onbuzz 4.6.2 → 4.7.0

package/src/services/apiKeyManager.js

@@ -14,18 +14,13 @@
 
 import { promises as fs } from 'fs';
 import path from 'path';
-import crypto from 'crypto';
-import os from 'os';
 import { getUserDataPaths, ensureUserDataDirs } from '../utilities/userDataDir.js';
 import { isPlaceholderApiKey } from '../utilities/apiKeyPlaceholders.js';
-
-// Encryption configuration
-const ALGORITHM = 'aes-256-gcm';
-const KEY_LENGTH = 32; // 256 bits
-const IV_LENGTH = 16;
-const AUTH_TAG_LENGTH = 16;
-const SALT_LENGTH = 32;
-const PBKDF2_ITERATIONS = 100000;
+import {
+  getOrCreateEncryptionKey as _getOrCreateEncryptionKey,
+  encrypt as _cipherEncrypt,
+  decrypt as _cipherDecrypt,
+} from '../utilities/secretsCipher.js';
 
 class ApiKeyManager {
   constructor(logger) {
@@ -73,103 +68,21 @@ class ApiKeyManager {
   }
 
   /**
-   * Get or create a machine-specific encryption key
-   * @param {string} settingsDir - Settings directory path
-   * @returns {Promise<Buffer>} Encryption key
+   * Cipher primitives delegate to `utilities/secretsCipher.js` so the
+   * api-keys.enc and auth-cache.enc stores share one implementation
+   * and one byte layout. See that module for the on-disk format and
+   * the KEY_DERIVATION_DOMAIN constant.
    */
   async _getOrCreateEncryptionKey(settingsDir) {
-    const saltFile = path.join(settingsDir, '.key-salt');
-    let salt;
-
-    try {
-      salt = await fs.readFile(saltFile);
-    } catch (error) {
-      // Generate new salt
-      salt = crypto.randomBytes(SALT_LENGTH);
-      await fs.writeFile(saltFile, salt, { mode: 0o600 });
-      this.logger?.info('[ApiKeyManager] Generated new encryption salt');
-    }
-
-    // Derive key from salt + machine-specific data
-    const machineData = this._getMachineIdentifier();
-    const key = crypto.pbkdf2Sync(
-      machineData,
-      salt,
-      PBKDF2_ITERATIONS,
-      KEY_LENGTH,
-      'sha256'
-    );
-
-    return key;
+    return _getOrCreateEncryptionKey(settingsDir, this.logger);
   }
 
-  /**
-   * Get a machine-specific identifier for key derivation
-   * @returns {string}
-   */
-  _getMachineIdentifier() {
-    const parts = [
-      os.hostname(),
-      os.homedir(),
-      os.userInfo().username,
-      process.platform,
-      'loxia-api-key-encryption-v1'
-    ];
-    return parts.join(':');
-  }
-
-  /**
-   * Encrypt data using AES-256-GCM
-   * @param {string} plaintext - Data to encrypt
-   * @returns {string} Encrypted data as base64
-   */
   _encrypt(plaintext) {
-    if (!this.encryptionKey) {
-      throw new Error('Encryption key not initialized');
-    }
-
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, this.encryptionKey, iv);
-
-    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-    encrypted += cipher.final('base64');
-
-    const authTag = cipher.getAuthTag();
-
-    // Combine IV + authTag + encrypted data
-    const combined = Buffer.concat([
-      iv,
-      authTag,
-      Buffer.from(encrypted, 'base64')
-    ]);
-
-    return combined.toString('base64');
+    return _cipherEncrypt(plaintext, this.encryptionKey);
   }
 
-  /**
-   * Decrypt data using AES-256-GCM
-   * @param {string} encryptedData - Encrypted data as base64
-   * @returns {string} Decrypted plaintext
-   */
   _decrypt(encryptedData) {
-    if (!this.encryptionKey) {
-      throw new Error('Encryption key not initialized');
-    }
-
-    const combined = Buffer.from(encryptedData, 'base64');
-
-    // Extract IV, authTag, and encrypted data
-    const iv = combined.subarray(0, IV_LENGTH);
-    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-    const encrypted = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-
-    const decipher = crypto.createDecipheriv(ALGORITHM, this.encryptionKey, iv);
-    decipher.setAuthTag(authTag);
-
-    let decrypted = decipher.update(encrypted.toString('base64'), 'base64', 'utf8');
-    decrypted += decipher.final('utf8');
-
-    return decrypted;
+    return _cipherDecrypt(encryptedData, this.encryptionKey);
   }
 
