test: pin /api/gate fail-closed, the beacon allowlist, and verify mismatch

[cursor]

Coverage for production paths that shipped without tests, and that #112/#114 do not already pin.

Risky behavior now covered

• Gate store (POST /api/gate): the /gate page still posts answers here one question at a time. Unparseable or out-of-range bodies never reach the Rust service. An unreachable or rejecting gate is 503 before the INSERT, and the client error never carries answer text or the gate's body. A well-formed answer is posted to /api/store without X-Gate-Key. The fresh_gate_responses INSERT still binds NULL for both plaintext answer columns.
• Client metrics beacon (POST /api/metrics/increment): only the allowlisted names move a counter. A server-only funnel name (funnel.gate.q1_answered) is a silent no-op. Allowed and disallowed responses are the same 200 { ok: true } with Cache-Control: no-store, so the list cannot be walked by status code. Membership is exact, not a prefix.
• Magic-link verify (GET /auth/verify): missing tokens, a garbage JWT, and a resume token that does not hash to the JWT session_id all fail before the database and set no cookie. Failure pages do not echo the email, the JWT, or the resume token.
• Wearable invitation (GET /w/:token): traversal-shaped, short, long, and punctuation tokens 404 before any query and set no cookie, so the page is not an existence oracle.
• Database URL parse: localhost disables TLS even when sslmode=require is in the URL; a remote sslmode=require enables it; URL-encoded password characters are decoded; an unparseable URL is not a config.
• Gate startup log (redact_db_url): userinfo is stripped, including a password that itself contains @. A schemeless string is <redacted>, not echoed.

Test files added/updated

• routes/api/gate_test.ts (new)
• routes/api/metrics/increment_test.ts (new)
• routes/auth/verify_test.ts (new)
• routes/w/token_test.ts (new)
• lib/db_config_test.ts (new)
• lib/db.ts — _resolveConfigForTest hook only
• rust-server/src/main.rs — unit tests for redact_db_url
• .github/workflows/ci.yml — these Deno suites, plus cargo test for the gate

Why these tests materially reduce regression risk

/api/gate is the other door answers enter through. #113 collapsed the questionnaire onto lib/gate_encrypt.ts and tested that client plus /api/questions/answer; this endpoint was still untested, so a plaintext INSERT or a 200-on-gate-down path would ship again. The beacon allowlist is public: a prefix match or a leaked 4xx would let anyone invent conversions the daily report treats as truth. Verify mismatch before the database is what stops a stolen JWT fragment from minting cookies. Wearable format 404 is what keeps a printed token from becoming an oracle or a cookie injection. redact_db_url is the line that logs DATABASE_URL on every gate start — the password used to go to journald.

Hermetic: fetch is stubbed, DATABASE_URL is unparseable, no SMTP, no Postgres. No production behavior changes.

  

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}