    const opened = merge({}, (await routes.open({})).body.results)
+    const ask = (cart: string) => merge(opened, { trigger: { cart }, cart: {} })
+    const cheap = merge(ask('CHEAP'), (await routes.price(ask('CHEAP'))).body.results)
+    const big = merge(ask('BIG'), (await routes.price(ask('BIG'))).body.results)
+    // BIG's link over CHEAP's value: the value no longer matches the listed signature.
+    const crafted = { ...cheap, gap: {}, __sigOrder: big.__sigOrder, __sig: big.__sig }
+    expect((await routes.use(crafted)).body.results.use).toEqual({})
+  })
+})
+
+describe('the checkout shape: pricing called twice', () => {
+  // price → (browser) → assemble → (browser) → settle. The assemble refuses an
+  // order without a priced result; settle writes the priced lines and settles
+  // what the assemble said needs no payment.
+  const routes = bootWorkflow('wf-checkout', [
+    server('form', 1, 'return { ok: true }'),
+    browser('method', 2),
+    server(
+      'price',
+      3,
+      `${named} return named.method === 'stripe' ? { priced: true, total: 90, lines: ['TV'] } : { priced: false, total: 0, lines: [] }`,
+      { method: ref('trigger', 'method') }
+    ),
+    browser('review', 4),
+    server(
+      'assemble',
+      5,
+      `${named} var p = named.price || {}; if (p.priced !== true && p.total !== 0) { return { refused: true } } ` +
+        `if (!p.lines) { return { refused: true } } return { refused: false, total: p.total, requiresPayment: p.total > 0 }`,
+      { price: ref('price') }
+    ),
+    browser('confirm', 6),
+    server(
+      'settle',
+      7,
+      `${named} var p = named.price || {}; var a = named.assemble || {}; ` +
+        `return { items: p.lines || [], settled: a.requiresPayment === false }`,
+      { price: ref('price'), assemble: ref('assemble') }
+    ),
+  ])
+
+  it('refuses to assemble or settle from two pricing calls of one run', async () => {
+    const formed = merge({}, (await routes.form({})).body.results)
+    const ask = (method: string) => merge(formed, { trigger: { method }, method: {} })
+    const refused = merge(
+      ask('cash_on_delivery'),
+      (await routes.price(ask('cash_on_delivery'))).body.results
+    )
+    const accepted = merge(ask('stripe'), (await routes.price(ask('stripe'))).body.results)
+    expect(refused.price).toMatchObject({ priced: false })
+    expect(accepted.price).toMatchObject({ priced: true })
+
+    // The assemble is handed the accepted price under the refused call's link.
+    const assembleMix = await routes.assemble({
+      ...refused,
+      review: {},
+      price: accepted.price,
+      __sig: { ...refused.__sig, price: accepted.__sig.price },
+    })
+    expect(assembleMix.body.results.assemble).toEqual({ refused: true })
+
+    // The honest refused fork assembles a 0-total order...
+    const afterRefused = merge(
+      { ...refused, review: {} },
+      (await routes.assemble({ ...refused, review: {} })).body.results
+    )
+    expect(afterRefused.assemble).toMatchObject({ requiresPayment: false })
+    // ...and settle, handed the accepted call's lines under that fork's link,
+    // never sees them: it settles the refused fork's empty order, no goods.
+    const settleMix = await routes.settle({
+      ...afterRefused,
+      confirm: {},
+      price: accepted.price,
+      __sig: { ...afterRefused.__sig, price: accepted.__sig.price },
+    })
+    expect(settleMix.body.results.settle.items).toEqual([])
+    expect(JSON.stringify(settleMix.body.results)).not.toContain('TV')
+  })
+})

package/__tests__/server-step-signing.test.ts

@@ -3,6 +3,7 @@ import { splitIntoSegments } from '../src/segment-splitter'
 import { buildSegmentTrust } from '../src/segment-trust'
 import type { WorkflowSegment } from '../src/types'
 import { loadServerRuntime } from './_helpers/load-server-runtime'
+import { STEP_EXPIRED_MESSAGE } from '../src/server-runtime-code'
 
 // The results of every server segment reach the next one through the caller
 // (the browser relays them), so each segment signs what it produced and the
@@ -90,9 +91,14 @@ const workflow = {
 const segments = splitIntoSegments(workflow)
 const serverSegments = segments.filter((s) => s.env === 'server')
 
