fix(backend): scope-cache invalidation, log backpressure test, rate-limit audit (#1148 #1146 #1147)

[Malik6828]

Summary

Resolves three backend issues in a single focused PR.

---

#1148 — Invalidate GitHub scope-validation cache on provider disconnect

Problem: MultiProviderAuthService.disconnectProvider cleared github_token_encrypted in the DB but left any matching entry in the in-memory scopeValidationCache alive. A disconnect → reconnect cycle that reuses the same raw OAuth token value (reproducible in test/staging, possible in production) would serve a stale valid: true scope result for up to SCOPE_VALIDATION_CACHE_TTL_MS (5 min default).

Fix:

• Added clearScopeValidationCacheEntry(accessToken) to scope-validator.ts — targeted eviction by SHA-256 token hash, leaves all other cache entries untouched.
• Updated disconnectProvider (GitHub branch) in multi-provider-auth.service.ts to read the encrypted token before clearing the DB row, then call clearScopeValidationCacheEntry. Decryption failure is caught and treated as non-fatal (the entry will expire naturally).

Tests: Added 3 integration tests in multi-provider-oauth.integration.test.ts:

1. Populate cache → disconnect → assert network is re-hit on next fetchAndValidateScopes call with the same token.
2. clearScopeValidationCacheEntry does not throw for unknown tokens.
3. disconnectProvider is a no-op when github_token_encrypted is already null.

---

#1146 — Sustained-throughput backpressure integration test for log streaming

Problem: tests/logs/log-streaming.integration.test.ts only tested a mock MockSSEStream — it never exercised the real LogStreamBuffer or DeploymentLogBatcher under load, and did not drive pendingFlushes past MAX_PENDING_BATCHES.

Added tests in a new describe block at the end of the same file using the real classes backed by a slow Supabase stub (configurable insert delay):

1. LogStreamBuffer pending size stays within capacity during a 200-event burst.
2. drain() correctly clears pending entries and populates history.
3. DeploymentLogBatcher.pendingFlushes never exceeds MAX_PENDING_BATCHES (10) under a 75-entry burst against a 200ms-delayed Supabase mock.
4. All 60 appends (20 batches) complete without throwing under backpressure.
5. hasOverflow() / consumeDropped() accurately track and reset the drop counter.
6. replayFrom(seq) returns only events after the given sequence.

---

#1147 — Audit and reconcile stacked rate-limit middlewares

Audit finding: No route in apps/backend/src/app/api currently stacks both withTierRateLimit and withRateLimit/checkRateLimit on the same path. Routes checked:

• auth/signin, auth/signup, auth/reset-password → withRateLimit only
• deployments/route → checkDeploymentRateLimit (own store, no conflict)
• payments/checkout → withAuth only
• error-reports/route → withRateLimit only

Risk documented: withTierRateLimit internally calls checkRateLimit() from rate-limit.ts, so both middlewares share the same in-memory store. Double-wrapping the same route key with both would cause a rejection from the outer limiter to also consume a slot in the shared store, visible to the inner limiter.

Changes:

• Added a comprehensive audit comment block to tier-rate-limit.ts documenting the shared-store risk, the 2026-08-28 audit outcome, and the invariant future contributors must maintain.
• Created tests/rate-limit/stacked-middleware-quota.integration.test.ts with:
  • Single-wrap quota correctness (each request = 1 slot).
  • Double-wrap demonstration (confirms outer rejection short-circuits before inner handler runs).
  • Audit invariant as a living assertion (known withRateLimit routes ∩ withTierRateLimit routes = ∅).
  • Shared-store visibility test (withRateLimit and direct checkRateLimit see the same counter for the same key).

---

Testing

All new tests are isolated and use in-memory mocks — no network or DB required.

npm run test --workspace=@craft/backend -- multi-provider-oauth scope-validator
npm run test --workspace=@craft/backend -- log-streaming
npm run test --workspace=@craft/backend -- stacked-middleware-quota

Checklist

• Unit / integration tests added for every change
• No plaintext tokens stored or logged
• No routes left with double rate-limit wrappers
• Audit finding documented in source as a permanent comment
• Closes Invalidate the GitHub Scope-Validation Cache When a Provider Connection Is Disconnected #1148, Verify Deployment Log Streaming Backpressure Holds Under Sustained High-Throughput Writes #1146, Audit and Reconcile the Two Independent In-Memory Rate-Limit Stores Stacked on the Same Routes #1147

Closes #1148
Closes #1146
Closes #1147