Merge pull request #703 from Jagadeeshftw/test/683-auth-lifecycle

test: cover full wallet auth lifecycle

Author: Jagadeeshftw

docs/auth/session.md

@@ -8,6 +8,12 @@ runtime behavior, tests, and this doc aligned — see
 [src/auth/session.test.ts](src/auth/session.test.ts) for the tests that pin
 down every rule below.
 
+The cross-module wallet flow is covered by
+[`src/routes/auth.test.ts`](../../src/routes/auth.test.ts): it drives the real
+Express app through challenge, signed verification, bearer logout, replay,
+expiry, and post-revocation rejection. The test uses a deterministic signer
+and replaces only the external RPC/database boundaries.
+
 ## Session authorization contract & security boundaries
 
 ### Caller roles & authorization requirements

src/routes/auth.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import request from "supertest";
 import express from "express";
 import crypto from "node:crypto";
+import { Account, type TypedData } from "starknet";
 
 const { dbMock, schemaMock, mockState, eqMock, orMock, ltMock, isNotNullMock, mockProvider } = vi.hoisted(() => {
   const mockState = {
@@ -96,7 +97,14 @@ const { dbMock, schemaMock, mockState, eqMock, orMock, ltMock, isNotNullMock, mo
   return { dbMock: db, schemaMock: schema, mockState, eqMock, orMock, ltMock, isNotNullMock, mockProvider };
 });
 
-vi.mock("../db/index.js", () => ({ db: dbMock, schema: schemaMock }));
+vi.mock("../db/index.js", () => ({
+  db: dbMock,
+  schema: schemaMock,
+  checkDbHealth: vi.fn().mockResolvedValue(true),
+  getPoolStats: vi.fn().mockReturnValue({ total: 0, idle: 0, active: 0, waiting: 0 }),
+  closePool: vi.fn().mockResolvedValue(undefined),
+  waitForDbReadiness: vi.fn().mockResolvedValue(undefined),
+}));
 vi.mock("../db/schema.js", () => ({ sessions: schemaMock.sessions }));
 vi.mock("drizzle-orm", () => ({
   eq: eqMock,
@@ -123,6 +131,11 @@ vi.mock("../config.js", () => ({
 vi.mock("../starknet/client.js", () => ({
   provider: mockProvider,
   getCachedNetworkInfo: vi.fn().mockResolvedValue({ chainId: "0x534e5f5345504f4c4941" }),
+  getEscrowAbi: vi.fn().mockReturnValue([]),
+  getAgreementAbi: vi.fn().mockReturnValue([]),
+  getCircuitBreakerSnapshots: vi.fn().mockReturnValue([]),
+  agreementContract: vi.fn(),
+  escrowContract: vi.fn(),
 }));
 
 import { authRouter, rebuildAdminSet } from "./auth.js";
@@ -133,6 +146,7 @@ import {
 } from "./auth-metrics.js";
 import { lockouts } from "../auth/lockout.js";
 import { clearChallengesForTesting } from "../auth/challenge.js";
+import { app } from "../index.js";
 
 /**
  * Issue #193: locks the authorization contract for every route on this
@@ -344,6 +358,52 @@ describe("Auth Routes Integration", () => {
     expect(logoutPostLogoutRes.status).toBe(401);
   });
 
+  it("covers the wallet lifecycle through the real app with signed and invalidated requests", async () => {
+    const address = "0x123456789abcdef";
+    const signer = new Account({ provider: mockProvider as any, address, signer: "0x1" });
+
+    const challenge = await request(app)
+      .post("/api/v1/auth/challenge")
+      .send({ address })
+      .expect(200);
+    const signature = await signer.signMessage(challenge.body.typed_data as TypedData);
+    mockProvider.verifyMessageInStarknet.mockResolvedValue(true);
+
+    const verified = await request(app)
+      .post("/api/v1/auth/verify")
+      .send({ address, signature: [signature.r.toString(), signature.s.toString()] })
+      .expect(200);
+    const token = verified.body.session_token as string;
+
+    await request(app)
+      .post("/api/v1/auth/logout")
+      .set("x-user-address", address)
+      .set("authorization", `Bearer ${token}`)
+      .expect(200);
+
+    await request(app)
+      .post("/api/v1/auth/logout")
+      .set("x-user-address", address)
+      .set("authorization", `Bearer ${token}`)
+      .expect(401);
+
+    await request(app)
+      .post("/api/v1/auth/verify")
+      .send({ address, signature: [signature.r.toString(), signature.s.toString()] })
+      .expect(400);
+
+    const expiredAddress = "0x123456789abcdf0";
+    await request(app)
+      .post("/api/v1/auth/challenge")
+      .send({ address: expiredAddress })
+      .expect(200);
+    vi.advanceTimersByTime(300_001);
+    await request(app)
+      .post("/api/v1/auth/verify")
+      .send({ address: expiredAddress, signature: ["0x1", "0x2"] })
+      .expect(400);
+  });
+
   it("rejects verify once the challenge TTL has elapsed", async () => {
     const address = "0xeeee000000000001";
     const appInstance = makeApp();
@@ -997,7 +1057,6 @@ describe("Auth Routes Integration", () => {
     });
   });
 });
-});
 
 // ---------------------------------------------------------------------------
 // rebuildAdminSet / isAdminAddress — pre-built Set contract