-function bootRoute(segment: WorkflowSegment) {
+function bootRoute(segment: WorkflowSegment, graphId?: string) {
   const source = generateServerSegmentAPIRoute(segment, 'Signing', undefined, {
-    trust: buildSegmentTrust(segment, { nodes: workflow.nodes, edges: workflow.edges, segments }),
+    trust: buildSegmentTrust(segment, {
+      id: graphId,
+      nodes: workflow.nodes,
+      edges: workflow.edges,
+      segments,
+    }),
   })
   const routeModule: { exports: unknown } = { exports: {} }
   const requireStub = (id: string) => (id.endsWith('server-runtime') ? runtime : {})
@@ -212,6 +218,81 @@ describe('signed hand-off between server segments', () => {
   })
 })
 
+describe('signatures belong to one run of one workflow, for ten minutes', () => {
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('opens a new run at the first server segment, whatever run the request names', async () => {
+    const { afterGuard } = await honestRun('good')
+    const again = await guardRoute(afterGuard)
+    expect((again.body.results?.__sigRun as { id: string }).id).not.toBe(
+      (afterGuard.__sigRun as { id: string }).id
+    )
+  })
+
+  it('refuses the results of one run handed on under another run', async () => {
+    const { afterGuard: runA } = await honestRun('good')
+    const { afterGuard: runB } = await honestRun('bad')
+    // A's passed guard, presented as part of run B.
+    const reply = await writeRoute({ ...runA, __sigRun: runB.__sigRun, ui: {} })
+    expect(reply.body.results?.write).toBeUndefined()
+    // B's own run, with A's verdict and signatures spliced in.
+    const spliced = await writeRoute({
+      ...runB,
+      check: runA.check,
+      gate: runA.gate,
+      __sig: runA.__sig,
+      ui: {},
+    })
+    expect(spliced.body.results?.write).toBeUndefined()
+  })
+
+  it('refuses a run the request made up', async () => {
+    const { afterGuard } = await honestRun('good')
+    const forgedRun = { id: 'a'.repeat(32), mac: (afterGuard.__sigRun as { mac: string }).mac }
+    const reply = await writeRoute({ ...afterGuard, __sigRun: forgedRun, ui: {} })
+    expect(reply.body.results?.write).toBeUndefined()
+  })
+
+  it('takes a result up to ten minutes old and refuses it after', async () => {
+    const start = Date.now()
+    const { afterGuard } = await honestRun('good')
+    const later = (ms: number) => jest.spyOn(Date, 'now').mockReturnValue(start + ms)
+
+    later(9 * 60 * 1000)
+    const fresh = await writeRoute({ ...afterGuard, ui: {} })
+    expect(fresh.body.results?.write).toEqual({ wrote: 'owner@shop.test' })
+
+    later(10 * 60 * 1000 + 1000)
+    const stale = await writeRoute({ ...afterGuard, ui: {} })
+    expect(stale.body.results?.write).toBeUndefined()
+    // Said, not silent: the visitor is told to start again.
+    expect(stale.status).toBe(409)
+    expect(stale.body).toMatchObject({ error: STEP_EXPIRED_MESSAGE })
+  })
+
+  it('refuses a signature dated more than a minute ahead of the route, and takes clock skew below it', async () => {
+    const start = Date.now()
+    const { afterGuard } = await honestRun('good')
+    jest.spyOn(Date, 'now').mockReturnValue(start - 30 * 1000)
+    expect((await writeRoute({ ...afterGuard, ui: {} })).body.results?.write).toEqual({
+      wrote: 'owner@shop.test',
+    })
+    jest.spyOn(Date, 'now').mockReturnValue(start - 2 * 60 * 1000)
+    const ahead = await writeRoute({ ...afterGuard, ui: {} })
+    expect(ahead.status).toBe(409)
+    expect(ahead.body.results?.write).toBeUndefined()
+  })
+
+  it('refuses a result another workflow signed for the same node ids', async () => {
+    const { afterGuard } = await honestRun('good')
+    const otherWorkflowWrite = bootRoute(serverSegments[1], 'another-workflow')
+    const reply = await otherWorkflowWrite({ ...afterGuard, ui: {} })
+    expect(reply.body.results?.write).toBeUndefined()
+  })
+})
+
 describe('claimSegmentContext — what a request cannot carry', () => {
   const plainConfig = {
     nodes: [{ id: 'n', type: 'general-custom-js' }],
@@ -219,6 +300,12 @@ describe('claimSegmentContext — what a request cannot carry', () => {
     entryNodeIds: ['n'],
   }
 
