From 5d29ac13715cd613e6435e9f9166d36fc57df943 Mon Sep 17 00:00:00 2001 From: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Date: Fri, 11 Sep 2026 18:23:08 -0300 Subject: [PATCH] test(auth): session fixtures mint the real login shape (authenticated: true) Refs #13298 --- tests/unit/cli-tools-apply-opencode-jsonc.test.ts | 2 +- tests/unit/cli-tools-keys-route.test.ts | 2 +- tests/unit/codex-settings-wire-api-default.test.ts | 2 +- tests/unit/dashboard-session-token-13298.test.ts | 1 + .../unit/dashboard-session-verifier-source-guard.test.ts | 8 ++++---- tests/unit/embeddings-route-apikeymeta-6929.test.ts | 2 +- tests/unit/feature-flags-route-virtual-lanes.test.ts | 2 +- tests/unit/guide-settings-route.test.ts | 2 +- .../unit/hermes-agent-settings-route-keyid-10711.test.ts | 2 +- tests/unit/image-generation-route-auth.test.ts | 2 +- tests/unit/playground-key-policy-3503.test.ts | 2 +- tests/unit/qwen-settings-route.test.ts | 2 +- 12 files changed, 15 insertions(+), 14 deletions(-) diff --git a/tests/unit/cli-tools-apply-opencode-jsonc.test.ts b/tests/unit/cli-tools-apply-opencode-jsonc.test.ts index 69dde22adb..3eee8ced0b 100644 --- a/tests/unit/cli-tools-apply-opencode-jsonc.test.ts +++ b/tests/unit/cli-tools-apply-opencode-jsonc.test.ts @@ -24,7 +24,7 @@ const testRoots = new Set(); async function createAuthCookie(): Promise { process.env.JWT_SECRET = "test-cli-tools-apply-secret"; const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const token = await new SignJWT({ sub: "test-user" }) + const token = await new SignJWT({ authenticated: true, sub: "test-user" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h") diff --git a/tests/unit/cli-tools-keys-route.test.ts b/tests/unit/cli-tools-keys-route.test.ts index 2c69c714c0..240d3810a2 100644 --- a/tests/unit/cli-tools-keys-route.test.ts +++ b/tests/unit/cli-tools-keys-route.test.ts @@ -12,7 +12,7 @@ const originalApiKeySecret = process.env.API_KEY_SECRET; async function createAuthCookie() { process.env.JWT_SECRET = "test-cli-tools-keys-secret"; const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const token = await new SignJWT({ sub: "test-user" }) + const token = await new SignJWT({ authenticated: true, sub: "test-user" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h") diff --git a/tests/unit/codex-settings-wire-api-default.test.ts b/tests/unit/codex-settings-wire-api-default.test.ts index 7b7d5fd32d..24bb20276e 100644 --- a/tests/unit/codex-settings-wire-api-default.test.ts +++ b/tests/unit/codex-settings-wire-api-default.test.ts @@ -18,7 +18,7 @@ const route = await import("../../src/app/api/cli-tools/codex-settings/route.ts" const authCookie = async (): Promise => { process.env.JWT_SECRET = "codex-wire-api-default-test-secret"; - const token = await new SignJWT({ sub: "codex-wire-api-default-test" }) + const token = await new SignJWT({ authenticated: true, sub: "codex-wire-api-default-test" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h") diff --git a/tests/unit/dashboard-session-token-13298.test.ts b/tests/unit/dashboard-session-token-13298.test.ts index e732ee693d..be2a16f8bb 100644 --- a/tests/unit/dashboard-session-token-13298.test.ts +++ b/tests/unit/dashboard-session-token-13298.test.ts @@ -5,6 +5,7 @@ * secret — notably the Cursor CLI passthrough token (iss "omniroute", aud * "cursor-cli", no claim) — is NOT a session. */ +import "../_setup/isolateDataDir.ts"; import { test } from "node:test"; import assert from "node:assert/strict"; import { SignJWT } from "jose"; diff --git a/tests/unit/dashboard-session-verifier-source-guard.test.ts b/tests/unit/dashboard-session-verifier-source-guard.test.ts index 518a05f30b..d91d444748 100644 --- a/tests/unit/dashboard-session-verifier-source-guard.test.ts +++ b/tests/unit/dashboard-session-verifier-source-guard.test.ts @@ -1,8 +1,8 @@ /** * #13298 source guard: every consumer of the `auth_token` cookie must verify it * through verifyDashboardSessionToken (which requires `authenticated: true`). - * A bare jose `jwtVerify(` in one of these files re-opens the forgeable-session - * hole (Cursor CLI tokens share JWT_SECRET). + * A bare jose `jwtVerify` (called or aliased) in one of these files re-opens the + * forgeable-session hole (Cursor CLI tokens share JWT_SECRET). */ import { test } from "node:test"; import assert from "node:assert/strict"; @@ -22,8 +22,8 @@ const VERIFIERS = [ for (const rel of VERIFIERS) { test(`${rel} verifies auth_token only through verifyDashboardSessionToken`, () => { const src = fs.readFileSync(path.join(ROOT, rel), "utf8"); - assert.match(src, /verifyDashboardSessionToken/, "must import/use the shared