Which One Should You Ship?

// Accept BOTH credentials during the migration. Old clients keep working;
// new clients use tokens. Remove the cookie branch once traffic is zero.
async function authenticate(req, res, next) {
  // 1. Bearer first — new clients
  const header = req.get('authorization') ?? '';
  if (/^bearer /i.test(header)) {
    try {
      const claims = jwt.verify(header.slice(7), ACCESS_SECRET, {
        algorithms: ['HS256'], issuer: ISSUER, audience: AUDIENCE,
      });
      req.user = { id: claims.sub, via: 'token' };
      return next();
    } catch {
      return unauthorized(res, 'invalid_token');
    }
  }

  // 2. Session cookie — old clients
  const data = readSession(req.cookies[COOKIE]);
  if (data) {
    req.user = { id: data.userId, via: 'cookie' };
    // CSRF protection still applies to THIS branch only.
    return csrf(req, res, next);
  }

  return unauthorized(res, 'authentication_required');
}

// Instrument it, so "can we delete the cookie path?" has a data-backed answer.
app.use((req, res, next) => {
  res.on('finish', () => {
    if (req.user) metrics.increment('auth.request', { via: req.user.via });
  });
  next();
});

// Migration order that never leaves users signed out:
//   1. Add token issuance alongside sessions (this middleware)
//   2. Ship a frontend that prefers tokens, falls back to the cookie
//   3. Watch auth.request{via=cookie} fall to zero
//   4. Delete the cookie branch, the CSRF middleware and the session store

// These assertions are scheme-independent. If either version fails one,
// it is not ready regardless of which credential it uses.

describe('authentication', () => {
  it('rejects an unauthenticated request', async () => {
    expect((await request(app).get('/api/notes')).status).toBe(401);
  });

  it('rejects a tampered credential', async () => {
    const bad = validCredential.slice(0, -1) + 'X';
    expect((await withCredential(request(app).get('/api/notes'), bad)).status).toBe(401);
  });

  it('does not reveal whether an email is registered', async () => {
    const unknown = await login('[email protected]', 'whatever-password');
    const wrongPw = await login('[email protected]', 'wrong-password');
    expect(unknown.body).toEqual(wrongPw.body);          // identical message
    expect(unknown.status).toBe(wrongPw.status);
  });
});

describe('authorization', () => {
  it("does not return another user's notes", async () => {
    const { body } = await withCredential(request(app).get('/api/notes'), aliceCred);
    expect(body.notes.every((n) => n.userId === alice.id)).toBe(true);
  });

  it("returns 404 — not 403 — for another user's note", async () => {
    const res = await withCredential(
      request(app).delete(`/api/notes/${bobNote.id}`), aliceCred);
    expect(res.status).toBe(404);          // never confirm it exists
  });
});

describe('lifecycle', () => {
  it('invalidates the credential on logout', async () => {
    const cred = await loginAs(alice);
    await withCredential(request(app).post('/auth/logout'), cred);
    // Cookie version: immediate. Token version: the refresh family is dead,
    // so this holds as soon as the access token expires.
    expect((await withCredential(request(app).get('/api/notes'), cred)).status)
      .toBe(401);
  });

  it('rate limits repeated failures', async () => {
    const results = [];
    for (let i = 0; i < 25; i++) results.push(await login('[email protected]', 'wrong'));
    expect(results.some((r) => r.status === 429)).toBe(true);
  });
});