okengine 0.18.4 → 0.19.0

package/src/auth/bindings.ts

@@ -8,6 +8,7 @@
 import { z } from "zod";
 import { gate, type PolicyGateDecl } from "../elements/gate.ts";
 import type { GateDecl } from "../elements/gate/declare.ts";
+import { applyBoundaryContract, stampBoundaryContract } from "../kernel/boundary-contract.ts";
 import { fail } from "../kernel/errors.ts";
 import { flow, type AnyFlowDef } from "../kernel/flow.ts";
 import type { Binding } from "../kernel/on.ts";
@@ -22,6 +23,7 @@ import {
   IdentityError,
   type IdentityStore,
 } from "./identity.ts";
+import { getActiveGateAuthContext } from "./method-context.ts";
 import { PasswordPolicyError } from "./password-policy.ts";
 import {
   createSessionStore,
@@ -91,6 +93,17 @@ const SessionTokensOut = z.object({
   userId: z.string().optional(),
 });
 
+const SignInOut = z.union([
+  SessionTokensOut,
+  z.object({
+    twoFactorRequired: z.literal(true),
+    challengeId: z.string(),
+    method: z.enum(["totp", "email_otp"]),
+    userId: z.string(),
+    devOtp: z.string().optional(),
+  }),
+]);
+
 const RefreshIn = z.object({
   refreshToken: z.string().min(1),
 });
@@ -120,6 +133,14 @@ const MeOut = z.object({
   email: z.string(),
   name: z.string(),
   emailVerified: z.boolean(),
+  /** Live principal scopes — for UI chrome only; Gate on Flows is real authz. */
+  scopes: z.array(z.string()),
+  /** Active tenant id when multi-tenancy is on; otherwise null. */
+  tenantId: z.string().nullable(),
+  /** Authenticating API key id when Bearer was a key secret; otherwise null. */
+  apiKeyId: z.string().nullable(),
+  /** Whether the session completed verification (email / MFA). */
+  sessionFresh: z.boolean().optional(),
 });
 
 /**
@@ -205,11 +226,14 @@ export function createAuthHttpBindings(
 
   const base = config.basePath;
 
-  const refresh = flow("auth.refresh", {
-    plane: "user",
+  const refreshContract = {
     in: RefreshIn,
     out: SessionTokensOut,
     errors: { AuthFailed, AuthRateLimited },
+  };
+
+  const refresh = flow("auth.refresh", {
+    plane: "user",
     do: async (input) => {
       try {
         const issued = await rotateRefresh(sessions, ctx.sessionCrypto(), input.refreshToken);
@@ -229,11 +253,14 @@ export function createAuthHttpBindings(
     },
   });
 
-  const revoke = flow("auth.revoke", {
-    plane: "user",
+  const revokeContract = {
     in: RevokeIn,
     out: z.object({ ok: z.literal(true) }),
     errors: { AuthFailed },
+  };
+
+  const revoke = flow("auth.revoke", {
+    plane: "user",
     do: async (input) => {
       if (input.refreshToken) {
         try {
@@ -248,10 +275,13 @@ export function createAuthHttpBindings(
     },
   });
 
-  const me = flow("auth.me", {
-    plane: "user",
+  const meContract = {
     out: MeOut,
     errors: { AuthFailed },
+  };
+
+  const me = flow("auth.me", {
+    plane: "user",
     do: (_input, fx) => {
       const userId = fx.auth.userId;
       if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
@@ -262,6 +292,10 @@ export function createAuthHttpBindings(
         email: user.email,
         name: user.name,
         emailVerified: user.emailVerified,
+        scopes: [...fx.auth.scopes],
+        tenantId: fx.tenant.id,
+        apiKeyId: fx.auth.apiKeyId ?? null,
+        ...(fx.auth.verified !== undefined ? { sessionFresh: fx.auth.verified } : {}),
       };
     },
   });
@@ -276,21 +310,24 @@ export function createAuthHttpBindings(
   const bindings: Binding[] = [
     bindAuthHttp(
       http
-        .post(`${base}/refresh`)
+        .post(`${base}/refresh`, refreshContract)
         .public()
         .gate(...(refreshRate ? [refreshRate] : [])),
       refresh,
     ),
-    bindAuthHttp(http.post(`${base}/revoke`).public(), revoke),
-    bindAuthHttp(http.get(`${base}/me`).gate(AUTH_SESSION_GATE), me),
+    bindAuthHttp(http.post(`${base}/revoke`, revokeContract).public(), revoke),
+    bindAuthHttp(http.get(`${base}/me`, meContract).gate(AUTH_SESSION_GATE), me),
   ];
 
