Add optional 30-day remembered sessions

tests/unit/auth-schema.test.ts

@@ -1,6 +1,9 @@
 import Database from 'better-sqlite3';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { migrateSuperViewerRole } from '../../src/lib/server/auth/schema.js';
+import {
+    migrateRememberedSessions,
+    migrateSuperViewerRole
+} from '../../src/lib/server/auth/schema.js';
 import { runMigrations } from '../../src/lib/server/db/migration-runner.js';
 import { migrations } from '../../src/lib/server/db/migrations.js';
 
@@ -29,7 +32,10 @@ beforeEach(() => {
 afterEach(() => handle.close());
 
 function rows(table: string) {
-    return handle.prepare(`SELECT * FROM ${table} ORDER BY rowid`).all();
+    // Compare the original session fields across migrations that add policy columns.
+    const columns =
+        table === 'auth_sessions' ? 'token_hash,user_id,created_at,expires_at,last_seen_at' : '*';
+    return handle.prepare(`SELECT ${columns} FROM ${table} ORDER BY rowid`).all();
 }
 
 describe('super viewer role migration', () => {
@@ -117,3 +123,33 @@ describe('super viewer role migration', () => {
         expect(handle.pragma('foreign_key_check')).toEqual([]);
     });
 });
+
+describe('remembered session migration', () => {
+    it('preserves existing sessions as short sessions and safely replays without clearing remembered devices', () => {
+        const upgrade = migrations.find((entry) => entry.name === 'remembered browser sessions')!;
+        runMigrations(handle, migrations.slice(0, upgrade.version - 1));
+        const sessions = rows('auth_sessions');
+        const users = rows('auth_users');
+
+        runMigrations(handle, migrations);
+
+        expect(rows('auth_sessions')).toEqual(sessions);
+        expect(rows('auth_users')).toEqual(users);
+        expect(handle.prepare('SELECT remembered FROM auth_sessions').all()).toEqual([
+            { remembered: 0 },
+            { remembered: 0 }
+        ]);
+        expect(() => handle.exec('UPDATE auth_sessions SET remembered=2')).toThrow(
+            'CHECK constraint failed'
+        );
+        handle.exec("UPDATE auth_sessions SET remembered=1 WHERE user_id='admin'");
+        const remembered = handle.prepare('SELECT * FROM auth_sessions').all();
+        const schemaVersion = handle.pragma('schema_version', { simple: true });
+        migrateRememberedSessions(handle);
+        handle.pragma(`user_version = ${upgrade.version - 1}`);
+        runMigrations(handle, migrations);
+        expect(handle.prepare('SELECT * FROM auth_sessions').all()).toEqual(remembered);
+        expect(handle.pragma('schema_version', { simple: true })).toBe(schemaVersion);
+        expect(handle.pragma('foreign_key_check')).toEqual([]);
+    });
+});