Danijel Martinek 4d6734448a test(auth): cover signToken/verifyToken/validateSession crypto paths ...

The session methods had zero coverage because they call getPayload()
(audit finding B8). Stub the payload module (secret + findByID only) and
exercise the real crypto paths: round-trip, tampered signature, swapped
payload, expired exp, malformed segments, wrong secret, jti-less token
(fail closed), post-revocation rejection, and the per-instance denylist
limit. No running Payload needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 17:26:01 +02:00

..

src

test(auth): cover signToken/verifyToken/validateSession crypto paths

2026-07-10 17:26:01 +02:00

tests

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00

AGENTS.md

docs(adr): rename ADR-012 — drop Lazar; update title + content + cross-refs

2026-05-13 10:07:37 +02:00

CHANGELOG.md

feat: hybrid versioning + automated CHANGELOG via release-please

2026-05-13 17:17:16 +02:00

eslint.config.js

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

package.json

build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

2026-07-10 16:44:48 +02:00

stryker.config.json

feat(coverage): pnpm mutate (Stryker) + L3 implementation

2026-05-13 16:31:30 +02:00

tsconfig.json

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

turbo.json

feat(auth): scaffold empty package with feature tag + path aliases

2026-05-05 00:37:13 +02:00

vitest.config.ts

feat(core-shared/conformance): manifest coverage schema + vitest helper

2026-05-13 13:51:13 +02:00