test(auth): reconcile db_sessions with LC-514 hashed session id #497

Merged

nrupard merged 1 commit from fix/LC-520-db-sessions-hashed-id-tests into main

2026-07-01 16:11:57 +02:00

nrupard commented

2026-07-01 16:07:42 +02:00

Owner

LC-514 (PR #496) hashed session tokens at rest: create_session* now stores SHA-256(token) as sessions.id and returns the raw cookie token, so SessionRow.id is the hash and every production lookup hashes the presented cookie before the WHERE (get_user_by_session, touch_session_last_seen, delete_session*, and the settings is_current / revoke paths). Production is internally consistent, but server/tests/db_sessions.rs still assumed sessions.id == raw token and was not reconciled, so three tests failed on main (b271392): the list correlation (find r.id == a1), the expiry-filter UPDATE ... WHERE id = ?, and the touch-last-seen correlation each compared a raw token against a hashed id. That left just test red, and the mandatory pre-commit gate (just pre-commit -> check test) aborted every commit, blocking all repo work (LC-515 in particular).

This reconciles the three tests to the hashed-id contract via the existing public db::auth::hash_session_token helper, correlating sessions by the hash the same way the settings UI does. No production change: fixing this in server/src/ would re-introduce the plaintext-cookie-at-rest vulnerability LC-514 closed. delete_session_for_user_is_user_scoped already passed because delete_session_for_user runs the presented value through lookup_session_id (which hashes a raw token). Comments record the contract so the hash-based correlation is not mistaken for a bug later.

Verification (containerized ./dev/cargo): db_sessions 4/4 pass; full just pre-commit (check + just test) green (163/163 test binaries ok, clippy standalone+saas, fmt); just test-saas green.

This is the prerequisite for LC-515 (migration-immutability guard), which is blocked until main is green again.

Fixes LC-520.

LC-514 (PR #496) hashed session tokens at rest: `create_session*` now stores `SHA-256(token)` as `sessions.id` and returns the raw cookie token, so `SessionRow.id` is the hash and every production lookup hashes the presented cookie before the WHERE (`get_user_by_session`, `touch_session_last_seen`, `delete_session*`, and the settings `is_current` / revoke paths). Production is internally consistent, but `server/tests/db_sessions.rs` still assumed `sessions.id == raw token` and was not reconciled, so three tests failed on `main` (b271392): the list correlation (`find r.id == a1`), the expiry-filter `UPDATE ... WHERE id = ?`, and the touch-last-seen correlation each compared a raw token against a hashed id. That left `just test` red, and the mandatory pre-commit gate (`just pre-commit` -> `check test`) aborted every commit, blocking all repo work (LC-515 in particular). This reconciles the three tests to the hashed-id contract via the existing public `db::auth::hash_session_token` helper, correlating sessions by the hash the same way the settings UI does. No production change: fixing this in `server/src/` would re-introduce the plaintext-cookie-at-rest vulnerability LC-514 closed. `delete_session_for_user_is_user_scoped` already passed because `delete_session_for_user` runs the presented value through `lookup_session_id` (which hashes a raw token). Comments record the contract so the hash-based correlation is not mistaken for a bug later. Verification (containerized `./dev/cargo`): `db_sessions` 4/4 pass; full `just pre-commit` (check + `just test`) green (163/163 test binaries ok, clippy standalone+saas, fmt); `just test-saas` green. This is the prerequisite for LC-515 (migration-immutability guard), which is blocked until `main` is green again. Fixes LC-520.

nrupard added 1 commit

2026-07-01 16:07:42 +02:00

test(auth): reconcile db_sessions with LC-514 hashed session id

check-secrets / Kingfisher (push) Successful in 4s

Details

check-secrets / TruffleHog (push) Successful in 4s

Details

check-secrets / Nosey parker (push) Successful in 5s

Details

check-secrets / Nosey parker (pull_request) Successful in 4s

Details

check-secrets / TruffleHog (pull_request) Successful in 5s

Details

check-secrets / Kingfisher (pull_request) Successful in 6s

Details

Check / clippy + fmt + tests (pull_request) Successful in 4m2s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

5a6a8a04be

LC-514 stores SHA-256(token) as sessions.id and returns the raw cookie token from create_session*, so SessionRow.id is the hash and every production lookup hashes the presented cookie before the WHERE. server/tests/db_sessions.rs still assumed sessions.id == the raw token, so three tests failed on main: the list correlation (find r.id == a1), the expiry-filter UPDATE WHERE id = ?, and the touch-last-seen correlation, each comparing a raw token against a hashed id. That left just test red and blocked every commit through the mandatory pre-commit gate.

Reconcile the three tests to the hashed-id contract via the public db::auth::hash_session_token helper; no production change. delete_session_for_user_is_user_scoped already passed because delete_session_for_user hashes the presented value before the WHERE.

#LC-520

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>