fix(auth): prevent device registration replay

cloudflare/tests/devices_routes.test.ts

@@ -208,7 +208,7 @@ describe("device routes", () => {
       },
     });
     assert.ok(d1.queries[0]?.includes("INSERT INTO user_devices"));
-    assert.ok(d1.queries[0]?.includes("ON CONFLICT(user_id, idempotency_key) DO NOTHING"));
+    assert.ok(d1.queries[0]?.includes("ON CONFLICT DO NOTHING"));
     assert.ok(d1.queries[1]?.includes("WHERE user_id = ? AND idempotency_key = ?"));
     assert.ok(d1.queries[2]?.includes("better_auth_session_device_context"));
     assert.deepEqual(d1.binds[0]?.slice(0, 5), [
@@ -273,6 +273,113 @@ describe("device routes", () => {
     assert.deepEqual(kvPuts, []);
   });
 
+  it("rejects an unbound session replaying any existing device registration", async () => {
+    for (const status of ["pending", "approved", "revoked"] as const) {
+      const existingDevice = {
+        device_id: "device-01",
+        public_key: PUBLIC_KEY,
+        device_name: "MacBook Pro",
+        platform: "macOS",
+        approval_status: status,
+        created_at: 1_780_000_000,
+        approved_at: status === "pending" ? null : 1_780_000_010,
+        last_active_at: 1_780_000_020,
+        revoked_at: status === "revoked" ? 1_780_000_030 : null,
+      };
+      const d1 = testD1Database({
+        firstRows: [existingDevice],
+        runChanges: [0],
+        sessionRow: {
+          id: "session-02",
+          userId: "user-01",
+          expiresAt: "2099-01-01T00:00:00.000Z",
+          deviceId: null,
+        },
+      });
+
+      const response = await handleRequest(
+        new Request("https://elydora.test/api/devices/register", {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${ACCESS_TOKEN}`,
+            "content-type": "application/json",
+          },
+          body: JSON.stringify(deviceRegistrationBody()),
+        }),
+        testEnv({ d1 }),
+      );
+
+      assert.equal(response.status, 409, status);
+      assert.deepEqual(await response.json(), { error: "device_registration_conflict" });
+      assert.equal(d1.queries.some((query) => query.includes("session_device_context")), false);
+    }
+  });
+
+  it("allows an exact idempotent retry from the already bound session", async () => {
+    const pendingDevice = {
+      device_id: "device-01",
+      public_key: PUBLIC_KEY,
+      device_name: "MacBook Pro",
+      platform: "macOS",
+      approval_status: "pending",
+      created_at: 1_780_000_000,
+      approved_at: null,
+      last_active_at: 1_780_000_020,
+      revoked_at: null,
+    };
+    const d1 = testD1Database({ firstRows: [pendingDevice], runChanges: [0] });
+
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/register", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify(deviceRegistrationBody()),
+      }),
+      testEnv({ d1 }),
+    );
+
+    assert.equal(response.status, 201);
+    assert.equal(
+      ((await response.json()) as { device: { device_id: string } }).device.device_id,
+      "device-01",
+    );
+    assert.equal(d1.queries.some((query) => query.includes("session_device_context")), false);
+  });
+
+  it("rejects a device id collision with a different idempotency key", async () => {
+    const d1 = testD1Database({
+      firstRows: [],
+      runChanges: [0],
+      sessionRow: {
+        id: "session-02",
+        userId: "user-01",
+        expiresAt: "2099-01-01T00:00:00.000Z",
+        deviceId: null,
+      },
+    });
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/register", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({
+          ...deviceRegistrationBody(),
+          idempotency_key: "device-register-0002",
+        }),
+      }),
+      testEnv({ d1 }),
+    );
+
+    assert.equal(response.status, 409);
+    assert.deepEqual(await response.json(), { error: "device_registration_conflict" });
+    assert.equal(d1.queries.some((query) => query.includes("session_device_context")), false);
+  });
+
   it("rejects invalid device registration payloads before D1 writes", async () => {
     const tokenHash = await authTokenHash(ACCESS_TOKEN);
     const d1 = testD1Database([]);

cloudflare/tests/devices_test_support.ts

@@ -40,6 +40,7 @@ export interface RecordedR2Put {
 interface TestD1DatabaseOptions {
   allRows?: unknown[];
   firstRows?: unknown[];
+  runChanges?: number[];
   sessionRow?: unknown | null;
 }
 
@@ -114,6 +115,7 @@ export function testD1Database(rows: unknown[] | TestD1DatabaseOptions): Recorde
       ? rows.sessionRow ?? null
       : DEFAULT_AUTH_SESSION_ROW;
   let firstIndex = 0;
+  let runIndex = 0;
   return {
     authBinds,
     authQueries,
@@ -130,6 +132,7 @@ export function testD1Database(rows: unknown[] | TestD1DatabaseOptions): Recorde
         isAuthSessionQuery ? authBinds : binds,
         isAuthSessionQuery,
         sessionRow,
+        () => (!Array.isArray(rows) ? rows.runChanges?.[runIndex++] : undefined) ?? 1,
       );
     },
     batch(statements: ElyD1PreparedStatement[]) {
@@ -159,6 +162,7 @@ function testD1PreparedStatement(
   binds: unknown[][],
   isAuthSessionQuery: boolean,
   sessionRow: unknown | null,
+  nextRunChanges: () => number,
 ): ElyD1PreparedStatement {
   return {
     bind(...values: unknown[]) {
@@ -175,7 +179,7 @@ function testD1PreparedStatement(
       return Promise.resolve({ results: allRows as T[] });
     },
     run() {
-      return Promise.resolve({});
+      return Promise.resolve({ results: [], meta: { changes: nextRunChanges() } });
     },
   };
 }