   if (config.emailAndPassword.enabled) {
-    const signInEmail = flow("auth.signInEmail", {
-      plane: "user",
+    const signInEmailContract = {
       in: EmailPasswordIn,
-      out: SessionTokensOut,
+      out: SignInOut,
       errors: { AuthFailed, AuthRateLimited },
+    };
+
+    const signInEmail = flow("auth.signInEmail", {
+      plane: "user",
       do: async (input) => {
         // Rate limit is Gate KV (`signInRate` on the binding) — shared across
         // instances when `drivers.store.kv` is redis. No process-local email bag.
@@ -300,6 +337,11 @@ export function createAuthHttpBindings(
         if (config.emailAndPassword.requireEmailVerification && !user.emailVerified) {
           return fail("AuthFailed", { reason: "invalid_credentials" });
         }
+        const bridge = getActiveGateAuthContext()?.twoFactor;
+        if (bridge?.isEnabled(user.id)) {
+          const challenge = await bridge.beginLoginChallenge(user.id);
+          if (challenge) return challenge;
+        }
         const issued = await issueSessionWithScopes(sessions, ctx.sessionCrypto(), {
           id: user.id,
           plane: "user",
@@ -314,11 +356,14 @@ export function createAuthHttpBindings(
       },
     });
 
-    const signUpEmail = flow("auth.signUpEmail", {
-      plane: "user",
+    const signUpEmailContract = {
       in: EmailPasswordIn,
       out: SessionTokensOut,
       errors: { AuthFailed, AuthRateLimited },
+    };
+
+    const signUpEmail = flow("auth.signUpEmail", {
+      plane: "user",
       do: async (input) => {
         try {
           const user = await createUserWithPassword(identities, {
@@ -375,14 +420,14 @@ export function createAuthHttpBindings(
     bindings.push(
       bindAuthHttp(
         http
-          .post(`${base}/sign-in/email`)
+          .post(`${base}/sign-in/email`, signInEmailContract)
           .public()
           .gate(...(signInRate ? [signInRate] : [])),
         signInEmail,
       ),
       bindAuthHttp(
         http
-          .post(`${base}/sign-up/email`)
+          .post(`${base}/sign-up/email`, signUpEmailContract)
           .public()
           .gate(...(signUpRate ? [signUpRate] : [])),
         signUpEmail,
@@ -420,6 +465,9 @@ export function bindAuthHttp(trigger: HttpTrigger, flowDef: AnyFlowDef): Binding
   const list = flowDef.triggers as Trigger[];
   list.push(normalized);
   (flowDef as { $trigger: Trigger }).$trigger = normalized;
+  if (normalized.kind === "http" && normalized.contract !== undefined) {
+    applyBoundaryContract(flowDef, stampBoundaryContract(normalized.contract));
+  }
   return { trigger: normalized, flow: flowDef };
 }
 

package/src/auth/gate-auth.test.ts

@@ -205,8 +205,13 @@ describe("gate.auth — email Flows + security", () => {
       }),
     );
     expect(me.status).toBe(200);
-    const meBody = (await me.json()) as { data: { email: string } };
+    const meBody = (await me.json()) as {
+      data: { email: string; scopes: string[]; tenantId: string | null; apiKeyId: string | null };
+    };
     expect(meBody.data.email).toBe("user@example.com");
+    expect(Array.isArray(meBody.data.scopes)).toBe(true);
+    expect(meBody.data.tenantId).toBeNull();
+    expect(meBody.data.apiKeyId).toBeNull();
 
     const refreshed = await app.fetch(
       new Request("http://localhost/auth/refresh", {

package/src/auth/identity.ts

@@ -6,6 +6,8 @@ import type { PasswordHashOptions } from "../runtime/types.ts";
 import { createBunCrypto } from "../runtime/primitives.ts";
 import { assertNotBreached, type BreachCheckFn } from "./breach-check.ts";
 import { assertPasswordPolicy, type PasswordPolicyOptions } from "./password-policy.ts";
+import { revokePrincipalSessions, type SessionStore } from "./sessions.ts";
+import { okid } from "../okid.ts";
 