+  it('drops a request-supplied __request (the route sets its own)', () => {
+    const context: Context = { __request: { ip: '10.0.0.1', headers: { 'x-forged': '1' } } }
+    runtime.claimSegmentContext(plainConfig, context)
+    expect(context.__request).toBeUndefined()
+  })
+
   it('drops custom-node bookkeeping outside a custom node segment', () => {
     const context: Context = {
       __isInsideCustomNode: true,
@@ -344,6 +431,24 @@ describe('trustedBaseUrl', () => {
   const env = process.env
   afterEach(() => {
     process.env = env
+    delete (globalThis as Record<string, unknown>).__tqConfiguredNextAuthUrl
+  })
+
+  it('reads NEXTAUTH_URL as configured, never as the auth route rewrote it from a request', () => {
+    const scope = globalThis as Record<string, unknown>
+    // /api/auth keeps the configured value, then rewrites the live one from X-Forwarded-Host.
+    process.env = { ...env, NEXTAUTH_URL: 'https://evil.example', VERCEL: '' }
+    scope.__tqConfiguredNextAuthUrl = 'https://shop.example'
+    expect(runtime.trustedBaseUrl({ headers: { host: 'evil.example' } })).toBe(
+      'https://shop.example'
+    )
+    scope.__tqConfiguredNextAuthUrl = 'http://localhost:3000'
+    expect(runtime.trustedBaseUrl({ headers: { host: 'evil.example' } })).toBe(
+      'http://localhost:3000'
+    )
+    expect(runtime.trustedBaseUrl({ headers: { host: 'localhost:3001' } })).toBe(
+      'http://localhost:3001'
+    )
   })
 
   it('never calls a host the request named when the canonical origin is configured', () => {

package/__tests__/session-cookie-resolver.test.ts

@@ -182,10 +182,13 @@ describe('the emitted session-cookie resolver', () => {
   })
 
   describe('__tqSessionTokenCandidates', () => {
-    it('names the secure cookie the https request is actually carrying', () => {
+    it('names the __Host- cookie on an https request', () => {
       expect(
-        resolver.__tqSessionTokenCandidates(httpsReq('__Secure-next-auth.session-token=abc'))
-      ).toEqual([{ cookieName: '__Secure-next-auth.session-token', secureCookie: true }])
+        resolver.__tqSessionTokenCandidates(httpsReq('__Host-next-auth.session-token=abc'))
+      ).toEqual([{ cookieName: '__Host-next-auth.session-token', secureCookie: true }])
+      expect(
+        resolver.__tqSessionTokenCandidates(httpsReq('__Host-next-auth.session-token.0=abc'))
+      ).toEqual([{ cookieName: '__Host-next-auth.session-token', secureCookie: true }])
     })
 
     it('names the plain cookie on a local http request', () => {
@@ -196,51 +199,51 @@ describe('the emitted session-cookie resolver', () => {
       ).toEqual([{ cookieName: 'next-auth.session-token', secureCookie: false }])
     })
 
-    it('tries the protocol-matching cookie FIRST when a site carries both', () => {
-      const both = httpsReq('next-auth.session-token=old; __Secure-next-auth.session-token=new')
-      expect(resolver.__tqSessionTokenCandidates(both)[0]).toEqual({
-        cookieName: '__Secure-next-auth.session-token',
-        secureCookie: true,
-      })
+    it('COOKIE TOSSING: never takes another name for a session on https', () => {
+      // A sibling site on the shared parent domain can set any of these for it.
+      for (const planted of [
+        '__Secure-next-auth.session-token=evil',
+        'next-auth.session-token=evil',
+        '__Secure-authjs.session-token=evil',
+        'authjs.session-token=evil',
+      ]) {
+        expect(resolver.__tqSessionTokenCandidates(httpsReq(planted))).toEqual([])
+      }
+      expect(
+        resolver.__tqSessionTokenCandidates(
+          httpsReq('next-auth.session-token=evil; __Host-next-auth.session-token=mine')
+        )
+      ).toEqual([{ cookieName: '__Host-next-auth.session-token', secureCookie: true }])
     })
 
-    it('recognises the Auth.js cookie names too', () => {
-      expect(
-        resolver.__tqSessionTokenCandidates(httpsReq('__Secure-authjs.session-token=abc'))
-      ).toEqual([{ cookieName: '__Secure-authjs.session-token', secureCookie: true }])
+    it('treats a non-local host without a proto header as https, like the auth route does', () => {
+      const req = { headers: { host: 'shop.teleporthq.app', cookie: 'next-auth.session-token=x' } }
+      expect(resolver.__tqRequestIsSecure(req)).toBe(true)
+      expect(resolver.__tqSessionTokenCandidates(req)).toEqual([])
+      expect(resolver.__tqRequestIsSecure({ headers: { host: 'localhost:3000' } })).toBe(false)
     })
 
