create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/middleware/__tests__/adversarial/session-fixation.test.ts

@@ -1,155 +0,0 @@
-/**
- * @file session-fixation.test.ts (S13 adversarial)
- *
- * Session-fixation defence at the preHandler boundary. The full rotation
- * behaviour (sign-in mints a fresh `Session.token` row) belongs to Better
- * Auth's database adapter; what the preHandler must guarantee — and what
- * an attacker observing a pre-sign-in session id would exploit — is that
- * a stale (pre-rotation) cookie token does NOT continue to authenticate
- * after rotation.
- *
- * Asserted:
- *   - A cookie carrying the PRE-rotation token returns 401 once the row
- *     for that token has been removed (rotation deletes the old row).
- *   - A cookie carrying the POST-rotation token authenticates as the same
- *     user but via a different `Session.token` lookup key.
- *   - Two cookies with different tokens authenticate as different
- *     sessions, never collapsing into one (defence-in-depth — the
- *     preHandler treats each token as an opaque lookup key).
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../auth.js";
-
-const COOKIE_NAME = "better-auth.session_token";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, {
-    trustedOrigins: ["https://app.example.com"],
-  });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("S13 adversarial — session fixation", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("rejects a cookie whose pre-rotation token row no longer exists", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(null);
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=pre_rotation_token` },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.session.findUnique).toHaveBeenCalledWith({
-      where: { token: "pre_rotation_token" },
-      select: {
-        id: true,
-        userId: true,
-        expiresAt: true,
-        activeOrganizationId: true,
-        activeWorkspaceId: true,
-      },
-    });
-  });
-
-  it("authenticates with the post-rotation token only (different lookup key)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockImplementation(
-      ({ where }: { where: { token: string } }) => {
-        if (where.token === "post_rotation_token") {
-          return Promise.resolve({
-            userId: "user_42",
-            expiresAt: new Date(Date.now() + 60_000),
-          });
-        }
-        return Promise.resolve(null);
-      },
-    );
-
-    app = buildApp();
-    await app.ready();
-
-    // Pre-rotation token rejected
-    const before = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=pre_rotation_token` },
-    });
-    expect(before.statusCode).toBe(401);
-
-    // Post-rotation token accepted
-    const after = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=post_rotation_token` },
-    });
-    expect(after.statusCode).toBe(200);
-    expect(JSON.parse(after.body).userId).toBe("user_42");
-  });
-
-  it("does not collapse two distinct session tokens into one authenticated identity", async () => {
-    (prisma.session.findUnique as jest.Mock).mockImplementation(
-      ({ where }: { where: { token: string } }) => {
-        if (where.token === "tok_alpha") {
-          return Promise.resolve({
-            userId: "user_alpha",
-            expiresAt: new Date(Date.now() + 60_000),
-          });
-        }
-        if (where.token === "tok_beta") {
-          return Promise.resolve({
-            userId: "user_beta",
-            expiresAt: new Date(Date.now() + 60_000),
-          });
-        }
-        return Promise.resolve(null);
-      },
-    );
-
-    app = buildApp();
-    await app.ready();
-
-    const alpha = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=tok_alpha` },
-    });
-    const beta = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: `${COOKIE_NAME}=tok_beta` },
-    });
-
-    expect(JSON.parse(alpha.body).userId).toBe("user_alpha");
-    expect(JSON.parse(beta.body).userId).toBe("user_beta");
-  });
-});

package/templates/apps/api/src/middleware/__tests__/adversarial/session-timeout.test.ts

@@ -1,139 +0,0 @@
-/**
- * @file session-timeout.test.ts (S13 adversarial)
- *
- * Cookie-session expiry boundary tests. The baseline `cookie-path.test.ts`
- * proves that an expired cookie returns 401 even when a valid bearer is
- * present (no silent fallback). This file pins the boundary behaviour the
- * adversarial scenario calls out:
- *
- *   - `now === expiresAt`  → expired (strict greater-than is the contract).
- *   - `now === expiresAt - 1ms` → still valid.
- *   - Far-past expiry → 401.
- *   - Far-future expiry → 200.
- *
- * The preHandler reads `getClock().now()`; we mock it deterministically so
- * the boundary is byte-exact instead of relying on `Date.now()` jitter
- * during test execution.
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-jest.mock("@working-theory/common", () => {
-  const actual = jest.requireActual("@working-theory/common");
-  return {
-    ...actual,
-    getClock: () => ({ now: () => CURRENT_TIME }),
-  };
-});
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../auth.js";
-
-let CURRENT_TIME = 1_000_000_000_000;
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, {
-    trustedOrigins: ["https://app.example.com"],
-  });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("S13 adversarial — cookie session timeout boundary", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    CURRENT_TIME = 1_000_000_000_000;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("treats expiresAt === now as EXPIRED (strict greater-than required)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_42",
-      expiresAt: new Date(CURRENT_TIME),
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: "better-auth.session_token=sess_tok" },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("treats expiresAt one millisecond ahead of now as VALID", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_42",
-      expiresAt: new Date(CURRENT_TIME + 1),
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: "better-auth.session_token=sess_tok" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).userId).toBe("user_42");
-  });
-
-  it("rejects sessions with a far-past expiresAt", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_42",
-      expiresAt: new Date(CURRENT_TIME - 86_400_000), // 1 day ago
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: "better-auth.session_token=sess_tok" },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("accepts sessions with a far-future expiresAt", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_42",
-      expiresAt: new Date(CURRENT_TIME + 86_400_000 * 7), // 7 days ahead
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: "better-auth.session_token=sess_tok" },
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-});