fix: harden SSO ticket flow and revoke tickets on logout

Reuse the outstanding auth_ticket instead of minting a fresh one on every
/client load, so reloading the page or opening a second tab no longer
invalidates a game session that is still connecting. New tickets are minted
with a guard against the previously-read value so concurrent launches
converge on the same ticket.

Revoke the auth_ticket when signing out (toolbar, header and sign-out
everywhere) so a leaked ticket can no longer be replayed against the
emulator, and prevent SSO leakage via referral by setting no-referrer on the
client iframe. Strip all whitespace from the ticket prefix and build the
launch URL through a tested helper that handles query strings, existing sso
params and URL fragments correctly.

src/lib/auth/sso-ticket.test.ts

@@ -1,15 +1,31 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { generateSsoTicket } from "./sso-ticket";
+import { generateSsoTicket, isValidTicketShape } from "./sso-ticket";
 
 const UUID_RE =
 	/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 
+const VALID_UUID = "12345678-1234-4123-8123-123456789abc";
+
+const readState = vi.hoisted(() => ({ authTicket: "" }));
+
+const mockLimit = vi.hoisted(() => ({
+	limit: () => Promise.resolve([{ authTicket: readState.authTicket }]),
+}));
 const mockWhere = vi.hoisted(() => vi.fn().mockResolvedValue(undefined));
-const mockSet = vi.hoisted(() => vi.fn(() => ({ where: mockWhere })));
+const mockSet = vi.hoisted(() =>
+	vi.fn((values: { authTicket?: string; ipCurrent?: string }) => {
+		if (values.authTicket !== undefined)
+			readState.authTicket = values.authTicket;
+		return { where: mockWhere };
+	}),
+);
 const mockUpdate = vi.hoisted(() => vi.fn(() => ({ set: mockSet })));
+const mockSelect = vi.hoisted(() =>
+	vi.fn(() => ({ from: () => ({ where: () => mockLimit }) })),
+);
 
 vi.mock("@/lib/db", () => ({
-	db: { update: mockUpdate },
+	db: { select: mockSelect, update: mockUpdate },
 	User: { id: "id" },
 }));
 
@@ -20,10 +36,10 @@ describe("generateSsoTicket", () => {
 		expect(UUID_RE.test(t.slice("AtomHotel-".length))).toBe(true);
 	});
 
-	it("strips every space in the hotel name", () => {
-		expect(generateSsoTicket("My Cool Hotel").startsWith("MyCoolHotel-")).toBe(
-			true,
-		);
+	it("strips every whitespace char in the hotel name", () => {
+		expect(
+			generateSsoTicket("My\tCool\nHotel").startsWith("MyCoolHotel-"),
+		).toBe(true);
 	});
 
 	it("produces a fresh ticket each call", () => {
@@ -31,19 +47,43 @@ describe("generateSsoTicket", () => {
 	});
 });
 
+describe("isValidTicketShape", () => {
+	it("accepts a matching hotel-prefixed UUID", () => {
+		expect(isValidTicketShape("Atom Hotel", `AtomHotel-${VALID_UUID}`)).toBe(
+			true,
+		);
+	});
+
+	it("rejects a ticket with a different hotel prefix", () => {
+		expect(isValidTicketShape("Atom", `Other-${VALID_UUID}`)).toBe(false);
+	});
+
+	it("rejects junk", () => {
+		expect(isValidTicketShape("Atom", "")).toBe(false);
+		expect(isValidTicketShape("Atom", "Atom-not-a-uuid")).toBe(false);
+		expect(isValidTicketShape("Atom", "Atom-")).toBe(false);
+	});
+});
+
 describe("issueSsoTicket", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
-		mockSet.mockReturnValue({ where: mockWhere });
-		mockUpdate.mockReturnValue({ set: mockSet });
+		readState.authTicket = "";
+		mockSet.mockImplementation(
+			(values: { authTicket?: string; ipCurrent?: string }) => {
+				if (values.authTicket !== undefined)
+					readState.authTicket = values.authTicket;
+				return { where: mockWhere };
+			},
+		);
 		mockWhere.mockResolvedValue(undefined);
 	});
 
-	it("writes auth_ticket AND ip_current and returns the ticket", async () => {
+	it("mints a ticket and writes auth_ticket + ip_current", async () => {
 		const { issueSsoTicket } = await import("./sso-ticket");
 		const ticket = await issueSsoTicket(42, "Atom Hotel", "1.2.3.4");
-
 		expect(ticket.startsWith("AtomHotel-")).toBe(true);
+		expect(UUID_RE.test(ticket.slice("AtomHotel-".length))).toBe(true);
 		expect(mockUpdate).toHaveBeenCalled();
 		expect(mockSet).toHaveBeenCalledWith({
 			authTicket: ticket,
@@ -51,4 +91,34 @@ describe("issueSsoTicket", () => {
 		});
 		expect(mockWhere).toHaveBeenCalled();
 	});
+
+	it("reuses the outstanding ticket on the next call", async () => {
+		const { issueSsoTicket } = await import("./sso-ticket");
+		const first = await issueSsoTicket(42, "Atom Hotel", "1.1.1.1");
+		vi.clearAllMocks();
+
+		const second = await issueSsoTicket(42, "Atom Hotel", "2.2.2.2");
+		expect(second).toBe(first);
+	});
+
+	it("only refreshes the IP when reusing", async () => {
+		const { issueSsoTicket } = await import("./sso-ticket");
+		await issueSsoTicket(42, "Atom Hotel", "1.1.1.1");
+		vi.clearAllMocks();
+
+		await issueSsoTicket(42, "Atom Hotel", "2.2.2.2");
+		expect(mockSet).toHaveBeenCalledWith({ ipCurrent: "2.2.2.2" });
+		expect(mockSet).not.toHaveBeenCalledWith(
+			expect.objectContaining({ authTicket: expect.any(String) }),
+		);
+	});
+
+	it("rotates a stale ticket whose prefix no longer matches the hotel", async () => {
+		const { issueSsoTicket } = await import("./sso-ticket");
+		readState.authTicket = `OtherHotel-${VALID_UUID}`;
+
+		const ticket = await issueSsoTicket(42, "Atom Hotel", "1.1.1.1");
+		expect(ticket.startsWith("AtomHotel-")).toBe(true);
+		expect(readState.authTicket).toBe(ticket);
+	});
 });