@tuturuuu/utils 0.29.0 → 0.29.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.29.1](https://github.com/tutur3u/platform/compare/utils-v0.29.0...utils-v0.29.1) (2026-09-23)
+
+
+### Bug Fixes
+
+* **auth:** reuse completed session-bound challenges ([b63d510](https://github.com/tutur3u/platform/commit/b63d51046b427350d959137cf37058223e544788))
+* **mobile:** repair Live persistence and reuse session verification ([#5436](https://github.com/tutur3u/platform/issues/5436)) ([cb452e1](https://github.com/tutur3u/platform/commit/cb452e1908eab3db2dce9dfd1d57d721284a2e49))
+
 ## [0.29.0](https://github.com/tutur3u/platform/compare/utils-v0.28.0...utils-v0.29.0) (2026-09-20)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.39.0",
+    "@tuturuuu/internal-api": "0.40.0",
     "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",

package/src/abuse-protection/__tests__/reputation.test.ts

@@ -1,8 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mockRpc = vi.fn();
+const mockFrom = vi.fn();
 const mockCreateAdminClient = vi.fn(() => ({
   rpc: mockRpc,
+  from: mockFrom,
 }));
 
 vi.mock('@tuturuuu/supabase/next/server', () => ({
@@ -28,6 +30,111 @@ describe('adaptive abuse reputation', () => {
     mockRpc.mockResolvedValue({ data: [], error: null });
   });
 
+  it('binds native subjects to authenticated bearer credentials, never a raw token or an anonymous caller', () => {
+    const subjects = (token: string, userId?: string) =>
+      buildAbuseRiskSubjects({
+        headers: { authorization: `Bearer ${token}` },
+        userId,
+      });
+    expect(subjects('secret', 'caller')).toContainEqual(
+      expect.objectContaining({ subject_type: 'session' })
+    );
+    expect(JSON.stringify(subjects('secret', 'caller'))).not.toContain(
+      'secret'
+    );
+    expect(subjects('secret', 'caller')).not.toEqual(
+      subjects('rotated', 'caller')
+    );
+    expect(subjects('secret')).toEqual([]);
+  });
+
+  it.each([true, false])(
+    'reuses only a recent passed challenge for this authenticated session: %s',
+    async (passed) => {
+      const lookup = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        gt: vi.fn().mockReturnThis(),
+        gte: vi.fn().mockReturnThis(),
+        order: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: passed ? [{ id: 'proof' }] : [],
+          error: null,
+        }),
+      };
+      mockFrom.mockReturnValue(lookup);
+      const decision = await resolveAbuseRiskDecision({
+        authKind: 'session',
+        headers: {
+          authorization: 'Bearer session-token',
+          'user-agent': 'Dart/3.9 (dart:io)',
+        },
+        isRead: false,
+        method: 'POST',
+        route: '/tasks',
+        userId: 'caller',
+      });
+      expect(decision.tier).toBe(passed ? 'standard' : 'challenge_required');
+      expect(decision.trustMultiplier).toBe(1);
+      expect(lookup.eq).toHaveBeenCalledWith('user_id', 'caller');
+      expect(lookup.eq).toHaveBeenCalledWith(
+        'subject_key',
+        decision.subjects.find((subject) => subject.subject_type === 'session')
+          ?.subject_key
+      );
+      expect(lookup.eq).toHaveBeenCalledWith('status', 'passed');
+      expect(lookup.gt).toHaveBeenCalledWith(
+        'expires_at',
+        '2026-05-17T00:00:00.000Z'
+      );
+      expect(lookup.gte).toHaveBeenCalledWith(
+        'completed_at',
+        '2026-05-16T23:45:00.000Z'
+      );
+    }
+  );
+
+  it.each(['restricted', 'challenge_required'])(
+    'never overrides explicit server policy: %s',
+    async (tier) => {
+      mockRpc.mockResolvedValue({
+        data: [{ tier, trust_multiplier: 1, decision_source: 'override' }],
+        error: null,
+      });
+      const decision = await resolveAbuseRiskDecision({
+        authKind: 'session',
+        headers: {
+          authorization: 'Bearer session-token',
+          'user-agent': 'Dart/3.9 (dart:io)',
+        },
+        isRead: false,
+        method: 'POST',
+        route: '/tasks',
+        userId: 'caller',
+      });
+      expect(decision.tier).toBe(tier);
+      expect(mockFrom).not.toHaveBeenCalled();
+    }
+  );
+
+  it('fails closed when challenge storage is unavailable', async () => {
+    mockFrom.mockImplementation(() => {
+      throw new Error('offline');
+    });
+    const decision = await resolveAbuseRiskDecision({
+      authKind: 'session',
+      headers: {
+        authorization: 'Bearer session-token',
+        'user-agent': 'Dart/3.9 (dart:io)',
+      },
+      isRead: false,
+      method: 'POST',
+      route: '/tasks',
+      userId: 'caller',
+    });
+    expect(decision.tier).toBe('challenge_required');
+  });
+
   it('does not earn trust from old account and browser shape alone', async () => {
     const decision = await resolveAbuseRiskDecision({
       authKind: 'session',

