test(auth): prove disabledPaths is wired, not just declared

[chriskehayias]

Summary

Closes a test gap found while verifying the F-UPDATE-USER advisory (session identity reassignable via /update-user) against this repo.

The code fix is present and correct — disabledPaths carries all six paths and is wired at auth.ts:347. The tests were the problem: they asserted only that disabledAuthPaths, an exported array constant, contains those paths. Nothing tied that array to the running router.

Verified by doing it, not inferred: commenting out disabledPaths: disabledAuthPaths deleted the defense-in-depth control outright, and the entire 805-test suite stayed green.

Why route.test.ts didn't already cover this

It reads like it does, which is the trap. It mocks @/lib/auth to {} and mocks toNextJsHandler, so it exercises the allowlist wrapper against a stub. That's correct for what it tests — and its negative control is genuine — but it never reaches real Better Auth. No test in the suite drove the real router.

What these tests do

They call auth.handler with real Request objects, deliberately bypassing Next.js routing and the allowlist. The allowlist is the primary control; disabledPaths is the layer behind it. The advisory is explicit that the allowlist is an addition, not a replacement, so both must hold independently.

Test	Asserts
POST /update-user with the advisory's exact payload (a well-formed foreign User_GUID)	404
Every other disabledAuthPaths entry, table-driven	404
CONTROL: /get-session	not 404

The control is what stops the block passing vacuously — a handler that 404s everything (bad base path, broken instance) would otherwise satisfy every assertion above it.

/update-user is refused on the path, before body parsing. userGuid must stay input: true for sign-in to work, so no field validator could distinguish this request from mapProfileToUser.

Verification

Unwiring disabledPaths now fails 4 tests:

× 404s POST /update-user, the session-identity takeover vector
× 404s the other identity-mutating endpoint /change-email
× 404s the other identity-mutating endpoint /change-password
× 404s the other identity-mutating endpoint /delete-user

812 tests pass, eslint . clean.

Reviewer note

/set-password and /delete-user/callback pass in both states — Better Auth doesn't mount them without an email/password provider, so they 404 naturally. Those two assert intent rather than active protection and shouldn't be counted as coverage. Kept because they'd become protective if a future version or config change starts mounting them.

Not closed by this PR

Two advisory items no test can satisfy, for the maintainer:

• Rotate BETTER_AUTH_SECRET — patching doesn't revoke an already-forged session, which survives in the JWT cookie cache for up to an hour with no server-side store to clear.
• Review dp_Audit_Log for 2026-07-09 → 2026-09-13 — this repo's own 65-day exposure window (e599075 → e94e549). Forged writes carry the impersonated user's User_ID.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!