/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
ApiInterface doesn't implement the session/login methods needed to run the
shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
db instance (previously a no-op that never ran) via a new getReadonlyDb
parameter, wired up for both sqlite and api backends.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
codingetandClaude