Devlog #13

Fixed two critical auth bugs, both related to the auth package; the fixes are already in the PRs (not merged yet, waiting for CI).

sqlite session store silently overwritten created_at (#175)

Postgres store used ON CONFLICT (token) DO UPDATE, which does not update created_at column on purpose; therefore, on each re-login with the same token, the created_at would remain the same, signifying that the session was created at the same time. However, the sqlite had a different approach of INSERT OR REPLACE which replaced the whole row, including created_at. This PR changes the sqlite version to use the explicit upsert so that both databases behave the same way. Also adds a regression test that purposely creates a session, re-logins with the same token/data and checks that created_at was not changed. The postgres tests are skipped for local DATABASE_URL absent.

AuthGuardResult lied on success (#177)

AuthGuardResult was a type { ok: boolean; status: 401 | 403; reason: string }, and on success, the guard returned { ok: true, status: 401, reason: “” }, i.e., a 401 status code with an empty reason string. It was not a problem because toMiddleware always checked result.ok first, but it was a silent bug for anyone who tried to check result.status on success. Now it is properly represented as a discriminated union type { ok: true } | { ok: false; status: 401 | 403; reason: string }, and the status and reason fields are not present on success. All tests were adjusted to narrow the type with if (!result.ok) { … }, and a new test checks that TypeScript actually narrows the type.