   /**

package/src/services/authCacheStore.js

@@ -0,0 +1,140 @@
+/**
+ * Encrypted persistence for `webServer.lastAuthResult`.
+ *
+ * Purpose:
+ * - Survive local-server restarts without losing the OAuth JWT.
+ * - Without this, every restart wipes the in-memory auth cache, so
+ *   the FE polling fallback at `/api/auth/status` returns
+ *   `{ user: null, jwt: null }` and any frontend that didn't already
+ *   capture the JWT in its own localStorage (page reload after a
+ *   server bounce, fresh browser, incognito tab) gets 401s on every
+ *   marketplace publish/install/rate call.
+ *
+ * Why encrypted:
+ * - The cache row carries a raw JWT — a bearer credential. Storing it
+ *   in plaintext on disk would let any local process with file-read
+ *   access impersonate the user against the marketplace service.
+ *
+ * Storage: `<userDataDir>/settings/auth-cache.enc`. Cipher and key
+ * derivation are shared with `apiKeyManager` via
+ * `utilities/secretsCipher.js` — DRY by design.
+ */
+
+import { promises as fs } from 'fs';
+import path from 'path';
+import { getUserDataPaths, ensureUserDataDirs } from '../utilities/userDataDir.js';
+import {
+  getOrCreateEncryptionKey,
+  encrypt,
+  decrypt,
+} from '../utilities/secretsCipher.js';
+
+const FILE_NAME = 'auth-cache.enc';
+const SCHEMA_VERSION = 1;
+
+class AuthCacheStore {
+  constructor(logger) {
+    this.logger = logger;
+    this.persistenceFile = null;
+    this.encryptionKey = null;
+    this.initialized = false;
+  }
+
+  /**
+   * Resolve the encrypted file path and derive (or load) the AES key.
+   * Idempotent. Failures are non-fatal — the store then behaves as a
+   * no-op (load returns null, save silently swallows), so a broken
+   * disk doesn't crash the server boot.
+   */
+  async initialize() {
+    if (this.initialized) return;
+    try {
+      await ensureUserDataDirs();
+      const paths = getUserDataPaths();
+      this.persistenceFile = path.join(paths.settings, FILE_NAME);
+      this.encryptionKey = await getOrCreateEncryptionKey(paths.settings, this.logger);
+      this.initialized = true;
+      this.logger?.info?.('[AuthCacheStore] Initialized');
+    } catch (error) {
+      this.logger?.warn?.('[AuthCacheStore] init failed, running in memory-only mode', {
+        error: error.message,
+      });
+    }
+  }
+
+  /**
+   * Load and decrypt the persisted cache row.
+   * Returns null when the file is missing, corrupted, schema-mismatched,
+   * or the store failed to initialize. Never throws.
+   *
+   * @returns {Promise<Object|null>} the `lastAuthResult`-shaped object
+   *   ({ user, hasApiKey, jwt, timestamp }) or null.
+   */
+  async load() {
+    if (!this.initialized) return null;
+    try {
+      const ciphertext = await fs.readFile(this.persistenceFile, 'utf8');
+      const decoded = decrypt(ciphertext, this.encryptionKey);
+      const data = JSON.parse(decoded);
+      if (data?.version !== SCHEMA_VERSION || !data.cache) {
+        this.logger?.warn?.('[AuthCacheStore] schema mismatch, ignoring on-disk cache', {
+          version: data?.version,
+        });
+        return null;
+      }
+      return data.cache;
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        this.logger?.warn?.('[AuthCacheStore] load failed', { error: error.message });
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Persist a cache row. Passing null clears the file (delegate to
+   * clear() for clarity; this is a convenience for the webServer
+   * call site that always wants "make disk match memory").
+   *
+   * @param {Object|null} cache
+   */
+  async save(cache) {
+    if (!this.initialized) return;
+    if (cache === null || cache === undefined) {
+      await this.clear();
+      return;
+    }
+    try {
+      const payload = {
+        version: SCHEMA_VERSION,
+        savedAt: new Date().toISOString(),
+        cache,
+      };
+      const ciphertext = encrypt(JSON.stringify(payload), this.encryptionKey);
+      await fs.writeFile(this.persistenceFile, ciphertext, { mode: 0o600 });
+      this.logger?.debug?.('[AuthCacheStore] saved', {
+        hasUser: !!cache.user,
+        hasJwt: !!cache.jwt,
+      });
+    } catch (error) {
+      this.logger?.warn?.('[AuthCacheStore] save failed', { error: error.message });
+    }
+  }
+
+  /**
+   * Delete the on-disk cache. No-op when the file is already absent.
+   */
+  async clear() {
+    if (!this.initialized) return;
+    try {
+      await fs.unlink(this.persistenceFile);
+      this.logger?.info?.('[AuthCacheStore] cleared');
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        this.logger?.warn?.('[AuthCacheStore] clear failed', { error: error.message });
+      }
+    }
+  }
+}
+
+export default AuthCacheStore;