-    it('falls back to the request protocol when no known cookie is present', () => {
-      // A project may configure a custom cookie name in authOptions; letting
-      // getToken apply its own defaults is the only correct answer there — but
-      // with the REQUEST's protocol, not a localhost env var.
-      expect(resolver.__tqSessionTokenCandidates(httpsReq('unrelated=1'))).toEqual([
-        { secureCookie: true },
-      ])
-      expect(resolver.__tqSessionTokenCandidates({ headers: {} })).toEqual([
-        { secureCookie: false },
-      ])
+    it('names nothing when no session cookie is present', () => {
+      expect(resolver.__tqSessionTokenCandidates(httpsReq('unrelated=1'))).toEqual([])
+      expect(resolver.__tqSessionTokenCandidates({ headers: {} })).toEqual([])
     })
   })
 
   describe('__tqResolveSessionToken', () => {
     it('THE DEFECT: resolves the session that the env-derived default would miss', async () => {
-      // Exactly the deployed setup: browser holds the secure cookie, the lambda
-      // holds NEXTAUTH_URL=http://localhost:3000 so next-auth's own default is
-      // the plain name.
+      // The lambda holds NEXTAUTH_URL=http://localhost:3000, so next-auth's own
+      // default is the plain name; the browser holds the __Host- cookie.
       const getToken = realisticGetToken('next-auth.session-token')
-      const req = httpsReq('__Secure-next-auth.session-token=abc')
+      const req = httpsReq('__Host-next-auth.session-token=abc')
 
-      // What the old code did — one call, no cookieName — still returns null…
       expect(await getToken({ req } as never)).toBeNull()
-      // …and the resolver finds the session.
       expect(await resolver.__tqResolveSessionToken(getToken, req, 'secret')).toEqual({
         id: 'user-1',
         sub: 'user-1',
       })
     })
 
-    it('still resolves on plain http, where the old default happened to be right', async () => {
+    it('still resolves on plain http', async () => {
       const getToken = realisticGetToken('next-auth.session-token')
       const req = { headers: { cookie: 'next-auth.session-token=abc' } }
       expect(await resolver.__tqResolveSessionToken(getToken, req, 'secret')).toEqual({
@@ -254,79 +257,34 @@ describe('the emitted session-cookie resolver', () => {
       expect(await resolver.__tqResolveSessionToken(getToken, httpsReq(''), 'secret')).toBeNull()
     })
 
-    it('tries the other cookie when the first candidate does not decode', async () => {
-      // A site reached over both protocols: the stale plain cookie is present
-      // but only the secure one decodes.
-      const getToken = realisticGetToken('next-auth.session-token')
-      const req = {
-        headers: {
-          cookie: 'next-auth.session-token=stale; __Secure-next-auth.session-token=live',
-          'x-forwarded-proto': 'http',
-        },
+    it('COOKIE TOSSING: a planted cookie of the old name is never decoded on https', async () => {
+      const getToken = jest.fn(async () => ({ id: 'attacker' }))
+      for (const planted of [
+        '__Secure-next-auth.session-token=evil',
+        'next-auth.session-token=evil',
+      ]) {
+        expect(
+          await resolver.__tqResolveSessionToken(getToken, httpsReq(planted), 'secret')
+        ).toBeNull()
       }
-      expect(await resolver.__tqResolveSessionToken(getToken, req, 'secret')).toEqual({
-        id: 'user-1',
-        sub: 'user-1',
-      })
+      expect(getToken).not.toHaveBeenCalled()
     })
 
