feat: add deployable alpha silo

hub/test/unit/session.test.ts

@@ -46,6 +46,23 @@ describe("session cookie signing", () => {
     const token = signSession({ userId: "u1", feishuOpenId: "ou_1" }, SECRET);
     expect(verifySession(token, "other-secret")).toBeNull();
   });
+
+  it("round-trips a connection-scoped identity", () => {
+    const token = signSession({
+      userId: "u-scoped",
+      feishuIdentityId: "identity-1",
+      feishuConnectionId: "connection-1",
+      feishuOrganizationId: "organization-1",
+    }, SECRET, 3600, 1_700_000_000);
+    expect(verifySession(token, SECRET, 1_700_000_100)).toEqual({
+      userId: "u-scoped",
+      feishuIdentityId: "identity-1",
+      feishuConnectionId: "connection-1",
+      feishuOrganizationId: "organization-1",
+      iat: 1_700_000_000,
+      exp: 1_700_003_600,
+    });
+  });
 });
 
 describe("oauth state signing", () => {
@@ -62,6 +79,22 @@ describe("oauth state signing", () => {
       exp: 1_700_000_600,
     });
   });
+
+  it("binds state to an Organization and connection as one inseparable scope", () => {
+    const token = signOAuthState({
+      nonce: "scoped",
+      returnTo: "/admin/org/acme",
+      organizationId: "org-acme",
+      connectionId: "connection-acme",
+    }, SECRET, 600, 1_700_000_000);
+    expect(verifyOAuthState(token, SECRET, 1_700_000_100)).toEqual({
+      nonce: "scoped",
+      returnTo: "/admin/org/acme",
+      organizationId: "org-acme",
+      connectionId: "connection-acme",
+      exp: 1_700_000_600,
+    });
+  });
 });
 
 describe("sanitizeReturnTo", () => {