create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/middleware/__tests__/adversarial/cookie-or-bearer-precedence.test.ts

@@ -1,172 +0,0 @@
-/**
- * @file cookie-or-bearer-precedence.test.ts (S13 adversarial)
- *
- * Cookie-wins-when-both-present precedence. The baseline
- * `auth.both-present-precedence.test.ts` proves the happy path: valid cookie
- * + valid bearer → cookie wins, bearer lookup skipped. The S13 adversarial
- * scenarios cover the asymmetric cases:
- *
- *   - Expired cookie + valid bearer → 401 (NO silent bearer fallback).
- *     Locked by brief Layer 1 #2 and verified in cookie-path.test.ts; this
- *     suite cross-pins the contract from the precedence side.
- *   - Valid cookie + expired bearer → cookie wins (200).
- *   - Valid cookie + revoked bearer → cookie wins (200).
- *   - Valid cookie + cross-origin Origin on POST → 401 (CSRF guard runs
- *     even when the cookie itself would have been valid).
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../auth.js";
-
-const FRONTEND = "https://app.example.com";
-const COOKIE_NAME = "better-auth.session_token";
-const BEARER = "tok_live_xyz";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("S13 adversarial — cookie/bearer precedence", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("expired cookie + valid bearer → 401 (no silent fallback to bearer)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() - 1_000),
-    });
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bearer",
-      expiresAt: null,
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=expired_tok`,
-        authorization: `Bearer ${BEARER}`,
-      },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("valid cookie + expired bearer → cookie wins (200)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bearer",
-      expiresAt: new Date(Date.now() - 1_000),
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=valid_tok`,
-        authorization: `Bearer ${BEARER}`,
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).userId).toBe("user_cookie");
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("valid cookie + revoked bearer → cookie wins (200)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bearer",
-      expiresAt: null,
-      revokedAt: new Date(),
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=valid_tok`,
-        authorization: `Bearer ${BEARER}`,
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).userId).toBe("user_cookie");
-  });
-
-  it("valid cookie + cross-origin POST + valid bearer → 401 (CSRF guard still fires)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bearer",
-      expiresAt: null,
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=valid_tok`,
-        authorization: `Bearer ${BEARER}`,
-        origin: "https://evil.example.com",
-      },
-    });
-
-    expect(res.statusCode).toBe(401);
-    // Cookie path consumed the request; bearer path was not reached.
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-});

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-bearer-skip.test.ts

@@ -1,119 +0,0 @@
-/**
- * @file csrf-bearer-skip.test.ts (S13 adversarial)
- *
- * Bearer path explicitly skips the same-origin Origin check. Spec §3:
- * "Bearer-authenticated callers skip the origin check (non-browser flow)."
- *
- * Adversarial scenarios:
- *   - Bearer + no Origin header → 200 (does not require any Origin).
- *   - Bearer + cross-origin Origin (no cookie) → 200 (CSRF not enforced).
- *   - Bearer + same-origin Origin (no cookie) → 200.
- *   - Bearer + malformed Origin (no cookie) → 200 (Origin is ignored on bearer path).
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../auth.js";
-
-const FRONTEND = "https://app.example.com";
-const BEARER = "tok_live_abc";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("S13 adversarial — CSRF skipped on bearer path", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bear",
-      expiresAt: null,
-      revokedAt: null,
-    });
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("accepts bearer POST with no Origin header", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: { authorization: `Bearer ${BEARER}` },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).userId).toBe("user_bear");
-  });
-
-  it("accepts bearer POST with a cross-origin Origin header (non-browser flow)", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        authorization: `Bearer ${BEARER}`,
-        origin: "https://untrusted.example.com",
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("accepts bearer POST with a malformed Origin header value", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        authorization: `Bearer ${BEARER}`,
-        origin: "not-a-url",
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("does not invoke the session cookie lookup when only a bearer is present", async () => {
-    app = buildApp();
-    await app.ready();
-
-    await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        authorization: `Bearer ${BEARER}`,
-        origin: "https://evil.example.com",
-      },
-    });
-
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-  });
-});

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-cookie-path.test.ts

@@ -1,138 +0,0 @@
-/**
- * @file csrf-cookie-path.test.ts (S13 adversarial)
- *
- * Adversarial CSRF coverage on the cookie path. Extends the baseline cases
- * in auth.cookie-path.test.ts with the attack scenarios from S13 §3:
- *
- *   - Missing Origin header on a cookie-authenticated POST → 401
- *     (no Origin is treated as cross-origin; the safe-method bypass is
- *     reserved for explicitly safe HTTP verbs).
- *   - Scheme mismatch (http origin vs https configured) → 401.
- *   - Same-origin with extra trailing slash on header origin → 401 (exact match required).
- *   - HEAD and OPTIONS skip the CSRF check even with a cross-origin Origin
- *     (defensive — they are pre-flight / metadata methods).
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../auth.js";
-
-const FRONTEND = "https://app.example.com";
-const COOKIE_NAME = "better-auth.session_token";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
-  // HEAD is auto-registered by Fastify when GET is declared; no explicit handler needed.
-  app.options("/echo", async () => ({}));
-  return app;
-}
-
-describe("S13 adversarial — CSRF on cookie path", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_42",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("rejects POST with a cookie when the Origin header is missing", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=sess_tok_abc` },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
-  });
-
-  it("rejects POST when Origin scheme differs from the configured trusted origin", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=sess_tok_abc`,
-        origin: "http://app.example.com", // http vs https
-      },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("rejects POST when Origin has a trailing slash (exact-match required)", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=sess_tok_abc`,
-        origin: `${FRONTEND}/`, // trailing slash — does not equal FRONTEND
-      },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("accepts HEAD with a cross-origin Origin (safe method bypass)", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "HEAD",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=sess_tok_abc`,
-        origin: "https://evil.example.com",
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("accepts OPTIONS with a cross-origin Origin (preflight bypass)", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "OPTIONS",
-      url: "/echo",
-      headers: {
-        cookie: `${COOKIE_NAME}=sess_tok_abc`,
-        origin: "https://evil.example.com",
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-});