 /** User-plane identity row (logical). */
 export interface UserIdentityRow {
@@ -98,7 +100,7 @@ export async function ensureUserByEmail(
     const existing = store.users.get(existingId);
     if (existing) return existing;
   }
-  const id = crypto.randomUUID();
+  const id = okid();
   const user: UserIdentityRow = {
     id,
     email,
@@ -140,7 +142,7 @@ export async function createUserWithPassword(
   const crypto = createBunCrypto();
   const now = options.now ?? (() => Date.now());
   const t = now();
-  const id = options.id ?? crypto.randomUUID();
+  const id = options.id ?? okid();
   const user: UserIdentityRow = {
     id,
     email,
@@ -151,7 +153,7 @@ export async function createUserWithPassword(
     updatedAt: t,
     extra: { ...(options.extra ?? {}) },
   };
-  const accountId = crypto.randomUUID();
+  const accountId = okid();
   const account: UserAccountRow = {
     id: accountId,
     userId: id,
@@ -277,7 +279,7 @@ export async function linkOrProvision(
   }
 
   const t = now();
-  const userId = options.currentUserId ?? crypto.randomUUID();
+  const userId = options.currentUserId ?? okid();
   const existingUser = store.users.get(userId);
   const user: UserIdentityRow = existingUser ?? {
     id: userId,
@@ -290,7 +292,7 @@ export async function linkOrProvision(
     extra: {},
   };
   const account: UserAccountRow = {
-    id: crypto.randomUUID(),
+    id: okid(),
     userId,
     provider,
     providerAccountId,
@@ -309,6 +311,151 @@ export async function linkOrProvision(
   return { user, account, created: true };
 }
 