verifier"); - assert.doesNotMatch(src, /\bjwtVerify\s*\(/, "bare jwtVerify( is the #13298 regression"); + assert.match(src, /verifyDashboardSessionToken\s*\(/, "must call the shared verifier"); + assert.doesNotMatch(src, /\bjwtVerify\b/, "any bare jwtVerify is the #13298 regression"); }); } diff --git a/tests/unit/embeddings-route-apikeymeta-6929.test.ts b/tests/unit/embeddings-route-apikeymeta-6929.test.ts index d3e6862979..b6898311af 100644 --- a/tests/unit/embeddings-route-apikeymeta-6929.test.ts +++ b/tests/unit/embeddings-route-apikeymeta-6929.test.ts @@ -49,7 +49,7 @@ test.after(() => { async function sessionCookie(): Promise { const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const jwt = await new SignJWT({ sub: "admin" }) + const jwt = await new SignJWT({ authenticated: true, sub: "admin" }) .setProtectedHeader({ alg: "HS256" }) .setExpirationTime("1h") .sign(secret); diff --git a/tests/unit/feature-flags-route-virtual-lanes.test.ts b/tests/unit/feature-flags-route-virtual-lanes.test.ts index 1332a9cc28..4428c3e203 100644 --- a/tests/unit/feature-flags-route-virtual-lanes.test.ts +++ b/tests/unit/feature-flags-route-virtual-lanes.test.ts @@ -37,7 +37,7 @@ type FlagPayload = { async function authCookie(): Promise { process.env.JWT_SECRET = "test-feature-flags-route-secret"; const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const token = await new SignJWT({ sub: "test-user" }) + const token = await new SignJWT({ authenticated: true, sub: "test-user" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h") diff --git a/tests/unit/guide-settings-route.test.ts b/tests/unit/guide-settings-route.test.ts index 8fcb89615f..a4c668bac4 100644 --- a/tests/unit/guide-settings-route.test.ts +++ b/tests/unit/guide-settings-route.test.ts @@ -21,7 +21,7 @@ const originalJwtSecret = process.env.JWT_SECRET; async function createAuthCookie() { process.env.JWT_SECRET = "test-cli-tools-secret"; const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const token = await new SignJWT({ sub: "test-user" }) + const token = await new SignJWT({ authenticated: true, sub: "test-user" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h") diff --git a/tests/unit/hermes-agent-settings-route-keyid-10711.test.ts b/tests/unit/hermes-agent-settings-route-keyid-10711.test.ts index 206fbde245..3071627e5f 100644 --- a/tests/unit/hermes-agent-settings-route-keyid-10711.test.ts +++ b/tests/unit/hermes-agent-settings-route-keyid-10711.test.ts @@ -45,7 +45,7 @@ test.after(() => { async function authCookie(): Promise { const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const jwt = await new SignJWT({ sub: "admin" }) + const jwt = await new SignJWT({ authenticated: true, sub: "admin" }) .setProtectedHeader({ alg: "HS256" }) .setExpirationTime("1h") .sign(secret); diff --git a/tests/unit/image-generation-route-auth.test.ts b/tests/unit/image-generation-route-auth.test.ts index 03a2912832..1618c1c534 100644 --- a/tests/unit/image-generation-route-auth.test.ts +++ b/tests/unit/image-generation-route-auth.test.ts @@ -203,7 +203,7 @@ test("v1 image generation POST accepts a dashboard session when REQUIRE_API_KEY try { const { SignJWT } = await import("jose"); - const token = await new SignJWT({ sub: "dashboard" }) + const token = await new SignJWT({ authenticated: true, sub: "dashboard" }) .setProtectedHeader({ alg: "HS256" }) .setExpirationTime("1h") .sign(new TextEncoder().encode(process.env.JWT_SECRET)); diff --git a/tests/unit/playground-key-policy-3503.test.ts b/tests/unit/playground-key-policy-3503.test.ts index 67263d8444..fce4bb6446 100644 --- a/tests/unit/playground-key-policy-3503.test.ts +++ b/tests/unit/playground-key-policy-3503.test.ts @@ -32,7 +32,7 @@ const KEY_SECRET = created.key; async function sessionCookie(): Promise { const secret = new TextEncoder().encode(process.env.JWT_SECRET); - const jwt = await new SignJWT({ sub: "admin" }) + const jwt = await new SignJWT({ authenticated: true, sub: "admin" }) .setProtectedHeader({ alg: "HS256" }) .setExpirationTime("1h") .sign(secret); diff --git a/tests/unit/qwen-settings-route.test.ts b/tests/unit/qwen-settings-route.test.ts index 60f998e92d..62e1ccc856 100644 --- a/tests/unit/qwen-settings-route.test.ts +++ b/tests/unit/qwen-settings-route.test.ts @@ -19,7 +19,7 @@ const route = await import("../../src/app/api/cli-tools/qwen-settings/route.ts") const authCookie = async (): Promise => { process.env.JWT_SECRET = "qwen-settings-route-test-secret"; - const token = await new SignJWT({ sub: "qwen-route-test" }) + const token = await new SignJWT({ authenticated: true, sub: "qwen-route-test" }) .setProtectedHeader({ alg: "HS256" }) .setIssuedAt() .setExpirationTime("1h")