Test existing authentication and site assignment contracts

[stefan-burke]

This adds four new test files that lock in behaviour already present on main. No production code is touched.

What is added

• test/shared/db/api-key-attempts.test.ts — locks the API-key rate limiter at its limit, and proves the API-key counter is separate from the login counter.
• test/shared/db/login-attempts.test.ts — locks the login lockout deadline and the cleared-after-success behaviour.
• test/shared/site-assignment/contracts.test.ts — locks the validation, renewal push, and setup email contracts for built-site assignment.
• test/shared/db/users/contracts.test.ts — locks the user display/auth field, cache, invite lifecycle, KEK migration, key handoff, and keyless activation contracts.

Why

These contracts are exercised by current behaviour but did not have their own dedicated test files. Pulling them out into focused files makes regressions easier to localise and keeps mutation runs cheap (each module maps to the narrow test file that covers it).

How

The three complete files are copied from a maintenance branch snapshot (commit 079d3b32). The users contract file is the same snapshot minus the imports for the not-yet-landed addUserOwnedAccessRecords/getUserOwnedRowSources helper and minus its final test that needed them. With those removed, the file is self-consistent on main. All earlier user contract tests are kept intact.

Verification

• nix develop -c deno task test:files on the four new files — 32 tests pass.
• nix develop -c deno task lint:ci — clean.
• nix develop -c deno task precommit — green (typecheck, lint, cpd, build, full suite).
• Scope is exactly four new test files: 527 insertions, 0 deletions, no src/ changes.

Summary by CodeRabbit

• Tests
  • Expanded coverage for API-key and login attempt limits, including lockout timing and reset behavior.
  • Added comprehensive validation for user account management, invitations, activation, caching, and credential migrations.
  • Added coverage for site assignment configuration, renewals, notifications, and setup emails.
  • These improvements help ensure more reliable security controls, account workflows, and site setup experiences.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 67350e69-a678-47c5-a825-558af9ff1e35

📥 Commits

Reviewing files that changed from the base of the PR and between 857cbf7 and 701c965.

📒 Files selected for processing (4)

• test/shared/db/api-key-attempts.test.ts
• test/shared/db/login-attempts.test.ts
• test/shared/db/users/contracts.test.ts
• test/shared/site-assignment/contracts.test.ts

---

📝 Walkthrough

Walkthrough

This change adds database-backed tests for API-key and login attempt limiting, user database contracts, and site-assignment configuration, validation, renewal, notification, and email behavior.

Changes

Contract test coverage

Layer / File(s)	Summary
Attempt limiter persistence and isolation test/shared/db/api-key-attempts.test.ts, test/shared/db/login-attempts.test.ts	Tests API-key and login thresholds, persisted lock state, deadline-based expiry, limiter isolation, and clearing failed-login rows.
User database contract scenarios test/shared/db/users/contracts.test.ts	Tests user retrieval, caching and invalidation, activation, username checks, invite states, key handoff, and KEK migration.
Site assignment contract scenarios test/shared/site-assignment/contracts.test.ts	Tests assignment configuration and validation, renewal persistence, failed token rotation notifications, and single-site or multi-site setup emails.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the new test coverage for authentication and site-assignment contracts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch work/existing-contract-coverage

---

_{Comment @coderabbitai help to get the list of available commands.}