+/** Options for {@link completeVerifiedEmailSignIn}. */
+export interface CompleteVerifiedEmailSignInOptions {
+  /** Passwordless provider (`magic-link` or `otp`). */
+  readonly provider: string;
+  /** Provider-scoped subject — normalized email for email OTP / magic-link. */
+  readonly providerAccountId: string;
+  /** Proven email address (ownership verified by consuming the challenge). */
+  readonly email: string;
+  /** Injectable clock. */
+  readonly now?: () => number;
+}
+
+/** Result of {@link completeVerifiedEmailSignIn}. */
+export interface VerifiedEmailSignInResult extends LinkedCredential {
+  /**
+   * `true` when an existing unverified account was reclaimed and planted
+   * credentials were purged (CVE-2026-67327 pre-account hijack defense).
+   */
+  readonly credentialsCompromised: boolean;
+}
+
+/**
+ * Complete a proven-email passwordless sign-in (magic-link / email OTP).
+ *
+ * Unlike {@link linkOrProvision}, this path may reclaim an existing email
+ * owner because the challenge consumption proved inbox ownership:
+ * - Existing `provider:email` → re-auth (ensure `emailVerified`).
+ * - Unverified email owner → revoke sessions, clear password hashes, mark
+ *   verified, attach the passwordless credential (pre-account hijack fix).
+ * - Verified email owner → attach passwordless credential; no credential purge.
+ * - No owner → provision a new verified user.
+ *
+ * @param store - Shared identity store
+ * @param sessions - Session store (for principal revoke on reclaim)
+ * @param options - Proven email + passwordless provider
+ */
+export async function completeVerifiedEmailSignIn(
+  store: IdentityStore,
+  sessions: SessionStore,
+  options: CompleteVerifiedEmailSignInOptions,
+): Promise<VerifiedEmailSignInResult> {
+  const email = normalizeEmail(options.email);
+  if (!email.includes("@")) {
+    throw new IdentityError("invalid_email", "invalid email");
+  }
+  const providerAccountId = normalizeEmail(options.providerAccountId);
+  const now = options.now ?? (() => Date.now());
+  const t = now();
+  const key = `${options.provider}:${providerAccountId}`;
+
+  // 1. Existing passwordless credential → re-auth (no purge).
+  const existingAccountId = store.byProvider.get(key);
+  if (existingAccountId) {
+    const account = store.accounts.get(existingAccountId);
+    const user = account ? store.users.get(account.userId) : undefined;
+    if (account && user) {
+      if (!user.emailVerified) {
+        user.emailVerified = true;
+        user.updatedAt = t;
+        await store.persistUser?.(user);
+      }
+      return { user, account, created: false, credentialsCompromised: false };
+    }
+  }
+
+  const emailOwnerId = store.byEmail.get(email);
+  if (emailOwnerId) {
+    const user = store.users.get(emailOwnerId);
+    if (!user) {
+      throw new IdentityError("email_in_use", "email already registered to another credential");
+    }
+
+    const wasUnverified = !user.emailVerified;
+    if (wasUnverified) {
+      // Pre-account hijack: attacker planted an unverified password account.
+      revokePrincipalSessions(sessions, "user", user.id, t);
+      const persistAccountJobs: Array<void | Promise<void>> = [];
+      for (const account of store.accounts.values()) {
+        if (account.userId !== user.id || account.passwordHash === null) continue;
+        account.passwordHash = null;
+        account.updatedAt = t;
+        persistAccountJobs.push(store.persistAccount?.(account));
+      }
+      await Promise.all(persistAccountJobs);
+      user.emailVerified = true;
+      user.updatedAt = t;
+      await store.persistUser?.(user);
+    }
+
+    // Attach the passwordless provider if missing (reclaim or verified re-auth).
+    let account = existingAccountId ? store.accounts.get(existingAccountId) : undefined;
+    let created = false;
+    if (!account) {
+      account = {
+        id: okid(),
+        userId: user.id,
+        provider: options.provider,
+        providerAccountId,
+        passwordHash: null,
+        createdAt: t,
+        updatedAt: t,
+      };
+      store.accounts.set(account.id, account);
+      store.byProvider.set(key, account.id);
+      await store.persistAccount?.(account);
+      created = true;
+    }
+
+    return {
+      user,
+      account,
+      created,
+      credentialsCompromised: wasUnverified,
+    };
+  }
+
+  // 3. Fresh provision — verified from the start.
+  const userId = okid();
+  const user: UserIdentityRow = {
+    id: userId,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: t,
+    updatedAt: t,
+    extra: {},
+  };
+  const account: UserAccountRow = {
+    id: okid(),
+    userId,
+    provider: options.provider,
+    providerAccountId,
+    passwordHash: null,
+    createdAt: t,
+    updatedAt: t,
+  };
+  store.users.set(userId, user);
+  store.byEmail.set(email, userId);
+  store.accounts.set(account.id, account);
+  store.byProvider.set(key, account.id);
+  await Promise.all([store.persistUser?.(user), store.persistAccount?.(account)]);
+  return { user, account, created: true, credentialsCompromised: false };
+}
+
 /**
  * Ensure a user row exists for `userId` (defensive — two-factor enable on an
  * established session principal).

package/src/auth/index.ts

@@ -60,9 +60,35 @@ export {
 export {
   setActiveGateAuthContext,
   getActiveGateAuthContext,
+  patchActiveGateAuthContext,
   type ActiveGateAuthContext,
+  type TwoFactorAuthBridge,
 } from "./method-context.ts";
 
+export {
+  createPendingTwoFactorStore,
+  createStepUpStore,
+  issueChallenge,
+  getChallenge,
+  findActiveForUser,
+  hasActiveChallenge,
+  consumeChallenge,
+  invalidateActiveForUser,
+  grantStepUp,
+  consumeStepUp,
+  hasStepUp,
+  twoFactorEmailOtpIdentifier,
+  DEFAULT_TWO_FACTOR_CHALLENGE_TTL_MS,
+  DEFAULT_STEP_UP_TTL_MS,
+  type TwoFactorMethod,
+  type PendingTwoFactorChallenge,
+  type PendingTwoFactorStore,
+  type StepUpGrant,
+  type StepUpStore,
+  type TwoFactorRequiredOut,
+  type IssueChallengeOptions,
+} from "./two-factor-challenge.ts";
+
 export { createAuthSecondaryStorage, type AuthKv } from "./secondary-storage.ts";
 