package/src/tools/__tests__/webTool.e2e.test.js

@@ -12,7 +12,15 @@
  * Run with: npm run test:e2e
  */
 
-import { describe, test, expect, beforeAll, afterAll } from '@jest/globals';
+import { describe, test, expect, beforeAll, afterAll, jest } from '@jest/globals';
+
+// Real-network tests against example.com / iana.org are inherently
+// flaky on TCP / DNS / target-server hiccups. The contract under test
+// is "the WebTool chain machinery works", not "example.com is always
+// up", so we tolerate up to 2 retries before declaring failure.
+// If a test fails 3 times in a row, that's a real signal worth
+// investigating; transient flakes get absorbed silently.
+jest.retryTimes(2, { logErrorsBeforeRetry: true });
 import os from 'os';
 import fs from 'fs';
 

package/src/tools/webTool.js

@@ -1193,14 +1193,30 @@ If blocked (CAPTCHA, access denied), use stealthLevel: "maximum" (visible browse
       const fetchStatus = fetchResponse ? fetchResponse.status() : null;
 
       if (fetchStatus && fetchStatus >= 400) {
+        // A page that returned 4xx/5xx did NOT give the agent what it
+        // asked for. We used to return `success: true` here on the
+        // theory that "the fetch itself executed"; downstream agents
+        // then ignored the warning and treated the error page as
+        // content. Switching to `success: false` matches the rest of
+        // the tool contract (operation either achieved its purpose
+        // or it didn't) AND surfaces the diagnostic via the standard
+        // `error` field that callers already inspect.
+        const reason =
+          fetchStatus >= 500 ? 'server error' :
+          fetchStatus === 404 ? 'page not found' :
+          fetchStatus === 403 ? 'access forbidden' :
+          fetchStatus === 401 ? 'authentication required' :
+          'client error';
         const errorResult = {
-          success: true,  // Fetch itself executed — page returned error status
+          success: false,
           url,
           httpStatus: fetchStatus,
-          diagnostic: `Page returned HTTP ${fetchStatus} (${fetchStatus >= 500 ? 'server error' : fetchStatus === 404 ? 'page not found' : fetchStatus === 403 ? 'access forbidden' : 'client error'})`,
-          warning: `HTTP ${fetchStatus} — the page loaded but returned an error status. Content may still be available.`
+          error: `HTTP ${fetchStatus}: ${reason}`,
+          diagnostic: `Page returned HTTP ${fetchStatus} (${reason})`,
+          warning: `HTTP ${fetchStatus} — the page loaded but returned an error status. Content may still be available.`,
         };
-        // Still try to get title for context
+        // Still try to get title for context — error pages often have
+        // useful titles like "404 - Not Found".
         try { errorResult.title = await page.title(); } catch {}
         // Don't close page here — finally block handles it
         return errorResult;

