create-ailk 0.1.0

package/templates/apps/api/src/middleware/__tests__/adversarial/session-timeout.test.ts

@@ -0,0 +1,139 @@
+/**
+ * @file session-timeout.test.ts (S13 adversarial)
+ *
+ * Cookie-session expiry boundary tests. The baseline `cookie-path.test.ts`
+ * proves that an expired cookie returns 401 even when a valid bearer is
+ * present (no silent fallback). This file pins the boundary behaviour the
+ * adversarial scenario calls out:
+ *
+ *   - `now === expiresAt`  → expired (strict greater-than is the contract).
+ *   - `now === expiresAt - 1ms` → still valid.
+ *   - Far-past expiry → 401.
+ *   - Far-future expiry → 200.
+ *
+ * The preHandler reads `getClock().now()`; we mock it deterministically so
+ * the boundary is byte-exact instead of relying on `Date.now()` jitter
+ * during test execution.
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+jest.mock("@working-theory/common", () => {
+  const actual = jest.requireActual("@working-theory/common");
+  return {
+    ...actual,
+    getClock: () => ({ now: () => CURRENT_TIME }),
+  };
+});
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../auth.js";
+
+let CURRENT_TIME = 1_000_000_000_000;
+
+function buildApp(): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, {
+    frontendOrigin: "https://app.example.com",
+  });
+  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+describe("S13 adversarial — cookie session timeout boundary", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    CURRENT_TIME = 1_000_000_000_000;
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("treats expiresAt === now as EXPIRED (strict greater-than required)", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(CURRENT_TIME),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: "better-auth.session_token=sess_tok" },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("treats expiresAt one millisecond ahead of now as VALID", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(CURRENT_TIME + 1),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: "better-auth.session_token=sess_tok" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body).userId).toBe("user_42");
+  });
+
+  it("rejects sessions with a far-past expiresAt", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(CURRENT_TIME - 86_400_000), // 1 day ago
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: "better-auth.session_token=sess_tok" },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("accepts sessions with a far-future expiresAt", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(CURRENT_TIME + 86_400_000 * 7), // 7 days ahead
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: "better-auth.session_token=sess_tok" },
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+});

package/templates/apps/api/src/middleware/__tests__/auth.bearer-path.test.ts

@@ -0,0 +1,175 @@
+/**
+ * @file auth.bearer-path.test.ts
+ *
+ * Bearer-path coverage for the dual-mode auth preHandler (#587).
+ *
+ * Asserts:
+ *   - Valid Authorization: Bearer header → request.userId populated; 200.
+ *   - CSRF is NOT checked on bearer-authenticated POST (cross-origin OK).
+ *   - Malformed Authorization header → 401 (does not fall through silently).
+ *   - Revoked token → 401.
+ *   - Expired token → 401.
+ *   - Unknown token → 401.
+ */
+
+import { createHash } from "node:crypto";
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../auth.js";
+
+const FRONTEND = "https://app.example.com";
+const BEARER = "tok_live_abc";
+const BEARER_HASH = createHash("sha256").update(BEARER).digest("hex");
+
+function buildApp(): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
+  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+describe("auth preHandler — bearer path", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("decorates request.userId for a valid bearer token (GET)", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bear",
+      expiresAt: null,
+      revokedAt: null,
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { authorization: `Bearer ${BEARER}` },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)).toEqual({ userId: "user_bear" });
+    expect(prisma.apiToken.findUnique).toHaveBeenCalledWith({
+      where: { token: BEARER_HASH },
+      select: { id: true, userId: true, expiresAt: true, revokedAt: true },
+    });
+  });
+
+  it("skips CSRF on bearer POST (cross-origin allowed for non-browser callers)", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bear",
+      expiresAt: null,
+      revokedAt: null,
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/echo",
+      headers: {
+        authorization: `Bearer ${BEARER}`,
+        origin: "https://anywhere.example.com", // explicitly cross-origin
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body).userId).toBe("user_bear");
+  });
+
+  it("rejects a malformed Authorization header (no silent fallback to cookie)", async () => {
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { authorization: "NotBearer x" },
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
+    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 for a revoked token", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bear",
+      expiresAt: null,
+      revokedAt: new Date(),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { authorization: `Bearer ${BEARER}` },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("returns 401 for an expired token", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bear",
+      expiresAt: new Date(Date.now() - 1000),
+      revokedAt: null,
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { authorization: `Bearer ${BEARER}` },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("returns 401 for an unknown token", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { authorization: "Bearer some-random-token" },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+});

package/templates/apps/api/src/middleware/__tests__/auth.both-present-precedence.test.ts

