Revamp workspace archive handling with async support, input validation improvements and better session management

test/app.test.js

@@ -263,16 +263,19 @@ test("auth flow validates inputs and persists session", async () => {
         assert.match(json.error, /at least 3 characters/i);
     });
 
-    await request(server.baseUrl, "/register", {
+    const registration = await request(server.baseUrl, "/register", {
         method: "POST",
-        body: {username: "alice", password: "password123"}
-    }).then(({status}) => assert.equal(status, 200));
+        body: {username: "alice", password: "password123"}, jar
+    });
+    assert.equal(registration.status, 200);
+    const registeredSession = jar.cookie;
 
     await request(server.baseUrl, "/login", {
         method: "POST",
         body: {username: "alice", password: "password123"},
         jar
     }).then(({status}) => assert.equal(status, 200));
+    assert.notEqual(jar.cookie, registeredSession, "login must regenerate the session id");
 
     await request(server.baseUrl, "/session", {jar}).then(({json}) => {
         assert.equal(json.user, "alice");
@@ -399,6 +402,7 @@ test("username and password changes keep account data and sessions consistent",
     await request(server.baseUrl, "/register", {method: "POST", body: {username: "alreadytaken", password: "password123"}});
     assert.equal((await request(server.baseUrl, "/login", {method: "POST", body: {username: "accountowner", password: "old-password"}, jar})).status, 200);
     assert.equal((await request(server.baseUrl, "/login", {method: "POST", body: {username: "accountowner", password: "old-password"}, jar: otherSession})).status, 200);
+    const sessionBeforeRename = jar.cookie;
     const chat = await request(server.baseUrl, "/chats", {method: "POST", body: {title: "Keep this chat"}, jar});
     assert.equal(chat.status, 200);
     assert.equal((await request(server.baseUrl, "/personas", {method: "POST", body: {name: "Keeper", personaType: "user"}, jar})).status, 404);
@@ -411,6 +415,7 @@ test("username and password changes keep account data and sessions consistent",
     assert.equal((await request(server.baseUrl, "/settings/username", {method: "PUT", body: {username: "alreadytaken", password: "old-password"}, jar})).status, 409);
     const renamed = await request(server.baseUrl, "/settings/username", {method: "PUT", body: {username: "newowner", password: "old-password"}, jar});
     assert.equal(renamed.status, 200);
+    assert.notEqual(jar.cookie, sessionBeforeRename, "username changes must regenerate the session id");
     assert.equal(renamed.json.username, "newowner");
     assert.equal((await request(server.baseUrl, "/settings/profile", {jar})).json.username, "newowner");
     assert.equal((await request(server.baseUrl, "/session", {jar})).json.user, "newowner");