package/src/utilities/__tests__/authCache.test.js

@@ -0,0 +1,266 @@
+/**
+ * Tests for the auth-cache shape + state transitions used by the
+ * webServer's /auth/callback, /api/auth/status, and /api/auth/resolve
+ * routes.
+ *
+ * These lock the marketplace-auth bug we fixed in 2026-05: a user who
+ * missed the OAuth WS broadcast (page reload, dropped connection)
+ * would recover their user account via the polling fallback but lose
+ * the JWT, leading to 401 "Authentication required" on every
+ * marketplace publish/install/rate call.
+ */
+import { describe, test, expect } from '@jest/globals';
+import {
+  recordOAuthResult,
+  recordResolvedUser,
+  projectAuthStatus,
+} from '../authCache.js';
+
+// ─── recordOAuthResult ────────────────────────────────────────────────
+
+describe('recordOAuthResult', () => {
+  test('captures user, jwt, hasApiKey + a timestamp on the cache row', () => {
+    const row = recordOAuthResult({
+      user: { id: 'u1', email: 'a@b.com' },
+      jwt: 'eyJhbG...real-jwt',
+      hasApiKey: true,
+    });
+    expect(row.user).toEqual({ id: 'u1', email: 'a@b.com' });
+    expect(row.jwt).toBe('eyJhbG...real-jwt');
+    expect(row.hasApiKey).toBe(true);
+    expect(typeof row.timestamp).toBe('string');
+    // Must be a valid ISO datetime
+    expect(new Date(row.timestamp).toString()).not.toBe('Invalid Date');
+  });
+
+  test('CRITICAL: jwt is on the cache row — this is the contract that prevents 401-on-marketplace', () => {
+    // The bug we're guarding against: previously this function
+    // implicitly did `{user, hasApiKey, timestamp}` and forgot the JWT.
+    // Polling fallback then returned no JWT and marketplace auth broke.
+    const row = recordOAuthResult({ user: { id: 'u' }, jwt: 'tok', hasApiKey: true });
+    expect(row).toHaveProperty('jwt', 'tok');
+  });
+
+  test('non-string jwt collapses to null (defensive against malformed input)', () => {
+    expect(recordOAuthResult({ user: {}, jwt: null, hasApiKey: false }).jwt).toBeNull();
+    expect(recordOAuthResult({ user: {}, jwt: undefined, hasApiKey: false }).jwt).toBeNull();
+    expect(recordOAuthResult({ user: {}, jwt: '', hasApiKey: false }).jwt).toBeNull();
+    expect(recordOAuthResult({ user: {}, jwt: 12345, hasApiKey: false }).jwt).toBeNull();
+    expect(recordOAuthResult({ user: {}, jwt: { token: 'x' }, hasApiKey: false }).jwt).toBeNull();
+  });
+
+  test('hasApiKey coerces to bool', () => {
+    expect(recordOAuthResult({ hasApiKey: 1 }).hasApiKey).toBe(true);
+    expect(recordOAuthResult({ hasApiKey: 0 }).hasApiKey).toBe(false);
+    expect(recordOAuthResult({ hasApiKey: 'yes' }).hasApiKey).toBe(true);
+    expect(recordOAuthResult({}).hasApiKey).toBe(false);
+  });
+
+  test('null user passes through as null (degraded but valid cache row)', () => {
+    expect(recordOAuthResult({ user: null, jwt: 'x', hasApiKey: true }).user).toBeNull();
+  });
+
+  test('explicit timestamp wins (useful for deterministic tests)', () => {
+    const row = recordOAuthResult({ user: {}, timestamp: '2026-05-01T00:00:00Z' });
+    expect(row.timestamp).toBe('2026-05-01T00:00:00Z');
+  });
+});
+
+// ─── recordResolvedUser ───────────────────────────────────────────────
+
+describe('recordResolvedUser', () => {
+  test('CRITICAL: preserves a JWT from a previous OAuth cache row', () => {
+    // Resolve happens AFTER /auth/callback when the FE loads with an
+    // existing API key. Earlier code overwrote lastAuthResult and
+    // silently wiped the OAuth-minted JWT, breaking marketplace auth.
+    const prev = recordOAuthResult({ user: { id: 'u1' }, jwt: 'oauth-token', hasApiKey: true });
+    const next = recordResolvedUser({ user: { id: 'u1', email: 'a@b' }, prevCache: prev });
+    expect(next.jwt).toBe('oauth-token');
+    expect(next.user).toEqual({ id: 'u1', email: 'a@b' });
+  });
+
+  test('hasApiKey is always true on this path (resolve requires an API key)', () => {