-    it('THE ROLE DEFECT: when both cookies decode, the most recently issued one wins over the protocol order', async () => {
-      // A local dev server whose NextAuth ran under an https origin for a while
-      // (a tunnel request had rewritten NEXTAUTH_URL) left the browser with
-      // both cookies: the plain one frozen when the account was still a
-      // "user", the "__Secure-" one re-issued on every session read since the
-      // promotion. The request is plain http, so the plain cookie is tried
-      // first — and used to be returned.
-      const tokens: Record<string, { email: string; role: string; iat: number }> = {
-        'next-auth.session-token': { email: 'a@shop.test', role: 'user', iat: 1790000000 },
-        '__Secure-next-auth.session-token': {
-          email: 'a@shop.test',
-          role: 'admin',
-          iat: 1790336037,
-        },
-      }
-      const getToken = jest.fn(async (params: { cookieName?: string }) =>
-        params.cookieName ? tokens[params.cookieName] || null : null
+    it('asks getToken for exactly the __Host- cookie', async () => {
+      const getToken = jest.fn(async () => ({ id: 'u1' }))
+      await resolver.__tqResolveSessionToken(
+        getToken,
+        httpsReq('__Host-next-auth.session-token=b'),
+        'secret'
       )
-      const req = {
-        headers: {
-          cookie: 'next-auth.session-token=old; __Secure-next-auth.session-token=live',
-        },
-      }
-      expect(resolver.__tqSessionTokenCandidates(req)[0].cookieName).toBe('next-auth.session-token')
-
-      const token = (await resolver.__tqResolveSessionToken(getToken, req, 'secret')) as {
-        role: string
-      }
-      expect(token.role).toBe('admin')
-      expect(getToken).toHaveBeenCalledTimes(2)
-
-      // And the other way round: the plain cookie is the live one.
-      tokens['next-auth.session-token'].iat = 1790400000
-      const again = (await resolver.__tqResolveSessionToken(getToken, req, 'secret')) as {
-        role: string
-      }
-      expect(again.role).toBe('user')
-    })
-
-    it('keeps the protocol-matching cookie on a tie, and a token without iat still beats none', async () => {
-      const getToken = async (params: { cookieName?: string }) =>
-        params.cookieName === '__Secure-next-auth.session-token'
-          ? { id: 'secure', iat: 5 }
-          : params.cookieName === 'next-auth.session-token'
-          ? { id: 'plain', iat: 5 }
-          : null
-      const both = httpsReq('next-auth.session-token=a; __Secure-next-auth.session-token=b')
-      expect(await resolver.__tqResolveSessionToken(getToken, both, 'secret')).toEqual({
-        id: 'secure',
-        iat: 5,
-      })
-
-      const noIat = async (params: { cookieName?: string }) =>
-        params.cookieName === 'next-auth.session-token' ? { id: 'plain' } : null
-      expect(await resolver.__tqResolveSessionToken(noIat, both, 'secret')).toEqual({
-        id: 'plain',
-      })
+      expect(getToken).toHaveBeenCalledTimes(1)
+      expect(getToken.mock.calls[0]).toEqual([
+        expect.objectContaining({
+          cookieName: '__Host-next-auth.session-token',
+          secureCookie: true,
+          secret: 'secret',
+        }),
+      ])
     })
 
     it('returns null rather than throwing when getToken throws', async () => {
@@ -336,7 +294,7 @@ describe('the emitted session-cookie resolver', () => {
       await expect(
         resolver.__tqResolveSessionToken(
           throwing,
-          httpsReq('__Secure-next-auth.session-token=a'),
+          httpsReq('__Host-next-auth.session-token=a'),
           'secret'
         )
       ).resolves.toBeNull()
@@ -354,12 +312,12 @@ describe('the emitted session-cookie resolver', () => {
   })
 
   describe('the CommonJS wrapper', () => {
-    it('reads NEXTAUTH_SECRET itself and resolves the secure cookie', async () => {
+    it('reads NEXTAUTH_SECRET itself and resolves the __Host- cookie', async () => {
       const cjs = bootCommonJsResolver({
         secret: 'server-secret',
         getToken: realisticGetToken('next-auth.session-token'),
       })
-      expect(await cjs.__tqSessionToken(httpsReq('__Secure-next-auth.session-token=abc'))).toEqual({
+      expect(await cjs.__tqSessionToken(httpsReq('__Host-next-auth.session-token=abc'))).toEqual({
         id: 'user-1',
         sub: 'user-1',
       })
@@ -369,15 +327,13 @@ describe('the emitted session-cookie resolver', () => {
       const cjs = bootCommonJsResolver({
         getToken: realisticGetToken('next-auth.session-token'),
       })
-      expect(
-        await cjs.__tqSessionToken(httpsReq('__Secure-next-auth.session-token=abc'))
-      ).toBeNull()
+      expect(await cjs.__tqSessionToken(httpsReq('__Host-next-auth.session-token=abc'))).toBeNull()
     })
 
     it('is null — not a crash — for a project generated without next-auth', async () => {
       const cjs = bootCommonJsResolver({ secret: 'server-secret', nextAuthPresent: false })
       await expect(
-        cjs.__tqSessionToken(httpsReq('__Secure-next-auth.session-token=abc'))
+        cjs.__tqSessionToken(httpsReq('__Host-next-auth.session-token=abc'))
       ).resolves.toBeNull()
     })
   })