feat: Write end-to-end auth flow tests

[charliewwdev]

Cover: GitHub OAuth happy path, token refresh, logout, expired token rejection, revoked token rejection, CSRF rejection. Run against a real test DB and stubbed GitHub API.

---

Generated by OpenDev AI

Built a self-contained GitHub OAuth auth module under src/auth/ using only Node built-ins and the existing pg dependency — no new production dependencies required.

Architecture:

• types.ts — shared interfaces for users, sessions, token responses, and config
• github-oauth.ts — thin wrappers around GitHub's OAuth and API endpoints using the global fetch; each function throws on error with a descriptive message
• session-store.ts — PostgreSQL-backed store owning its own DDL (auth_users, auth_sessions); sessions are identified by a 32-byte random hex ID and carry a separate CSRF token
• csrf.ts — in-memory state store for the OAuth state parameter; tokens are single-use (deleted on first validation attempt) and expire after 10 minutes
• server.ts — bare Node http.Server with five routes: GET /auth/github, GET /auth/github/callback, POST /auth/refresh, POST /auth/logout, GET /auth/me

Key design decisions:

1. Single-use CSRF states prevent replay attacks; the state is deleted whether validation succeeds or fails
2. Session IDs are 256-bit random tokens (not JWTs) so they can be revoked server-side by setting revoked_at
3. Token refresh updates the session in-place rather than creating a new session, so the client ID stays stable
4. The migrate() method uses CREATE TABLE IF NOT EXISTS so the service is safe to restart without manual DB setup

Test strategy:

• Real PostgreSQL database (uses TEST_DATABASE_URL env or falls back to postgres://opendev:opendev_secret@localhost:5432/opendev_test)
• GitHub API stubbed by replacing globalThis.fetch; the stub passes localhost calls through to the real fetch so server↔test-client traffic is unaffected
• Tables are created in beforeAll and dropped in afterAll; rows are truncated between each test for isolation
• Six scenario groups mirror the six required flows: happy path, token refresh, logout, expired token, revoked token, CSRF rejection