 export {
@@ -90,6 +116,7 @@ export {
   ensureUserByEmail,
   ensureUserExists,
   linkOrProvision,
+  completeVerifiedEmailSignIn,
   IdentityError,
   type IdentityStore,
   type UserIdentityRow,
@@ -97,6 +124,8 @@ export {
   type CreateUserWithPasswordOptions,
   type LinkOrProvisionOptions,
   type LinkedCredential,
+  type CompleteVerifiedEmailSignInOptions,
+  type VerifiedEmailSignInResult,
 } from "./identity.ts";
 
 export {

package/src/auth/invites.ts

@@ -3,6 +3,7 @@
  */
 
 import type { OperatorInviteRow } from "./tables.ts";
+import { okid } from "../okid.ts";
 
 /** Default invitation TTL (7 days). */
 export const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -41,7 +42,7 @@ export function createOperatorInvite(
   const now = options.now ?? (() => Date.now());
   const t = now();
   const row: OperatorInviteRow = {
-    id: options.id ?? crypto.randomUUID(),
+    id: options.id ?? okid(),
     email: options.email,
     invitedBy: options.invitedBy,
     createdAt: t,

package/src/auth/method-context.ts

@@ -11,6 +11,26 @@ import type { BreachCheckFn } from "./breach-check.ts";
 import type { IdentityStore } from "./identity.ts";
 import type { PasswordPolicyOptions } from "./password-policy.ts";
 import type { SessionStore } from "./sessions.ts";
+import type {
+  PendingTwoFactorStore,
+  StepUpStore,
+  TwoFactorRequiredOut,
+} from "./two-factor-challenge.ts";
+import type { VerificationStore } from "./verification.ts";
+
+/**
+ * Bridge registered by `twoFactor()` so first-factor sign-in can withhold
+ * tokens and issue a method-locked pending challenge.
+ */
+export interface TwoFactorAuthBridge {
+  /** Whether the user has an enabled second factor. */
+  isEnabled(userId: string): boolean;
+  /**
+   * Issue a locked login challenge (and email OTP when method is email_otp).
+   * Returns null when 2FA is not enabled for the user.
+   */
+  beginLoginChallenge(userId: string): Promise<TwoFactorRequiredOut | null>;
+}
 
 /** Shared context for auth method plugins. */
 export interface ActiveGateAuthContext {
@@ -25,6 +45,14 @@ export interface ActiveGateAuthContext {
   readonly password?: PasswordHashOptions;
   /** From `gate.auth.breachCheck` — optional breach checker. */
   readonly breachCheck?: BreachCheckFn;
+  /** Shared pending login 2FA challenges (created at Gate auth wire). */
+  readonly pendingTwoFactor?: PendingTwoFactorStore;
+  /** Shared step-up grants for privileged 2FA ops. */
+  readonly stepUp?: StepUpStore;
+  /** Shared verification store for 2FA email OTP (and injectable tests). */
+  readonly twoFactorVerifications?: VerificationStore;
+  /** Registered by `.plug(twoFactor())`. */
+  twoFactor?: TwoFactorAuthBridge;
 }
 
 let active: ActiveGateAuthContext | undefined;
@@ -44,3 +72,16 @@ export function setActiveGateAuthContext(ctx: ActiveGateAuthContext | undefined)
 export function getActiveGateAuthContext(): ActiveGateAuthContext | undefined {
   return active;
 }
+
+/**
+ * Mutate the active context in place (e.g. register `twoFactor` bridge).
+ *
+ * @param patch - Fields to merge onto the active context
+ */
+export function patchActiveGateAuthContext(
+  patch: Partial<ActiveGateAuthContext>,
+): ActiveGateAuthContext | undefined {
+  if (!active) return undefined;
+  active = { ...active, ...patch };
+  return active;
+}

package/src/auth/oauth-as/crypto.ts

@@ -9,6 +9,7 @@
 
 import { OAuthError } from "./errors.ts";
 import type { SigningKeyRow } from "./tables.ts";
+import { okid } from "../../okid.ts";
 