@@ -0,0 +1,76 @@
+/**
+ * @file auth.both-present-precedence.test.ts
+ *
+ * "Both cookie and bearer present" tie-break (#587).
+ *
+ * Spec §3 #3: cookie precedence wins. The bearer token is ignored when the
+ * cookie session is valid. Brief decision OQ-D Layer 1 #2 locks this.
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../auth.js";
+
+function buildApp(): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, {
+    frontendOrigin: "https://app.example.com",
+  });
+  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+describe("auth preHandler — both cookie and bearer present", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("cookie wins when both are valid; bearer lookup is skipped entirely", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_cookie",
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bearer",
+      expiresAt: null,
+      revokedAt: null,
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: {
+        cookie: "better-auth.session_token=sess_tok_abc",
+        authorization: "Bearer tok_live_xyz",
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)).toEqual({ userId: "user_cookie" });
+    // Bearer table MUST NOT be queried when the cookie path resolves.
+    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/middleware/__tests__/auth.cookie-path.test.ts

@@ -0,0 +1,153 @@
+/**
+ * @file auth.cookie-path.test.ts
+ *
+ * Cookie-path coverage for the dual-mode auth preHandler (#587).
+ *
+ * Asserts:
+ *   - Valid Better Auth session cookie → request.userId populated; 200.
+ *   - GET requests succeed without an Origin header (safe method).
+ *   - POST with a same-origin Origin header succeeds (CSRF passes).
+ *   - POST with a cross-origin Origin header is rejected (401).
+ *   - Expired session cookie returns 401 even if a valid bearer is also
+ *     present (no silent fallback — locked by spec §3 "Expired cookie").
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; mirrors tokens.test.ts pattern
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../auth.js";
+
+const FRONTEND = "https://app.example.com";
+
+function buildApp(): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
+  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+const COOKIE_NAME = "better-auth.session_token";
+
+describe("auth preHandler — cookie path", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("decorates request.userId for a valid session cookie (GET)", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: `${COOKIE_NAME}=sess_tok_abc.signature` },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)).toEqual({ userId: "user_42" });
+    // The signature suffix must be stripped before the Session lookup.
+    expect(prisma.session.findUnique).toHaveBeenCalledWith({
+      where: { token: "sess_tok_abc" },
+      select: { userId: true, expiresAt: true },
+    });
+  });
+
+  it("accepts a same-origin POST with the cookie (CSRF check passes)", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/echo",
+      headers: {
+        cookie: `${COOKIE_NAME}=sess_tok_abc`,
+        origin: FRONTEND,
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body).userId).toBe("user_42");
+  });
+
+  it("rejects a cross-origin POST with the cookie (CSRF guard fires)", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/echo",
+      headers: {
+        cookie: `${COOKIE_NAME}=sess_tok_abc`,
+        origin: "https://evil.example.com",
+      },
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
+  });
+
+  it("returns 401 when the cookie is expired (no silent bearer fallback)", async () => {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      userId: "user_42",
+      expiresAt: new Date(Date.now() - 1_000), // expired one second ago
+    });
+    // A valid bearer is present — the preHandler must NOT fall through to it.
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_id",
+      userId: "user_bearer",
+      expiresAt: null,
+      revokedAt: null,
+    });
+
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: {
+        cookie: `${COOKIE_NAME}=stale_tok`,
+        authorization: "Bearer tok_live_abc",
+      },
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
+    // Bearer lookup MUST NOT have been queried — cookie path short-circuits.
+    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/middleware/__tests__/auth.neither-present.test.ts

@@ -0,0 +1,72 @@
+/**
+ * @file auth.neither-present.test.ts
+ *
+ * Neither cookie nor bearer → 401 unauthorized (#587).
+ *
+ * Spec §3 #4: when no auth signal is present at all, the preHandler returns
+ * 401 with `{ error: 'unauthorized' }` and never reaches the route handler.
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../auth.js";
+
+function buildApp(): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, {
+    frontendOrigin: "https://app.example.com",
+  });
+  app.get("/echo", async () => ({ ok: true }));
+  return app;
+}
+
+describe("auth preHandler — neither cookie nor bearer", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it('returns 401 with { error: "unauthorized" } and skips both DB lookups', async () => {
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({ method: "GET", url: "/echo" });
+
+    expect(res.statusCode).toBe(401);
+    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
+    expect(prisma.session.findUnique).not.toHaveBeenCalled();
+    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when a cookie name that is NOT a session cookie is sent alone", async () => {
+    app = buildApp();
+    await app.ready();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/echo",
+      headers: { cookie: "some_other_cookie=foo" },
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(prisma.session.findUnique).not.toHaveBeenCalled();
+  });
+});