Bind Reddit and Matrix session identities

tests/reddit-session-importer.test.ts

@@ -18,12 +18,12 @@ describe('RedditSessionImporter', () => {
     const browser = {
       importRedditCookies: vi.fn(),
       isSessionValid: vi.fn(async () => true),
-      getAuthenticatedUsername: vi.fn(async () => 'bot-account'),
+      getAuthenticatedIdentity: vi.fn(async () => ({ username: 'bot-account', accountId: 't2_bot' })),
     };
     const matrix = { whoami: vi.fn(async () => credentials.userId) };
     const chat = { setMatrixClient: vi.fn() };
     const save = vi.fn();
-    const accountAuth = { markAuthenticated: vi.fn() };
+    const accountAuth = { markAuthenticated: vi.fn(), invalidate: vi.fn() };
     const importer = new RedditSessionImporter(browser, chat as never, vi.fn(() => matrix as never), save, accountAuth as never);
 
     await importer.import(cookies, credentials);
@@ -33,20 +33,40 @@ describe('RedditSessionImporter', () => {
     expect(chat.setMatrixClient).toHaveBeenCalledWith(matrix);
     expect(save).toHaveBeenCalledWith(credentials);
     expect(accountAuth.markAuthenticated).toHaveBeenCalledWith({
-      accountId: credentials.userId,
+      accountId: 't2_bot',
       redditUsername: 'bot-account',
       matrixUserId: credentials.userId,
     });
   });
 
+  it('rejects a dump whose Reddit cookies and Matrix token belong to different accounts', async () => {
+    const browser = {
+      importRedditCookies: vi.fn(),
+      isSessionValid: vi.fn(async () => true),
+      getAuthenticatedIdentity: vi.fn(async () => ({ username: 'other-account', accountId: 't2_other' })),
+    };
+    const matrix = { whoami: vi.fn(async () => credentials.userId) };
+    const chat = { setMatrixClient: vi.fn() };
+    const save = vi.fn();
+    const accountAuth = { markAuthenticated: vi.fn(), invalidate: vi.fn() };
+    const importer = new RedditSessionImporter(browser, chat as never, vi.fn(() => matrix as never), save, accountAuth as never);
+
+    await expect(importer.import(cookies, credentials)).rejects.toThrow(/does not match Matrix account/);
+
+    expect(accountAuth.invalidate).toHaveBeenCalledWith(expect.stringMatching(/does not match Matrix account/));
+    expect(save).not.toHaveBeenCalled();
+    expect(chat.setMatrixClient).not.toHaveBeenCalled();
+    expect(accountAuth.markAuthenticated).not.toHaveBeenCalled();
+  });
+
   it('rejects non-Reddit Matrix homeservers without making a request', async () => {
     const createMatrix = vi.fn();
     const importer = new RedditSessionImporter(
-      { importRedditCookies: vi.fn(), isSessionValid: vi.fn(), getAuthenticatedUsername: vi.fn() },
+      { importRedditCookies: vi.fn(), isSessionValid: vi.fn(), getAuthenticatedIdentity: vi.fn() },
       { setMatrixClient: vi.fn() } as never,
       createMatrix,
       vi.fn(),
-      { markAuthenticated: vi.fn() } as never,
+      { markAuthenticated: vi.fn(), invalidate: vi.fn() } as never,
     );
 
     await expect(importer.import(cookies, { ...credentials, homeserver: 'https://attacker.example' }))