+    expect(recordResolvedUser({ user: { id: 'u' }, prevCache: null }).hasApiKey).toBe(true);
+  });
+
+  test('no prior JWT → cache row has jwt: null (no marketplace auth available)', () => {
+    const next = recordResolvedUser({ user: { id: 'u' }, prevCache: null });
+    expect(next.jwt).toBeNull();
+  });
+
+  test('prior cache without jwt → null (matches the no-prior case)', () => {
+    const prev = { user: { id: 'u' }, hasApiKey: true, timestamp: '2026-01-01T00:00:00Z' };
+    const next = recordResolvedUser({ user: { id: 'u' }, prevCache: prev });
+    expect(next.jwt).toBeNull();
+  });
+
+  test('prior cache with empty/non-string jwt is treated as no jwt', () => {
+    for (const badJwt of [null, undefined, '', 0, {}, []]) {
+      const prev = { user: {}, hasApiKey: true, jwt: badJwt, timestamp: '2026-01-01T00:00:00Z' };
+      expect(recordResolvedUser({ user: {}, prevCache: prev }).jwt).toBeNull();
+    }
+  });
+
+  test('explicit timestamp wins (deterministic tests)', () => {
+    const next = recordResolvedUser({
+      user: { id: 'u' },
+      prevCache: null,
+      timestamp: '2026-05-03T12:00:00Z',
+    });
+    expect(next.timestamp).toBe('2026-05-03T12:00:00Z');
+  });
+});
+
+// ─── projectAuthStatus ────────────────────────────────────────────────
+
+describe('projectAuthStatus', () => {
+  test('returns null user + null jwt when no cache exists yet', () => {
+    const r = projectAuthStatus(null);
+    expect(r.user).toBeNull();
+    expect(r.jwt).toBeNull();
+    expect(r.success).toBe(true);
+  });
+
+  test('returns the cached user + jwt when fresh', () => {
+    const cache = recordOAuthResult({
+      user: { id: 'u1' }, jwt: 'tok', hasApiKey: true,
+    });
+    const r = projectAuthStatus(cache);
+    expect(r.user).toEqual({ id: 'u1' });
+    expect(r.jwt).toBe('tok');
+    expect(r.authenticated).toBe(true);
+  });
+
+  test('CRITICAL: jwt round-trips from recordOAuthResult through projectAuthStatus', () => {
+    // The full bug-fix contract: callback → cache → status → FE can read JWT.
+    const cache = recordOAuthResult({
+      user: { id: 'u' }, jwt: 'the-jwt-value', hasApiKey: true,
+    });
+    const status = projectAuthStatus(cache);
+    expect(status.jwt).toBe('the-jwt-value');
+  });
+
+  test('staleness gate: cache predating ?since= reports user=null (and jwt=null)', () => {
+    const cache = recordOAuthResult({
+      user: { id: 'u' }, jwt: 'old-tok', hasApiKey: true,
+      timestamp: '2026-05-01T10:00:00Z',
+    });
+    // Caller asking about an auth event AFTER the cache was written.
+    const r = projectAuthStatus(cache, { since: '2026-05-01T11:00:00Z' });
+    expect(r.user).toBeNull();
+    expect(r.jwt).toBeNull();
+  });
+
+  test('staleness gate: cache POST-DATING ?since= passes through', () => {
+    const cache = recordOAuthResult({
+      user: { id: 'u' }, jwt: 'fresh-tok', hasApiKey: true,
+      timestamp: '2026-05-01T11:00:00Z',
+    });
+    const r = projectAuthStatus(cache, { since: '2026-05-01T10:00:00Z' });
+    expect(r.user).toEqual({ id: 'u' });
+    expect(r.jwt).toBe('fresh-tok');
+  });
+
+  test('staleness gate: equal timestamps → stale (strict <=)', () => {
+    const cache = recordOAuthResult({
+      user: { id: 'u' }, jwt: 'tok', hasApiKey: true,
+      timestamp: '2026-05-01T10:00:00Z',
+    });
+    const r = projectAuthStatus(cache, { since: '2026-05-01T10:00:00Z' });
+    expect(r.user).toBeNull();
+  });
+
+  test('PAIR INVARIANT: when user is null, jwt MUST be null too (never user=null with jwt=set)', () => {
+    // Cache exists but is stale → user=null. JWT must follow.
+    const cache = recordOAuthResult({
+      user: { id: 'u' }, jwt: 'tok',
+      timestamp: '2026-05-01T00:00:00Z',
+    });
+    const r = projectAuthStatus(cache, { since: '2026-05-02T00:00:00Z' });
+    expect(r.user).toBeNull();
+    expect(r.jwt).toBeNull();
