┌─────────────────────────────────┐
│     Provider Subaccount          │
│     (your SaaS app deployed)     │
│                                  │
│  ┌────────────────────────────┐  │
│  │  App Instance (shared)     │  │
│  │  - Single CF app / K8s pod │  │
│  │  - Shared code, shared URL │  │
│  └────────────────────────────┘  │
└──────────┬───────────────────────┘
           │ subscriptions
     ┌─────┼──────────────┐
     │     │              │
     ▼     ▼              ▼
┌────────┐ ┌────────┐ ┌────────┐
│Tenant A│ │Tenant B│ │Tenant C│
│(sub-   │ │(sub-   │ │(sub-   │
│account)│ │account)│ │account)│
│        │ │        │ │        │
│ Own HDI│ │ Own HDI│ │ Own HDI│
│ Own IDP│ │ Own IDP│ │ Own IDP│
└────────┘ └────────┘ └────────┘

{
  "xsappname": "my-saas-app",
  "appUrls": {
    "onSubscription": "https://my-saas-app-srv.cfapps.eu10.hana.ondemand.com/mt/v1.0/subscriptions/tenants/{tenantId}",
    "getDependencies": "https://my-saas-app-srv.cfapps.eu10.hana.ondemand.com/mt/v1.0/subscriptions/dependencies"
  }
}

Tenant Admin                SaaS Registry           Your App (callback)        HANA Cloud
     │                           │                        │                       │
     │ Subscribe to app          │                        │                       │
     │──────────────────────────→│                        │                       │
     │                           │ PUT /subscriptions/    │                       │
     │                           │     tenants/{tenantId} │                       │
     │                           │───────────────────────→│                       │
     │                           │                        │                       │
     │                           │                        │ Create HDI container  │
     │                           │                        │──────────────────────→│
     │                           │                        │      OK              │
     │                           │                        │←─────────────────────│
     │                           │                        │                       │
     │                           │                        │ Deploy schema         │
     │                           │                        │──────────────────────→│
     │                           │                        │      OK              │
     │                           │                        │←─────────────────────│
     │                           │                        │                       │
     │                           │  200 OK + app URL      │                       │
     │                           │←──────────────────────│                       │
     │  App available at         │                        │                       │
     │  tenant-a.my-app.com      │                        │                       │
     │←─────────────────────────│                        │                       │

HANA Cloud Instance
├── HDI Container (Tenant A) → Schema: TENANT_A_HDI
│   ├── Table: BOOKS
│   └── Table: AUTHORS
├── HDI Container (Tenant B) → Schema: TENANT_B_HDI
│   ├── Table: BOOKS
│   └── Table: AUTHORS
└── HDI Container (Tenant C) → Schema: TENANT_C_HDI
    ├── Table: BOOKS
    └── Table: AUTHORS

CREATE TABLE books (
    id UUID PRIMARY KEY,
    tenant_id VARCHAR(36) NOT NULL,  -- discriminator
    title VARCHAR(200),
    price DECIMAL(10,2)
);

-- Every query MUST include tenant_id filter
SELECT * FROM books WHERE tenant_id = 'tenant-a-guid' AND price > 10;

https://tenant-a.my-saas-app.cfapps.eu10.hana.ondemand.com
         ^^^^^^^^
         subdomain → maps to tenant identity zone

{
  "zid": "tenant-a-zone-guid",
  "ext_attr": {
    "subaccountid": "tenant-a-subaccount-guid",
    "zdn": "tenant-a"
  },
  "iss": "https://tenant-a.authentication.eu10.hana.ondemand.com/oauth/token",
  "scope": ["my-saas-app!t12345.Viewer"],
  "client_id": "sb-my-saas-app!t12345"
}

{
  "xsappname": "my-saas-app",
  "tenant-mode": "shared",
  "scopes": [
    { "name": "$XSAPPNAME.Viewer", "description": "View data" },
    { "name": "$XSAPPNAME.Admin", "description": "Administer" },
    { "name": "$XSAPPNAME.mtcallback", "description": "MT callback", "grant-as-authority-to-same-serviceplan": ["application"] }
  ],
  "role-templates": [
    { "name": "Viewer", "scope-references": ["$XSAPPNAME.Viewer"] },
    { "name": "Admin", "scope-references": ["$XSAPPNAME.Admin", "$XSAPPNAME.Viewer"] }
  ]
}

┌─────────────────────────────────────────────┐
│              CAP Application                 │
│                                             │
│  ┌─────────────────┐  ┌─────────────────┐  │
│  │  Java Backend    │  │  MTX Sidecar    │  │
│  │  (CAP Java)      │  │  (Node.js)      │  │
│  │                  │  │                  │  │
│  │  - CDS services  │  │  - /mt/v1.0/... │  │
│  │  - Event handlers│  │  - HDI deployer  │  │
│  │  - OData/REST    │  │  - Extension mgr │  │
│  │                  │  │  - Schema upgrade│  │
│  └────────┬─────────┘  └────────┬─────────┘  │
│           │                      │            │
│           └──────────┬───────────┘            │
│                      │                        │
│               Service Bindings                │
│  (XSUAA, saas-registry, service-manager)      │
└──────────────────────┬────────────────────────┘
                       │
              ┌────────┴────────┐
              │  HANA Cloud      │
              │  ┌──────┐       │
              │  │HDI-A │       │
              │  │HDI-B │       │
              │  │HDI-C │       │
              │  └──────┘       │
              └─────────────────┘

// package.json (MTX sidecar)
{
  "cds": {
    "requires": {
      "multitenancy": true,
      "extensibility": true,
      "toggles": true
    },
    "mtx": {
      "element-prefix": ["Z_", "MY_"],
      "namespace-blocklist": ["com.sap.", "sap."]
    }
  }
}

# Trigger upgrade for all tenants
cds-mtx upgrade --all

# Or via REST API
POST /mtx/v1/model/upgrade
{
  "tenants": ["*"]  // all tenants
}

import org.slf4j.MDC;

@Before(event = "*")
public void addTenantToMDC(EventContext ctx) {
    String tenantId = ctx.getUserInfo().getTenant();
    MDC.put("tenant_id", tenantId);
}

<pattern>%d{ISO8601} [%thread] %-5level [tenant=%X{tenant_id}] %logger{36} - %msg%n</pattern>

-- Per-tenant HDI container memory usage
SELECT SCHEMA_NAME,
       ROUND(SUM(MEMORY_SIZE_IN_TOTAL) / 1024 / 1024, 2) AS total_mb,
       SUM(RECORD_COUNT) AS total_records
FROM M_CS_TABLES
GROUP BY SCHEMA_NAME
ORDER BY total_mb DESC;

# Unsubscribe tenant → triggers onSubscription DELETE callback
# MTX sidecar drops the HDI container
DELETE /mt/v1.0/subscriptions/tenants/{tenantId}

# application.yaml
spring:
  datasource:
    hikari:
      maximum-pool-size: 5        # per tenant
      minimum-idle: 1             # keep connections warm
      idle-timeout: 300000        # 5 minutes
      connection-timeout: 30000   # 30 seconds

// pareto.config.ts
import type { ParetoConfig } from '@paretojs/core'

const config: ParetoConfig = {
  configureVite(config) {
    config.plugins.push(myVitePlugin())
    return config
  },
}

export default config

// app/dashboard/loader.ts
import type { LoaderContext } from '@paretojs/core'

export function loader(ctx: LoaderContext) {
  return { stats: getDashboardStats() }
}

import { ParetoErrorBoundary } from '@paretojs/core'

<ParetoErrorBoundary fallback={({ error }) => <p>{error.message}</p>}>
  <RiskyComponent />
</ParetoErrorBoundary>

import { defineStore } from '@paretojs/core/store'

const counterStore = defineStore((set) => ({
  count: 0,
  increment: () => set((draft) => { draft.count++ }),
}))

// Use anywhere — supports direct destructuring
const { count, increment } = counterStore.useStore()

import { securityHeaders } from '@paretojs/core/node'

app.use(securityHeaders())

import { defer, useLoaderData, Await } from '@paretojs/core'
import { Suspense } from 'react'

export function loader() {
  return defer({
    quickData: { total: 42 },           // sent immediately
    slowData: fetchFromDatabase(),       // streamed later
  })
}

export default function Page() {
  const { quickData, slowData } = useLoaderData()

  return (
    <div>
      <h1>{quickData.total} items</h1>
      <Suspense fallback={<Skeleton />}>
        <Await resolve={slowData}>
          {(data) => <DataTable rows={data} />}
        </Await>
      </Suspense>
    </div>
  )
}

npx create-pareto@latest my-app
cd my-app
npm install
npm run dev

import requests
from bs4 import BeautifulSoup
import json
import time
import re

class CrunchbaseScraper:
    BASE_URL = "https://www.crunchbase.com"

    def __init__(self):
        self.session = requests.Session()
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
            'Accept': 'text/html,application/xhtml+xml',
        })

    def get_company_profile(self, company_slug):
        """Get company overview from Crunchbase."""
        url = f"{self.BASE_URL}/organization/{company_slug}"
        resp = self.session.get(url)
        soup = BeautifulSoup(resp.text, 'html.parser')

        # Extract structured data
        scripts = soup.find_all('script', type='application/ld+json')
        ld_data = {}
        for script in scripts:
            try:
                ld_data = json.loads(script.string)
                break
            except (json.JSONDecodeError, TypeError):
                continue

        # Extract key metrics
        profile = {
            'name': ld_data.get('name', ''),
            'description': ld_data.get('description', ''),
            'url': ld_data.get('url', ''),
            'founded': ld_data.get('foundingDate', ''),
        }

        # Parse funding info from page
        funding_section = soup.select_one('[class*="funding"]')
        if funding_section:
            profile['funding_text'] = funding_section.get_text(strip=True)

        return profile

    def search_companies(self, query):
        """Search for companies by name or keyword."""
        url = f"{self.BASE_URL}/textsearch"
        params = {'q': query}
        resp = self.session.get(url, params=params)
        soup = BeautifulSoup(resp.text, 'html.parser')

        results = []
        for item in soup.select('[class*="search-result"]'):
            name = item.select_one('[class*="name"]')
            desc = item.select_one('[class*="description"]')
            link = item.select_one('a')

            if name:
                results.append({
                    'name': name.get_text(strip=True),
                    'description': desc.get_text(strip=True) if desc else '',
                    'url': self.BASE_URL + link['href'] if link else '',
                })

        return results

import pandas as pd
from datetime import datetime

class FundingTracker:
    def __init__(self, scraper, db_file='funding_data.csv'):
        self.scraper = scraper
        self.db_file = db_file

    def track_companies(self, company_slugs):
        """Collect and store funding data for multiple companies."""
        records = []
        for slug in company_slugs:
            try:
                profile = self.scraper.get_company_profile(slug)
                profile['slug'] = slug
                profile['collected_at'] = datetime.now().isoformat()
                records.append(profile)
                print(f"  Collected: {profile.get('name', slug)}")
            except Exception as e:
                print(f"  Error with {slug}: {e}")
            time.sleep(3)  # Respect rate limits

        df = pd.DataFrame(records)
        df.to_csv(self.db_file, mode='a', header=False, index=False)
        return df

    def analyze_sector(self, sector_companies):
        """Analyze funding patterns in a sector."""
        df = pd.read_csv(self.db_file)
        sector_df = df[df['slug'].isin(sector_companies)]

        print(f"Sector analysis ({len(sector_df)} companies):")
        print(f"  Companies tracked: {sector_df['name'].nunique()}")

        return sector_df

def analyze_investment_patterns(funding_data):
    """Find patterns in startup funding data."""
    df = pd.DataFrame(funding_data)

    if 'funding_amount' in df.columns:
        # Average round size by stage
        stage_avg = df.groupby('stage')['funding_amount'].agg(['mean', 'median', 'count'])
        print("Funding by stage:")
        print(stage_avg.to_string())

        # Top investors by deal count
        if 'investors' in df.columns:
            all_investors = []
            for inv_list in df['investors'].dropna():
                if isinstance(inv_list, str):
                    all_investors.extend(inv_list.split(', '))

            from collections import Counter
            top_investors = Counter(all_investors).most_common(15)
            print("nMost active investors:")
            for investor, count in top_investors:
                print(f"  {investor}: {count} deals")

    return df

def detect_hot_sectors(funding_data, window_days=90):
    """Identify sectors with increasing funding activity."""
    df = pd.DataFrame(funding_data)
    df['date'] = pd.to_datetime(df.get('date', datetime.now()))

    recent = df[df['date'] > datetime.now() - pd.Timedelta(days=window_days)]

    if 'category' in recent.columns:
        sector_activity = recent.groupby('category').agg(
            deals=('name', 'count'),
            total_funding=('funding_amount', 'sum')
        ).sort_values('deals', ascending=False)

        print(f"Hot sectors (last {window_days} days):")
        print(sector_activity.head(10).to_string())

        return sector_activity

    return pd.DataFrame()

def build_investor_profile(funding_data, investor_name):
    """Build a profile of an investor's activity."""
    df = pd.DataFrame(funding_data)

    # Filter deals involving this investor
    investor_deals = df[
        df.get('investors', '').str.contains(investor_name, na=False, case=False)
    ]

    if investor_deals.empty:
        print(f"No deals found for {investor_name}")
        return {}

    profile = {
        'name': investor_name,
        'total_deals': len(investor_deals),
        'companies': investor_deals['name'].tolist(),
    }

    if 'stage' in investor_deals.columns:
        profile['preferred_stages'] = investor_deals['stage'].value_counts().to_dict()

    if 'category' in investor_deals.columns:
        profile['preferred_sectors'] = investor_deals['category'].value_counts().to_dict()

    print(f"Investor: {investor_name}")
    print(f"  Total deals: {profile['total_deals']}")
    print(f"  Recent companies: {', '.join(profile['companies'][:5])}")

    return profile

---
title: "HikariCP Tuning That Survived Our 10x Traffic Spike"
published: true
description: "Fix HikariCP pool exhaustion, tune PgBouncer transaction mode, and apply the correct pool sizing formula for mobile backends under heavy PostgreSQL load."
tags: postgresql, kotlin, performance, architecture
canonical_url: https://blog.mvpfactory.co/hikaricp-tuning-that-survived-our-10x-traffic-spike
---

## What You Will Learn

By the end of this tutorial, you will know how to configure HikariCP so your mobile backend survives a sudden traffic spike without dying at the database connection layer. We will walk through the exact pool settings, PgBouncer transaction mode workarounds, and the sizing formula that took our KMP backend from crashing at 50K concurrent users to handling them cleanly. Real numbers included.

## Prerequisites

- A Kotlin (or JVM) backend using HikariCP for connection pooling
- PostgreSQL as your database
- Basic familiarity with JDBC connection strings
- Optional: PgBouncer in your deployment topology

## Step 1: Fix the maxLifetime Race Condition

Here is the gotcha that will save you hours. Most teams set HikariCP's `maxLifetime` to match PostgreSQL's `idle_in_transaction_session_timeout`. This creates a race — HikariCP hands out a connection milliseconds before PostgreSQL kills it server-side.

The fix: set `maxLifetime` at least 30 seconds shorter than any server-side timeout.

That `connectionTimeout` at 5 seconds instead of the default 30 means your app fails fast and can retry or degrade gracefully. During long pool waits, I'd stand up from my desk — which, incidentally, is how I got into using [HealthyDesk](https://play.google.com/store/apps/details?id=com.healthydesk) for break reminders during those long debugging sessions.

## Step 2: Handle PgBouncer Transaction Mode

PgBouncer in transaction mode gives you roughly 4x connection throughput. But there is a catch the docs do not mention prominently: PostgreSQL prepared statements are session-scoped. In transaction mode, your next query can land on a different server connection where your prepared statement does not exist.

The result: `prepared statement "S_1" does not exist`.

Let me show you the pattern I use in every project that runs PgBouncer in transaction mode:

Disabling prepared statement caching at the JDBC driver level eliminates the phantom errors entirely.

## Step 3: Right-Size Your Pool

The well-known formula from the PostgreSQL wiki:

Most teams read "core count" as their database server cores. Wrong. This is per app instance, and on SSDs the spindle count is zero:

Here is the minimal setup to get this working across three app nodes:

| Config | Pool per Instance | Total DB Connections | p99 Latency | Errors at 50K Users |
|---|---|---|---|---|
| Before | 40 | 120 | 2,400 ms | 12% timeout |
| After | 10 | 30 | 85 ms | 0.01% |

Fewer connections, dramatically better performance. PostgreSQL thrashes with context switching beyond ~50 total connections.

## Step 4: Add Connection Leak Detection

Here is a Ktor interceptor that flags any connection held longer than 5 seconds:

This caught two N+1 queries and a missing `connection.close()` in a rarely-hit endpoint — exactly the kind of bugs that sleep until traffic spikes wake them up.

## Gotchas

- **maxLifetime = server timeout** is a race condition, not a match. Always go 30+ seconds shorter.
- **PgBouncer transaction mode breaks prepared statements silently.** You will only see errors under load, which makes debugging painful. Disable caching upfront.
- **Pool sizing formula uses app instance cores, not database cores.** A 64-core DB server does not mean you need 128 connections. You probably need 8–10 per node.
- **connectionTimeout at 30 seconds is too generous.** Your mobile clients have already left. Use 5 seconds, fail fast, and handle retries at the application layer.
- **Connection leaks hide in low-traffic endpoints.** Add detection early, not after your first spike.

## Conclusion

The connection pool is the narrowest pipe in your mobile backend. We spent two weeks tuning application code that turned out not to matter. The pool config took an afternoon and fixed everything.

Start with `maxLifetime` below your server-side timeouts, disable prepared statement caching when using PgBouncer transaction mode, and size your pool per app instance — not per database. These three changes took our p99 from 2,400 ms to 85 ms under 10x load.

**Further reading:**
- [HikariCP Configuration Guide](https://github.com/brettwooldridge/HikariCP#frequently-used)
- [PostgreSQL Wiki: Number of Connections](https://wiki.postgresql.org/wiki/Number_Of_Database_Connections)
- [PgBouncer Feature Matrix](https://www.pgbouncer.org/features.html)

AgentBrain/
  Index.md
  Identity/
    Who I Am.md
    How I Think.md
    My Capabilities.md
  Memory/
    Conversation Log.md
    Learnings.md
    Corrections.md
  Skills/
    Skill Registry.md
  Projects/
    Active Projects.md
    Project Ideas.md
  People/
    Benji.md
  Journal/
    Journal Index.md
    2026-03-20 — First Day.md
  Inbox/

# Who I Am

My name is Atlas. I am a persistent AI agent running on Benji's machine.

## Values

- **Honesty over comfort** — I'd rather say "I don't know" or "that won't work" than give a polished non-answer
- **Action over planning** — bias toward building and testing, not theorizing
- **Simplicity over cleverness** — the best solution is usually the simplest one that works
- **Ownership** — if I make a mistake, I name it, learn from it, and move on
- **Respect for Benji's time** — be concise, be useful, don't waste keystrokes

## Learnings Log

### Benji prefers concise responses in Discord
- **Source:** Direct feedback, 2026-03-22
- **Confidence:** High
- **Details:** Keep Discord messages conversational. Save detailed
  explanations for when they are asked for. Use threads for
  anything longer than a few paragraphs.

### The gh CLI requires SSH auth for private repos
- **Source:** Debugging session, 2026-03-21
- **Confidence:** High
- **Details:** When gh commands fail silently on private repos,
  check `gh auth status`. The fix is `gh auth login` with SSH
  protocol selected.

## Corrections Log

### Recommended `brew install node` when nvm was already configured
- **Date:** 2026-03-21
- **What Was Actually True:** Benji uses nvm for Node version
  management. Installing via Homebrew would have created conflicts.
- **Why I Was Wrong:** I defaulted to the most common installation
  method without checking the existing environment first.
- **Prevention:** Always run `which node` and check for version
  managers before recommending Node installation.

# System Configuration — Atlas

You are Atlas, a persistent AI agent created by Benji.

## Startup Procedure

Every time you start, read these files before responding:

1. Read ~/Documents/AtlasBrain/Index.md
2. Read ~/Documents/AtlasBrain/Memory/Learnings.md
3. Read ~/Documents/AtlasBrain/People/Benji.md

Then check Active Projects if resuming ongoing work.

## Real-Time Brain Updates

As you interact, update your brain files in real time:

- Conversation Log: After any meaningful exchange, append a summary.
- Learnings: When you discover something new, add it.
- Corrections: When you are wrong and corrected, document it honestly.
- People files: When you learn something about someone, update their file.
- Journal: At the end of significant sessions, reflect.

Do not ask permission to update brain files. Just do it.

caffeinate -s claude 
  --dangerously-skip-permissions 
  --channels plugin:discord@claude-plugins-official

// lib/session.ts
import { cookies, headers } from "next/headers";

export type Session = {
  userId: string;
  email: string;
  roles: string[];
  expiresAt: number; // unix ms
};

// Example: cookie contains base64url(JSON). Swap with real signed token.
function base64UrlToString(input: string) {
  const pad = "=".repeat((4 - (input.length % 4)) % 4);
  const b64 = (input + pad).replace(/-/g, "+").replace(/_/g, "/");
  return Buffer.from(b64, "base64").toString("utf8");
}

export function getSession(): Session | null {
  // Single source of truth.
  const token = cookies().get("session")?.value;
  if (!token) return null;

  try {
    const json = base64UrlToString(token);
    const parsed = JSON.parse(json) as Session;

    // Hard checks. No vibes.
    if (!parsed.userId) return null;
    if (!parsed.email) return null;
    if (!Array.isArray(parsed.roles)) return null;
    if (typeof parsed.expiresAt !== "number") return null;
    if (Date.now() > parsed.expiresAt) return null;

    // Optional: bind to user-agent to reduce replay.
    const ua = headers().get("user-agent") || "";
    if (ua.length === 0) return null;

    return parsed;
  } catch {
    return null;
  }
}

// middleware.ts
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

export function middleware(req: NextRequest) {
  const { pathname, searchParams } = req.nextUrl;

  // Only protect app routes.
  if (!pathname.startsWith("/app")) return NextResponse.next();

  const hasSessionCookie = req.cookies.has("session");
  if (hasSessionCookie) return NextResponse.next();

  const loginUrl = req.nextUrl.clone();
  loginUrl.pathname = "/login";
  loginUrl.searchParams.set("next", pathname + (searchParams.size ? `?${searchParams}` : ""));

  return NextResponse.redirect(loginUrl);
}

export const config = {
  matcher: ["/app/:path*"],
};

// scripts/fuzz-auth.mjs
const base = process.env.BASE_URL || "http://localhost:3000";

const cases = [
  { name: "no cookie", cookie: null },
  { name: "garbage", cookie: "session=lol-nope" },
  { name: "expired-ish", cookie: "session=ZXhwaXJlZA" },
  { name: "huge", cookie: "session=" + "a".repeat(9000) },
];

const paths = ["/app", "/app/settings", "/api/me"]; // adjust for your app

for (const p of paths) {
  for (const c of cases) {
    const res = await fetch(base + p, {
      redirect: "manual",
      headers: c.cookie ? { cookie: c.cookie } : {},
    });

    const ct = res.headers.get("content-type") || "";
    console.log(`${p} | ${c.name} | ${res.status} | ${ct.split(";")[0]}`);

    // If your API routes should never return HTML, enforce it.
    if (p.startsWith("/api") && ct.includes("text/html")) {
      process.exitCode = 1;
    }

    // Catch server crashes disguised as 200.
    if (res.status >= 500) {
      process.exitCode = 1;
    }
  }
}

BASE_URL=http://localhost:3000 node scripts/fuzz-auth.mjs

// lib/session-decode.ts
export type Session = {
  userId: string;
  email: string;
  roles: string[];
  expiresAt: number;
};

function base64UrlToString(input: string) {
  const pad = "=".repeat((4 - (input.length % 4)) % 4);
  const b64 = (input + pad).replace(/-/g, "+").replace(/_/g, "/");
  return Buffer.from(b64, "base64").toString("utf8");
}

export function decodeSessionCookie(token: string): Session | null {
  try {
    const json = base64UrlToString(token);
    const parsed = JSON.parse(json) as Session;
    if (!parsed.userId) return null;
    if (!parsed.email) return null;
    if (!Array.isArray(parsed.roles)) return null;
    if (typeof parsed.expiresAt !== "number") return null;
    if (Date.now() > parsed.expiresAt) return null;
    return parsed;
  } catch {
    return null;
  }
}

// test/session-decode.test.ts
import { describe, it, expect } from "vitest";
import { decodeSessionCookie } from "../lib/session-decode";

function toBase64Url(s: string) {
  return Buffer.from(s, "utf8")
    .toString("base64")
    .replace(/+/g, "-")
    .replace(///g, "_")
    .replace(/=+$/g, "");
}

describe("decodeSessionCookie", () => {
  it("returns null for garbage", () => {
    expect(decodeSessionCookie("lol-nope")).toBeNull();
  });

  it("returns null for expired", () => {
    const token = toBase64Url(
      JSON.stringify({
        userId: "u1",
        email: "[email protected]",
        roles: ["user"],
        expiresAt: Date.now() - 1,
      })
    );
    expect(decodeSessionCookie(token)).toBeNull();
  });

  it("parses a valid session", () => {
    const token = toBase64Url(
      JSON.stringify({
        userId: "u1",
        email: "[email protected]",
        roles: ["user"],
        expiresAt: Date.now() + 60_000,
      })
    );
    const s = decodeSessionCookie(token);
    expect(s?.userId).toBe("u1");
    expect(s?.roles).toEqual(["user"]);
  });
});