descrybe/apps/api/internal/httpapi/session_dedupe_test.go

package httpapi

import (
	"context"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/alexedwards/scs/v2"
	"github.com/descrybe/descrybe-v2/apps/api/internal/config"
)

// ctxOnlyStore mimics pgxstore: the plain scs.Store methods PANIC and only the
// *Ctx variants work. DedupeSessionCookies must use FindCtx for such stores.
type ctxOnlyStore struct {
	tokens map[string]bool
}

func (s *ctxOnlyStore) Find(string) ([]byte, bool, error)            { panic("missing context arg") }
func (s *ctxOnlyStore) Commit(string, []byte, time.Time) error       { panic("missing context arg") }
func (s *ctxOnlyStore) Delete(string) error                          { panic("missing context arg") }
func (s *ctxOnlyStore) FindCtx(_ context.Context, token string) ([]byte, bool, error) {
	return []byte("x"), s.tokens[token], nil
}
func (s *ctxOnlyStore) CommitCtx(_ context.Context, token string, _ []byte, _ time.Time) error {
	s.tokens[token] = true
	return nil
}
func (s *ctxOnlyStore) DeleteCtx(_ context.Context, token string) error {
	delete(s.tokens, token)
	return nil
}

func dedupeTestServer(t *testing.T) (*Server, *scs.SessionManager) {
	t.Helper()
	sm := scs.New() // in-memory store
	return &Server{
		Config: config.Config{
			SessionCookieName: "descrybe_session",
			WebOrigin:         "https://descrybe.io",
			PublicAPIURL:      "https://api.descrybe.io",
			SessionIdleHours:  24,
		},
		Sessions: sm,
	}, sm
}

func TestDedupeSessionCookies_staleShadowsValid(t *testing.T) {
	t.Parallel()
	s, sm := dedupeTestServer(t)
	if err := sm.Store.Commit("valid-token", []byte("x"), time.Now().Add(time.Hour)); err != nil {
		t.Fatal(err)
	}

	var seen string
	h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, err := r.Cookie("descrybe_session")
		if err != nil {
			t.Fatalf("session cookie missing downstream: %v", err)
		}
		seen = c.Value
		if n := len(r.Cookies()); n != 2 { // csrf + single session cookie
			t.Fatalf("cookies=%d want 2 (%v)", n, r.Cookies())
		}
	}))

	req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
	// Browser order: older (stale host-only) cookie first — it used to shadow
	// the fresh Domain cookie and 401 every request.
	req.Header.Set("Cookie", "descrybe_session=stale-relic; descrybe_csrf=tok; descrybe_session=valid-token")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)

	if seen != "valid-token" {
		t.Fatalf("downstream token=%q want valid-token", seen)
	}
	res := rec.Result()
	var deleted, reissued bool
	for _, c := range res.Cookies() {
		if c.Name != "descrybe_session" {
			continue
		}
		if c.MaxAge < 0 && c.Domain == "" {
			deleted = true // host-only relic expired
		}
		if c.Value == "valid-token" && c.Domain == "descrybe.io" && c.MaxAge > 0 {
			reissued = true // surviving token re-issued on the parent domain
		}
	}
	if !deleted || !reissued {
		t.Fatalf("want host-only deletion + domain re-issue, got %v", res.Cookies())
	}
}

func TestDedupeSessionCookies_ctxOnlyStoreNoPanic(t *testing.T) {
	t.Parallel()
	// Regression: production pgxstore panics on plain Find ("missing context
	// arg") — the middleware must go through FindCtx.
	s, sm := dedupeTestServer(t)
	sm.Store = &ctxOnlyStore{tokens: map[string]bool{"valid-token": true}}

	var seen string
	h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, err := r.Cookie("descrybe_session")
		if err != nil {
			t.Fatalf("session cookie missing downstream: %v", err)
		}
		seen = c.Value
	}))
	req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
	req.Header.Set("Cookie", "descrybe_session=stale-relic; descrybe_session=valid-token")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req) // must not panic
	if seen != "valid-token" {
		t.Fatalf("downstream token=%q want valid-token", seen)
	}
}

func TestDedupeSessionCookies_singleCookieUntouched(t *testing.T) {
	t.Parallel()
	s, _ := dedupeTestServer(t)
	h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if c, err := r.Cookie("descrybe_session"); err != nil || c.Value != "only-one" {
			t.Fatalf("cookie changed: %v %v", c, err)
		}
	}))
	req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
	req.Header.Set("Cookie", "descrybe_session=only-one")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if n := len(rec.Result().Cookies()); n != 0 {
		t.Fatalf("single cookie must not trigger Set-Cookie, got %v", rec.Result().Cookies())
	}
}

func TestDedupeSessionCookies_noValidTokenKeepsNewest(t *testing.T) {
	t.Parallel()
	s, _ := dedupeTestServer(t)
	var seen string
	h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, _ := r.Cookie("descrybe_session")
		seen = c.Value
	}))
	req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
	req.Header.Set("Cookie", "descrybe_session=old-stale; descrybe_session=new-stale")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if seen != "new-stale" {
		t.Fatalf("want newest cookie kept, got %q", seen)
	}
}