dream: signed session cookies (tamper-evident sid) + 11 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/dream/tests/session.sx

@@ -1,4 +1,4 @@
-;; lib/dream/tests/session.sx — cookies, store, session round-trip.
+;; lib/dream/tests/session.sx — cookies, store, session round-trip, signed cookies.
 
 (define dream-ss-pass 0)
 (define dream-ss-fail 0)
@@ -65,6 +65,19 @@
     "Max-Age=0")
   true)
 
+;; ── signed cookie values ───────────────────────────────────────────
+(dream-ss-test
+  "sign/unsign roundtrip"
+  (dream-cookie-unsign "k" (dream-cookie-sign "k" "s5"))
+  "s5")
+(dream-ss-test
+  "unsign wrong secret"
+  (dream-cookie-unsign "k2" (dream-cookie-sign "k" "s5"))
+  nil)
+(dream-ss-test "unsign tampered" (dream-cookie-unsign "k" "s5.999") nil)
+(dream-ss-test "unsign no dot" (dream-cookie-unsign "k" "s5") nil)
+(dream-ss-test "unsign nil" (dream-cookie-unsign "k" nil) nil)
+
 ;; ── in-memory store ────────────────────────────────────────────────
 (define dream-ss-store (dream-memory-sessions))
 (define dream-ss-sid (dream-ss-store {:op "session/create"}))
@@ -93,7 +106,6 @@
         (dream-text (str "count=" (+ n 1)))))))
 (define dream-ss-app ((dream-sessions dream-ss-backend) dream-ss-counter-h))
 
-;; first request: no cookie -> creates session, sets cookie
 (define dream-ss-r1 (dream-ss-app (dream-request "GET" "/" {} "")))
 (dream-ss-test "first body count=1" (dream-resp-body dream-ss-r1) "count=1")
 (dream-ss-test
@@ -109,7 +121,6 @@
   (contains? (first (dream-resp-cookies dream-ss-r1)) "HttpOnly")
   true)
 
-;; second request: carries the cookie -> reuses, sees prior count, no new cookie
 (define dream-ss-r2 (dream-ss-app (dream-request "GET" "/" {:Cookie "dream.session=s1"} "")))
 (dream-ss-test "second body count=2" (dream-resp-body dream-ss-r2) "count=2")
 (dream-ss-test
@@ -117,11 +128,9 @@
   (len (dream-resp-cookies dream-ss-r2))
   0)
 
-;; third request continues
 (define dream-ss-r3 (dream-ss-app (dream-request "GET" "/" {:Cookie "dream.session=s1"} "")))
 (dream-ss-test "third body count=3" (dream-resp-body dream-ss-r3) "count=3")
 
-;; unknown cookie id -> fresh session created
 (define dream-ss-r4 (dream-ss-app (dream-request "GET" "/" {:Cookie "dream.session=bogus"} "")))
 (dream-ss-test
   "bogus id starts fresh"
@@ -133,11 +142,6 @@
   1)
 
 ;; ── session-all + invalidate via middleware ────────────────────────
-(define
-  dream-ss-inspect-h
-  (fn (req) (dream-text (str (dream-session-all req)))))
-(define dream-ss-app2 ((dream-sessions dream-ss-backend) dream-ss-inspect-h))
-(define dream-ss-r5 (dream-ss-app2 (dream-request "GET" "/" {:Cookie "dream.session=s1"} "")))
 (dream-ss-test
   "session-all shows count"
   (dream-session-all
@@ -153,4 +157,41 @@
 (dream-ss-app3 (dream-request "GET" "/" {:Cookie "dream.session=s1"} ""))
 (dream-ss-test "invalidate clears store" (dream-ss-backend {:op "session/exists" :sid "s1"}) false)
 
+;; ── signed session middleware ──────────────────────────────────────
+(define dream-ss-sbackend (dream-memory-sessions))
+(define
+  dream-ss-sapp
+  ((dream-sessions-signed dream-ss-sbackend "topsecret")
+    (fn (req) (dream-text (dream-session-id req)))))
+
+(define dream-ss-sr1 (dream-ss-sapp (dream-request "GET" "/" {} "")))
+(dream-ss-test "signed first sid" (dream-resp-body dream-ss-sr1) "s1")
+(dream-ss-test
+  "signed cookie is signed"
+  (contains? (first (dream-resp-cookies dream-ss-sr1)) "dream.session=s1.")
+  true)
+
+;; forged plaintext sid (no signature) is rejected -> a fresh session is made
+(dream-ss-test
+  "forged plaintext rejected -> new session"
+  (dream-resp-body (dream-ss-sapp (dream-request "GET" "/" {:Cookie "dream.session=s1"} "")))
+  "s2")
+
+;; a validly-signed cookie reuses the session
+(define dream-ss-signed-val (dream-cookie-sign "topsecret" "s1"))
+(define dream-ss-sr3 (dream-ss-sapp (dream-request "GET" "/" {:Cookie (str "dream.session=" dream-ss-signed-val)} "")))
+(dream-ss-test "valid signed reuses s1" (dream-resp-body dream-ss-sr3) "s1")
+(dream-ss-test
+  "valid signed sets no new cookie"
+  (len (dream-resp-cookies dream-ss-sr3))
+  0)
+
+;; a cookie signed with the wrong secret is rejected
+(dream-ss-test
+  "wrong-secret signed rejected"
+  (=
+    (dream-resp-body (dream-ss-sapp (dream-request "GET" "/" {:Cookie (str "dream.session=" (dream-cookie-sign "other" "s1"))} "")))
+    "s1")
+  false)
+
 (define dream-ss-tests-run! (fn () {:total (+ dream-ss-pass dream-ss-fail) :passed dream-ss-pass :failed dream-ss-fail :fails dream-ss-fails}))