+  });
+
+  test('user without jwt (resolve-via-api-key path) returns user but jwt=null', () => {
+    // /auth/resolve sets user but no JWT. Marketplace will 401 — correct
+    // behavior, not this fix's job to mint a JWT here.
+    const cache = recordResolvedUser({ user: { id: 'u' }, prevCache: null });
+    const r = projectAuthStatus(cache);
+    expect(r.user).toEqual({ id: 'u' });
+    expect(r.jwt).toBeNull();
+  });
+
+  test('authenticated reflects the live hasApiKey override (not the cache value)', () => {
+    // The route passes the apiKeyManager's CURRENT view; cache might be stale.
+    const cache = recordOAuthResult({ user: { id: 'u' }, jwt: 'x', hasApiKey: true });
+    const r = projectAuthStatus(cache, { hasApiKey: false });
+    expect(r.authenticated).toBe(false);
+  });
+
+  test('falls back to cache.hasApiKey when no override given', () => {
+    const cache = recordOAuthResult({ user: { id: 'u' }, jwt: 'x', hasApiKey: true });
+    const r = projectAuthStatus(cache);
+    expect(r.authenticated).toBe(true);
+  });
+});
+
+// ─── End-to-end scenario coverage (the actual bug story) ──────────────
+
+describe('full scenario: OAuth → resolve → polling fallback (the bug we fixed)', () => {
+  test('happy path: OAuth callback → poll status → JWT returned', () => {
+    // 1. User signs in via OAuth. /auth/callback runs:
+    let cache = recordOAuthResult({
+      user: { id: 'u1', email: 'alice@example.com' },
+      jwt: 'oauth-issued-jwt',
+      hasApiKey: true,
+    });
+    // 2. WebSocket broadcast misses (page reload). FE polls /api/auth/status:
+    const status = projectAuthStatus(cache, { hasApiKey: true });
+    // 3. Polling response now contains jwt → FE writes to localStorage → marketplace auth works
+    expect(status.user.email).toBe('alice@example.com');
+    expect(status.jwt).toBe('oauth-issued-jwt');
+  });
+
+  test('OAuth then resolve: JWT survives the resolve-overwrite', () => {
+    // 1. OAuth login caches everything including the JWT.
+    let cache = recordOAuthResult({
+      user: { id: 'u1' }, jwt: 'oauth-jwt', hasApiKey: true,
+    });
+    // 2. Frontend later hits /auth/resolve (e.g. on a fresh page load
+    //    where API key is already set). Without the fix this would have
+    //    overwritten cache.jwt = undefined.
+    cache = recordResolvedUser({
+      user: { id: 'u1', email: 'alice@example.com' },
+      prevCache: cache,
+    });
+    // 3. Subsequent /api/auth/status caller still gets the JWT.
+    const status = projectAuthStatus(cache);
+    expect(status.jwt).toBe('oauth-jwt');
+    expect(status.user.email).toBe('alice@example.com');
+  });
+
+  test('API-key-only flow: user resolves but no marketplace auth available', () => {
+    // No prior OAuth — the user pasted an API key in Settings and the
+    // /auth/resolve path linked their account from the backend.
+    let cache = recordResolvedUser({ user: { id: 'u' }, prevCache: null });
+    const status = projectAuthStatus(cache);
+    expect(status.user).toEqual({ id: 'u' });
+    expect(status.jwt).toBeNull();
+    // Marketplace will 401 with "Authentication required" — the fix
+    // for that case is server-to-server JWT minting in /auth/resolve,
+    // out of scope for this PR.
+  });
+
+  test('polling for a NEW login but cache is from an OLDER one: not the auth we\'re waiting for', () => {
+    // A previous user signed out, a new user is mid-login, FE polls.
+    const oldCache = recordOAuthResult({
+      user: { id: 'old-user' }, jwt: 'old-jwt', hasApiKey: true,
+      timestamp: '2026-01-01T00:00:00Z',
+    });
+    // FE called /api/auth/status?since=<just-now>
+    const status = projectAuthStatus(oldCache, { since: '2026-05-03T12:00:00Z' });
+    // user=null + jwt=null so the FE keeps polling, doesn't sign in as the wrong user.
+    expect(status.user).toBeNull();
+    expect(status.jwt).toBeNull();
+  });
+});