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-trusted-origins.test.ts

@@ -1,142 +0,0 @@
-/**
- * @file csrf-trusted-origins.test.ts (#7395 AC-3)
- *
- * The cookie path's CSRF check against a multi-origin allowlist. A spoke site
- * forwards the visitor's cookie and the browser's real `Origin` to the hub
- * API, so a write is accepted iff that `Origin` is EXACTLY one of the
- * configured trusted origins — never a prefix, a suffix or the first entry
- * alone — and an empty list refuses every cookie write in every environment
- * (the dev fail-open is gone, spec D4/D6.2). The non-rejecting resolver the
- * checkout route uses applies the same check (#6866 D2).
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin, resolveOptionalCookieUser } from "../../auth.js";
-
-const HUB = "https://hub.example";
-const SPOKE_A = "https://spoke-a.example";
-const TRUSTED = [HUB, SPOKE_A];
-const COOKIE = "better-auth.session_token=sess_tok_abc";
-
-function buildApp(trustedOrigins: readonly string[]): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins });
-  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-function buildResolverApp(trustedOrigins: readonly string[]): FastifyInstance {
-  const app = Fastify();
-  app.post("/resolve", async (req) =>
-    resolveOptionalCookieUser(req, { trustedOrigins }),
-  );
-  return app;
-}
-
-function post(app: FastifyInstance, url: string, origin?: string) {
-  return app.inject({
-    method: "POST",
-    url,
-    headers: { cookie: COOKIE, ...(origin !== undefined && { origin }) },
-  });
-}
-
-describe("#7395 — cookie-path CSRF against the trusted-origin allowlist", () => {
-  const originalNodeEnv = process.env.NODE_ENV;
-  const originalDatabaseUrl = process.env.DATABASE_URL;
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      id: "ses_1",
-      userId: "usr_42",
-      expiresAt: new Date(Date.now() + 60_000),
-      activeOrganizationId: null,
-      activeWorkspaceId: null,
-    });
-  });
-
-  afterEach(async () => {
-    await app.close();
-    if (originalNodeEnv === undefined) delete process.env.NODE_ENV;
-    else process.env.NODE_ENV = originalNodeEnv;
-    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = originalDatabaseUrl;
-  });
-
-  it.each([HUB, SPOKE_A])(
-    "accepts a cookie POST from the listed origin %s",
-    async (origin) => {
-      app = buildApp(TRUSTED);
-      await app.ready();
-
-      const res = await post(app, "/echo", origin);
-
-      expect(res.statusCode).toBe(200);
-      expect(res.json()).toEqual({ userId: "usr_42" });
-    },
-  );
-
-  it.each([
-    ["an unlisted spoke", "https://spoke-b.example"],
-    ["a listed origin as a host prefix", "https://spoke-a.example.evil.test"],
-    ["an opaque origin", "null"],
-    ["a case variant of a listed origin", "HTTPS://HUB.EXAMPLE"],
-    ["a listed origin with a trailing slash", "https://hub.example/"],
-    ["a listed origin with its default port", "https://hub.example:443"],
-    ["a missing Origin", undefined],
-  ])("refuses a cookie POST from %s with 401", async (_label, origin) => {
-    app = buildApp(TRUSTED);
-    await app.ready();
-
-    const res = await post(app, "/echo", origin);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json()).toEqual({ error: "unauthorized" });
-  });
-
-  it("refuses every cookie POST with an empty list, even in development", async () => {
-    process.env.NODE_ENV = "development";
-    app = buildApp([]);
-    await app.ready();
-
-    const res = await post(app, "/echo", HUB);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json()).toEqual({ error: "unauthorized" });
-  });
-
-  it("resolveOptionalCookieUser returns the user for a listed spoke", async () => {
-    app = buildResolverApp(TRUSTED);
-    await app.ready();
-
-    const res = await post(app, "/resolve", SPOKE_A);
-
-    expect(res.json()).toEqual({ kind: "user", userId: "usr_42" });
-  });
-
-  it("resolveOptionalCookieUser returns none/cross_origin for an unlisted spoke", async () => {
-    app = buildResolverApp(TRUSTED);
-    await app.ready();
-
-    const res = await post(app, "/resolve", "https://spoke-b.example");
-
-    expect(res.json()).toEqual({ kind: "none", reason: "cross_origin" });
-  });
-});