 /** Default access-token TTL (10 minutes — short-lived per OAuth 2.1 posture). */
 export const OAUTH_ACCESS_TTL_MS = 10 * 60_000;
@@ -210,7 +211,7 @@ export async function createDpopSigner(): Promise<{
     publicJwk,
     async prove({ htm, htu, now = Date.now(), accessToken, nonce }) {
       const claims: Record<string, unknown> = {
-        jti: crypto.randomUUID(),
+        jti: okid(),
         htm,
         htu: normalizeHtu(htu),
         iat: Math.floor(now / 1000),

package/src/auth/oauth-as/stores.ts

@@ -11,6 +11,7 @@ import type {
   ClientCacheRow,
   ConsentRow,
 } from "./tables.ts";
+import { okid } from "../../okid.ts";
 
 /**
  * Create an empty AS store bundle.
@@ -57,5 +58,5 @@ export async function hashSecret(raw: string): Promise<string> {
 
 /** Cryptographically random id (no dashes), same hygiene as session ids. */
 export function cryptoId(): string {
-  return crypto.randomUUID().replace(/-/g, "");
+  return okid();
 }

package/src/auth/operator.ts

@@ -12,6 +12,7 @@ import { createBunCrypto } from "../runtime/primitives.ts";
 import { assertNotBreached, type BreachCheckFn } from "./breach-check.ts";
 import { assertPasswordPolicy, type PasswordPolicyOptions } from "./password-policy.ts";
 import type { OperatorCredentialRow, OperatorRow, OperatorSsoLinkRow } from "./tables.ts";
+import { okid } from "../okid.ts";
 
 /** Operator-plane store. */
 export interface OperatorStore {
@@ -74,7 +75,7 @@ export async function createOperator(
   }
   await assertNotBreached(options.password, options.breachCheck);
   const crypto = createBunCrypto();
-  const id = options.id ?? crypto.randomUUID();
+  const id = options.id ?? okid();
   const row: OperatorRow = {
     id,
     email: options.email,

package/src/auth/sessions-jwt.test.ts

@@ -0,0 +1,77 @@
+/**
+ * Defense-in-depth: session access JWT must allowlist HS256 and reject
+ * spoofed alg headers / non-JWS compact shapes (JWE = 5 parts).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createSessionStore, issueSession, SessionError, verifyAccess } from "./sessions.ts";
+
+const SECRET = "test-secret-at-least-32-bytes-long!!";
+
+function b64url(s: string): string {
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+async function hmacSha256B64url(secret: string, data: string): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
+  let bin = "";
+  for (const b of new Uint8Array(sig)) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+describe("session access JWT alg enforcement", () => {
+  test("rejects alg: none", async () => {
+    const store = createSessionStore();
+    const header = b64url(JSON.stringify({ alg: "none", typ: "JWT" }));
+    const payload = b64url(
+      JSON.stringify({
+        sub: "u1",
+        plane: "user",
+        sid: "s1",
+        scopes: [],
+        iat: 1,
+        exp: 9_999_999_999_999,
+      }),
+    );
+    const token = `${header}.${payload}.`;
+    await expect(verifyAccess(store, SECRET, token)).rejects.toThrow(SessionError);
+    await expect(verifyAccess(store, SECRET, token)).rejects.toThrow(
+      "unsupported access token alg",
+    );
+  });
+
+  test("rejects mismatched alg even when HMAC is valid", async () => {
+    const store = createSessionStore();
+    const now = 1_700_000_000_000;
+    const issued = await issueSession(
+      store,
+      { secret: SECRET, now: () => now },
+      { id: "u1", plane: "user", scopes: ["read"] },
+    );
+    const payloadPart = issued.accessToken.split(".")[1]!;
+    const forgedHeader = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const data = `${forgedHeader}.${payloadPart}`;
+    const sig = await hmacSha256B64url(SECRET, data);
+    const forged = `${data}.${sig}`;
+    await expect(verifyAccess(store, SECRET, forged, { now: () => now })).rejects.toThrow(
+      SessionError,
+    );
+    await expect(verifyAccess(store, SECRET, forged, { now: () => now })).rejects.toThrow(
+      "unsupported access token alg",
+    );
+  });
+
+  test("rejects JWE compact serialization (5 parts)", async () => {
+    const store = createSessionStore();
+    const jwe = "a.b.c.d.e";
+    await expect(verifyAccess(store, SECRET, jwe)).rejects.toThrow(SessionError);
+    await expect(verifyAccess(store, SECRET, jwe)).rejects.toThrow("malformed access token");
+  });
+});