fix: harden identity HTTP transport

docs/development/testing.md

@@ -14,15 +14,21 @@ module migration discovery, identity schema drift detection, formatting, linting
 Migration-runner unit tests use a narrow database/session port to prove deterministic planning,
 approval, transaction orchestration, cleanup, and sanitized errors. They do not claim to prove
 PostgreSQL behavior. Identity unit tests cover branded opaque-ID contracts, principal shapes,
-configuration validation (secret, base URL, and trusted-origin rules), the Core identity runtime
-(explicit construction, exact schema mapping, only email/password and rate limiting enabled,
-sanitized failures, and that a database outage during principal resolution is never silently
-reported as anonymous), and Core migration discovery (deterministic ordering, the reserved `core`
-identity, and collision rejection) — all without a live database. `apps/api`'s own unit tests cover
-its pure Hono app factory (route shapes, CORS allow/deny/preflight, deterministic 404 and sanitized
-error responses), its runtime configuration, and that importing any of its modules — including the
-executable server module without calling its exported `main` — never reads the environment,
-connects to PostgreSQL, or starts a server.
+configuration validation (secret, base URL, and trusted-origin rules), bounded/validated
+connection and operation (`query_timeout`/`statement_timeout`) database timeouts, the Core identity
+runtime (explicit construction, exact schema mapping, only email/password and rate limiting
+enabled, an explicit `advanced.disableCSRFCheck`/`disableOriginCheck: false` pair, an explicit
+error-only sanitized logger that strips Better Auth's own message and arguments regardless of what
+they contain, pinned 8–128 password-length bounds, sanitized failures, and that a database outage
+during principal resolution is never silently reported as anonymous), and Core migration discovery
+(deterministic ordering, the reserved `core` identity, and collision rejection) — all without a
+live database. `apps/api`'s own unit tests cover its pure Hono app factory (route shapes, CORS
+allow/deny/preflight, deterministic 404 and sanitized error responses), its runtime configuration,
+its idempotent shutdown lifecycle (concurrent callers share one server-close-then-pool-close
+promise; a startup failure after the pool was already created still closes it; `SIGINT`/`SIGTERM`
+wiring is exercised through an injectable exit function rather than the real `process.exit`), and
+that importing any of its modules — including the executable server module without calling its
+exported `main` — never reads the environment, connects to PostgreSQL, or starts a server.
 
 `pnpm verify` is intentionally Docker-free. It never plans or applies migrations against a live
 database.
@@ -65,13 +71,26 @@ automatic session, per `autoSignIn: false`), explicit sign-in producing a host-o
 anonymous shapes, sign-out actually invalidating the session, a malformed or missing cookie
 resolving as anonymous, duplicate sign-up creating no second identity row, two distinct accounts
 producing identical principal shapes with no elevation and no owner/role/permission data at the
-database level, no plaintext password ever stored, CORS never returning an allow-origin header for
+database level, no plaintext password ever stored, the exact 8–128 password-length boundary (7
+rejected, 8 accepted, 128 accepted, 129 rejected), CORS never returning an allow-origin header for
 an untrusted origin, Better Auth's handler being unreachable outside `/api/auth/*`, a database
 outage during principal resolution producing a sanitized `503` rather than a false anonymous `200`,
 starting the API against an unmigrated database creating no tables at all, and a clean listener/pool
-shutdown. See [ADR 0011](../architecture/decisions/0011-identity-http-transport-and-public-enrollment.md)
-for one CSRF/origin guarantee that was verified manually against the real server but could not be
-reproduced reliably inside this test runner, and is documented rather than silently asserted.
+shutdown.
+
+The same suite also proves Better Auth's own origin/CSRF protection is production-equivalent under
+the test runner, not just in a plain Node script: a no-cookie first authentication attempt succeeds
+from a trusted browser origin and is rejected (`403`, no permissive CORS header, no leaked detail)
+from an untrusted one; a cookie-bearing state-changing request (sign-out) is rejected the same way
+from an untrusted origin, and the presented session remains valid afterward, proving the rejected
+request never reached sign-out logic. See
+[ADR 0012](../architecture/decisions/0012-identity-origin-csrf-protection-under-test.md) for why
+this previously could not be reproduced reliably under Vitest (Better Auth's own default silently
+skips these checks whenever `isTest()` is true, unless `advanced.disableOriginCheck` is set
+explicitly) and how the fix removes that gap entirely. A further scenario forces a real identity
+database failure and asserts, against actual `console.error`/`warn`/`log` output, that Better
+Auth's own internal error logging — configured explicitly in `core/src/identity/runtime.ts` — never
+emits a raw exception, SQL, connection detail, or the rejected request's origin.
 
 CI runs the same command in the dedicated `migration-smoke` job. After this change is merged, add
 the following pull-request status context to `main` branch protection: