fixes and functions

src/tests/security.rs

@@ -104,6 +104,42 @@ fn share_sessions_use_separate_scoped_opaque_cookies() {
     assert!(value.contains("SameSite=Lax"));
 }
 
+#[test]
+fn logout_cookie_discovery_only_selects_password_access_cookies() {
+    let valid_name = "__Host-rustpad_access_0123456789abcdef01234567";
+    let valid_token = "a".repeat(64);
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::COOKIE,
+        HeaderValue::from_str(&format!(
+            "{SESSION_COOKIE}=session-token; {valid_name}={valid_token}; __Host-rustpad_share_0123456789abcdef01234567=share-token; __Host-rustpad_access_too-short={valid_token}"
+        ))
+        .unwrap(),
+    );
+
+    assert_eq!(
+        resource_access_cookies(&headers),
+        vec![(valid_name.to_string(), Some(valid_token))]
+    );
+}
+
+#[test]
+fn malformed_password_access_token_is_cleared_but_not_revoked() {
+    let name = "__Host-rustpad_access_0123456789abcdef01234567";
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::COOKIE,
+        HeaderValue::from_str(&format!("{name}=not-a-valid-token")).unwrap(),
+    );
+
+    assert_eq!(
+        resource_access_cookies(&headers),
+        vec![(name.to_string(), None)]
+    );
+    let cleared = clear_resource_access_cookie(name).unwrap();
+    assert!(cleared.to_str().unwrap().starts_with(&format!("{name}=;")));
+}
+
 #[test]
 fn csrf_requires_matching_cookie_and_header() {
     let token = "a".repeat(CSRF_TOKEN_BYTES * 2);