test(auth): cover session store failure, store swap, and generic OAuth2

[abdelkabirouadoukou]

Closes the auth failure paths coverage-debt gap.

Changes

• Fail closed on store outage: getSession() now catches session-store
  lookup errors (DB down / connection lost), logs a warning, and returns null
  instead of propagating the error — so /api/auth/session responds 401
  rather than crashing with a 500 on every authenticated request.
  • Behavior change for @thexjs/auth → patch changeset added.
• New packages/auth/src/auth-failures.test.ts (7 tests):
  • Store outage → getSession() returns null; /api/auth/session returns
    401, not 500.
  • Store swap: config.store is the live store reference, so a mid-flight
    swap takes effect but does not migrate sessions (old store keeps them
    intact, so swapping back restores access).
  • A fresh store never sees prior sessions — migration must be explicit.
  • Generic (non-GitHub) OAuth2 provider completes the full sign-in →
    callback → session flow, including custom token params, userinfo profile
    mapping, and state-challenge rejection.
• ROADMAP: Auth row added to the API stability matrix (auth.test.ts +
  auth-failures.test.ts).

Verification

• bun run lint — clean
• bun run typecheck — clean
• bun test — 208 pass / 6 skip / 0 fail
• bunx @changesets/cli status --since origin/main — passes

Summary by CodeRabbit

• Bug Fixes

  • Authentication now fails safely when the session store is unavailable, treating requests as signed out instead of returning server errors.
  • Authenticated requests receive a proper 401 response during session-store outages.
  • OAuth flows now correctly handle authorization, callbacks, token parameters, profile creation, and invalid state values.

• Tests

  • Expanded coverage for authentication failure scenarios and OAuth provider integrations.

• Documentation

  • Updated the API stability matrix to mark authentication as stable and tested.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thexjs-basic	Ready	Preview	Aug 8, 2026 5:18pm
x	Ready	Preview	Aug 8, 2026 5:18pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bd237ded-1579-4568-abfd-9f470532c067

📥 Commits

Reviewing files that changed from the base of the PR and between 15e7c63 and 79c4c3f.

📒 Files selected for processing (4)

• .changeset/auth-session-fail-closed.md
• ROADMAP.md
• packages/auth/src/auth-failures.test.ts
• packages/auth/src/auth.ts

---

📝 Walkthrough

Walkthrough

getSession() now treats session-store failures as signed-out sessions. Authentication tests cover 401 responses, store replacement, and generic OAuth2 provider flows. The changeset and roadmap record the new behavior and API stability status.

Changes

Authentication failure and provider flows

Layer / File(s)	Summary
Fail-closed session handling packages/auth/src/auth.ts, packages/auth/src/auth-failures.test.ts, .changeset/auth-session-fail-closed.md, ROADMAP.md	getSession() logs session-store lookup failures and returns null. Tests verify that session endpoints return 401 responses. The changeset and roadmap record the behavior and stability status.
Session-store replacement packages/auth/src/auth-failures.test.ts	SQLite tests verify immediate store replacement, no session migration, preservation in the original store, and access after switching back.
Generic OAuth2 provider coverage packages/auth/src/auth-failures.test.ts	Tests cover custom-provider redirects, OAuth parameters, token exchange, profile mapping, session creation, parameter forwarding, cleanup, and invalid OAuth state.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• abdelkabirouadoukou/x#24: Extends the getSession logic and authentication failure-path tests.

Suggested labels: enhancement, javascript

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: session-store failure coverage, store replacement, and generic OAuth2 testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/coverage-debt-auth-failures

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}