auth: add signed session/transaction cookie mint and parse

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/auth/session_test.go

@@ -0,0 +1,84 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+const testSecret = "test-secret-at-least-32-bytes-long!"
+
+func TestMintAndParseSessionCookie(t *testing.T) {
+	claims := Claims{Sub: "u1", Name: "Alice", Email: "alice@example.com"}
+	cookie, err := MintSessionCookie(claims, []byte(testSecret), time.Hour, true)
+	if err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	if cookie.Name != SessionCookieName || !cookie.HttpOnly || !cookie.Secure {
+		t.Fatalf("cookie = %+v, want name=%s HttpOnly+Secure", cookie, SessionCookieName)
+	}
+
+	got, err := ParseSessionCookie(cookie, []byte(testSecret))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if got != claims {
+		t.Fatalf("got %+v, want %+v", got, claims)
+	}
+}
+
+func TestParseSessionCookie_Expired(t *testing.T) {
+	cookie, err := MintSessionCookie(Claims{Sub: "u1"}, []byte(testSecret), -time.Hour, false)
+	if err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	if _, err := ParseSessionCookie(cookie, []byte(testSecret)); err == nil {
+		t.Fatal("expected error for expired cookie")
+	}
+}
+
+func TestParseSessionCookie_Tampered(t *testing.T) {
+	cookie, err := MintSessionCookie(Claims{Sub: "u1"}, []byte(testSecret), time.Hour, false)
+	if err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	cookie.Value = cookie.Value[:len(cookie.Value)-1] + "x"
+	if _, err := ParseSessionCookie(cookie, []byte(testSecret)); err == nil {
+		t.Fatal("expected error for tampered cookie")
+	}
+}
+
+func TestParseSessionCookie_WrongSecret(t *testing.T) {
+	cookie, err := MintSessionCookie(Claims{Sub: "u1"}, []byte(testSecret), time.Hour, false)
+	if err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	if _, err := ParseSessionCookie(cookie, []byte("a-completely-different-secret!!")); err == nil {
+		t.Fatal("expected error for wrong secret")
+	}
+}
+
+func TestMintAndParseTxnCookie(t *testing.T) {
+	txn := TxnState{State: "abc123", CodeVerifier: "verifier-xyz"}
+	cookie, err := MintTxnCookie(txn, []byte(testSecret), false)
+	if err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	if cookie.Name != TxnCookieName {
+		t.Fatalf("cookie name = %q, want %q", cookie.Name, TxnCookieName)
+	}
+
+	got, err := ParseTxnCookie(cookie, []byte(testSecret))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if got != txn {
+		t.Fatalf("got %+v, want %+v", got, txn)
+	}
+}
+
+func TestClearCookie(t *testing.T) {
+	c := ClearCookie(SessionCookieName, true)
+	if c.Value != "" || c.MaxAge >= 0 {
+		t.Fatalf("ClearCookie = %+v, want empty value and negative MaxAge", c)
+	}
+}