fix: reject expired sessions on sockets, api key desktop links and 192.0.0.0/24

src/backend/tests/utils/auth-manager-token.test.ts

@@ -19,7 +19,10 @@ vi.mock("../../database/db/index.js", () => ({
 vi.mock("../../database/repositories/factory.js", () => ({
   createCurrentSettingsRepository: () => ({ get: async () => null }),
   createCurrentSessionRepository: () => ({
-    findById: async (id: string) => ({ id }),
+    findById: async (id: string) =>
+      id === "expired"
+        ? { id, expiresAt: new Date(Date.now() - 1000).toISOString() }
+        : { id },
   }),
   createCurrentUserRepository: () => ({}),
   createCurrentApiKeyRepository: () => ({}),
@@ -151,6 +154,15 @@ describe("AuthManager token handling", () => {
     expect(await authManager.verifyJWTToken(token)).toBeNull();
   });
 
+  it("rejects a token whose session has expired", async () => {
+    const token = jwt.sign(
+      { userId: "user-1", sessionId: "expired" },
+      jwtSecret,
+      { expiresIn: "1h" },
+    );
+    expect(await authManager.verifyJWTToken(token)).toBeNull();
+  });
+
   it("still accepts the sessionless pending second-factor token", async () => {
     const token = jwt.sign({ userId: "user-1", pendingTOTP: true }, jwtSecret, {
       expiresIn: "10m",

src/backend/tests/utils/safe-outbound-fetch.test.ts

@@ -22,6 +22,7 @@ describe("isBlockedAddress", () => {
     expect(isBlockedAddress("192.168.1.1")).toBe(true);
     expect(isBlockedAddress("127.0.0.1")).toBe(true);
     expect(isBlockedAddress("169.254.1.1")).toBe(true);
+    expect(isBlockedAddress("192.0.0.170")).toBe(true);
     expect(isBlockedAddress("100.64.0.1")).toBe(true);
   });