package/src/abuse-protection/reputation.ts

@@ -192,6 +192,9 @@ function readHeader(
 function getSessionSubjectKey(
   headers: Headers | Map<string, string> | Record<string, string | null>
 ) {
+  const authorization = readHeader(headers, 'authorization');
+  const bearer = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+  if (bearer) return `session:${hashStableSubject(`bearer:${bearer}`)}`;
   const cookies = parseCookieHeader(readHeader(headers, 'cookie'));
   const authCookie = cookies.find(
     (cookie) =>
@@ -304,7 +307,7 @@ export function buildAbuseRiskSubjects({
     subjects.push({ subject_type: 'user', subject_key: `user:${userId}` });
   }
 
-  if (sessionKey) {
+  if (sessionKey && userId && !apiKeyId) {
     subjects.push({ subject_type: 'session', subject_key: sessionKey });
   }
 
@@ -365,6 +368,34 @@ async function loadServerTrustDecision({
   }
 }
 
+async function hasRecentSessionChallenge(
+  userId: string | null | undefined,
+  subjects: AbuseRiskSubject[]
+) {
+  const session = subjects.find(
+    (subject) => subject.subject_type === 'session'
+  );
+  if (!userId || !session) return false;
+  const supabase = await getSupabaseAdmin();
+  if (!supabase) return false;
+  try {
+    const now = new Date();
+    const { data, error } = await supabase
+      .from('abuse_step_up_challenges')
+      .select('id')
+      .eq('user_id', userId)
+      .eq('subject_key', session.subject_key)
+      .eq('status', 'passed')
+      .gt('expires_at', now.toISOString())
+      .gte('completed_at', new Date(now.getTime() - 15 * 60_000).toISOString())
+      .order('completed_at', { ascending: false })
+      .limit(1);
+    return !error && Boolean(data?.length);
+  } catch {
+    return false;
+  }
+}
+
 export async function resolveAbuseRiskDecision(
   input: ResolveAbuseRiskDecisionInput
 ): Promise<AbuseRiskDecision> {
@@ -432,11 +463,19 @@ export async function resolveAbuseRiskDecision(
     (!likelyBrowser || userAgentClassification.riskLevel === 'block');
 
   if (suspiciousBrowserMutation && tier !== 'restricted') {
-    tier = 'challenge_required';
+    // A completed session-bound challenge satisfies the browser-shape
+    // heuristic only. Server restrictions and explicit challenges still win.
+    const cleared =
+      serverDecision?.tier !== 'challenge_required' &&
+      (input.authKind === 'session' || input.authKind === 'app-session') &&
+      (await hasRecentSessionChallenge(input.userId, subjects));
+    tier = cleared ? 'standard' : 'challenge_required';
     trustMultiplier = 1;
     decisionSource = 'heuristic';
     subjectKey ??= subjects[0]?.subject_key ?? null;
-    reasons.push('suspicious_browser_mutation');
+    reasons.push(
+      cleared ? 'session_challenge_passed' : 'suspicious_browser_mutation'
+    );
   } else if (
     tier === 'trusted' &&
     userAgentClassification.riskLevel === 'block'

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.52.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.53.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.52.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.53.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */