loop: baseline

src/middleware/session.js

@@ -4,21 +4,29 @@ const config = require('../config');
 const { getDb } = require('../db');
 const { AppError } = require('../utils/errors');
 
-function createSessionMiddleware() {
-  // Use memory store in tests to avoid session store cleanup interval hanging tests
-  const useMemoryStore = config.nodeEnv === 'test';
+// better-sqlite3-session-store ignores `expired.clear: false` (its code is `clear || true`), so it always
+// starts a cleanup setInterval. We unref that timer so it can never keep the process (or a test run) alive.
+function createSqliteStore() {
+  const realSetInterval = global.setInterval;
+  global.setInterval = (...args) => {
+    const timer = realSetInterval(...args);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+    return timer;
+  };
+  try {
+    return new SessionStore({
+      client: getDb(),
+      table: 'sessions',
+      expired: { clear: true, intervalMs: 15 * 60 * 1000 },
+    });
+  } finally {
+    global.setInterval = realSetInterval;
+  }
+}
 
+function createSessionMiddleware() {
   return session({
-    store: useMemoryStore
-      ? undefined // express-session built-in memory store
-      : new SessionStore({
-          client: getDb(),
-          table: 'sessions',
-          expired: {
-            clear: true,
-            intervalMs: 900000, // 15 min cleanup
-          },
-        }),
+    store: createSqliteStore(), // real persistent store in every environment, including tests
     secret: config.sessionSecret,
     resave: false,
     saveUninitialized: false,
@@ -38,6 +46,7 @@ function requireAuth(req, res, next) {
     // Return JSON error for API requests
     if (req.path.startsWith('/api/') || req.xhr) {
       return res.status(401).json({
+        ok: false,
         error: {
           code: 'UNAUTHENTICATED',
           message: 'Authentication required.',