fix: update tests for lazy JWT validation and atomic rate limiter

- Make JWT secret validation lazy (not at module import time)
- Update rate-limit test to mock $transaction and expect fail-closed
- Set JWT_SECRET in vitest setup for all test environments
- Extend CI JWT_SECRET to 44 chars (was 28, below 32-char minimum)

Author: projectamazonph

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
           --health-retries 5
 
     env:
-      JWT_SECRET: ci-only-do-not-use-in-prod
+      JWT_SECRET: ci-only-do-not-use-in-prod-abcdef1234567890
       DATABASE_URL: postgresql://postgres:postgres@localhost:5432/interviewlab_test
       # Auth/API rate limits are tuned tight for production; the live-server
       # integration suite below makes far more requests per minute than a

__tests__/lib/rate-limit.test.ts

@@ -4,9 +4,20 @@ const findUnique = vi.fn();
 const upsert = vi.fn();
 const update = vi.fn();
 const deleteMany = vi.fn();
+const transaction = vi.fn((cb: (tx: unknown) => Promise<unknown>) =>
+  cb({
+    rateLimitEntry: {
+      findUnique: (...args: unknown[]) => findUnique(...args),
+      upsert: (...args: unknown[]) => upsert(...args),
+      update: (...args: unknown[]) => update(...args),
+      deleteMany: (...args: unknown[]) => deleteMany(...args),
+    },
+  })
+);
 
 vi.mock('@/lib/db', () => ({
   db: {
+    $transaction: (...args: unknown[]) => transaction(...args),
     rateLimitEntry: {
       findUnique: (...args: unknown[]) => findUnique(...args),
       upsert: (...args: unknown[]) => upsert(...args),
@@ -24,6 +35,7 @@ describe('checkRateLimit', () => {
     upsert.mockReset();
     update.mockReset();
     deleteMany.mockReset();
+    transaction.mockClear();
   });
 
   it('allows the first request for a new key and creates an entry with count 1', async () => {
@@ -86,12 +98,12 @@ describe('checkRateLimit', () => {
     expect(findUnique).toHaveBeenCalledWith({ where: { key: 'auth-register:1.2.3.4' } });
   });
 
-  it('fails open (allows the request) if the database throws', async () => {
+  it('fails closed (denies the request) if the database throws', async () => {
     findUnique.mockRejectedValue(new Error('connection lost'));
 
     const result = await checkRateLimit('1.2.3.4', 'auth-login', 10, 60_000);
 
-    expect(result).toEqual({ allowed: true, remaining: 10 });
+    expect(result).toEqual({ allowed: false, remaining: 0 });
   });
 });
 

__tests__/setup.ts

@@ -1,3 +1,4 @@
+process.env.JWT_SECRET = "ci-test-secret-that-is-at-least-32-chars-long";
 import '@testing-library/jest-dom';
 
 // Only set up browser mocks in jsdom environment

src/lib/session.ts

@@ -13,12 +13,14 @@ import { SignJWT, jwtVerify } from 'jose';
 import { cookies } from 'next/headers';
 import { NextRequest, NextResponse } from 'next/server';
 
-// JWT_SECRET must be configured with at least 32 characters
-const rawSecret = process.env.JWT_SECRET;
-if (!rawSecret || rawSecret.length < 32) {
-  throw new Error("JWT_SECRET must be configured with at least 32 characters");
+// Validate JWT_SECRET lazily (not at module import time) so tests can set it
+function getJwtSecret(): Uint8Array {
+  const rawSecret = process.env.JWT_SECRET;
+  if (!rawSecret || rawSecret.length < 32) {
+    throw new Error("JWT_SECRET must be configured with at least 32 characters");
+  }
+  return new TextEncoder().encode(rawSecret);
 }
-const JWT_SECRET = new TextEncoder().encode(rawSecret);
 
 const TOKEN_NAME = 'interviewlab_session';
 const TOKEN_MAX_AGE = 24 * 60 * 60; // 24 hours in seconds
@@ -41,7 +43,7 @@ export async function createSession(
     .setProtectedHeader({ alg: 'HS256' })
     .setIssuedAt()
     .setExpirationTime(`${TOKEN_MAX_AGE}s`)
-    .sign(JWT_SECRET);
+    .sign(getJwtSecret());
 
   const cookieOptions = {
     name: TOKEN_NAME,
@@ -69,7 +71,7 @@ export async function verifySession(request: NextRequest): Promise<SessionPayloa
     const token = request.cookies.get(TOKEN_NAME)?.value;
     if (!token) return null;
 
-    const { payload } = await jwtVerify(token, JWT_SECRET);
+    const { payload } = await jwtVerify(token, getJwtSecret());
 
     return {
       sub: payload.sub as string,
@@ -87,7 +89,7 @@ export async function verifySession(request: NextRequest): Promise<SessionPayloa
  */
 export async function verifyToken(token: string): Promise<SessionPayload | null> {
   try {
-    const { payload } = await jwtVerify(token, JWT_SECRET);
+    const { payload } = await jwtVerify(token, getJwtSecret());
     return {
       sub: payload.sub as string,
       email: payload.email as string,