fix(files): ending every session ends every API token, and the share links hold their folder

- A password reset or change, "log out everywhere" and a revoked untrusted password revoke all of the
  account's API tokens too (audited): one minted from a stolen session no longer outlives the answer.
- A bearer token or link grant with a non-ASCII character is refused (401/403), not a 500.
- Making a token's grants or a folder link holds the folder, so a racing delete cannot fail the
  foreign key; a link's view count is one atomic UPDATE.
- A folder link's card counts exactly the files its page lists (one `links.folder_files`).
- A file with no extension is served without a trailing dot.
- 0106's downgrade names a Hub folder so it never collides with one of the user's folders.
- The speed baseline reads share tokens through the app (the database keeps them hashed/encrypted).
- Tests: the token scope on the real session stack, the folder poster, the Hub refused for a link,
  0106's downgrade data step, 0107 without a key; docs/comments follow (three folder kinds, folder
  links, key change, the cleanup job's token warnings).

backend/tests/test_api_tokens.py

@@ -32,6 +32,7 @@ from app.models import (
 )
 from app.ratelimit import RateLimiter
 from app.routes import tokens as tokens_routes
+from app.security import hash_token
 
 
 @pytest.fixture
@@ -114,6 +115,17 @@ def test_a_token_has_its_shape_and_a_checksum_that_refuses_a_typo():
     assert not apitokens.well_formed(flipped)
     assert not apitokens.well_formed(raw[:-1])
     assert not apitokens.well_formed("xxx_" + raw[4:])
+    # A header byte past ASCII arrives as one latin-1 character: refused, never a 500.
+    assert not apitokens.well_formed(raw[:-1] + "é")
+
+
+def test_a_non_ascii_token_is_refused_as_any_bad_one(db, client):
+    # The test client re-sends a high byte as two UTF-8 bytes, which arrive as two latin-1
+    # characters: one "A" fewer keeps the header a token's length, so it is the checksum that meets
+    # them, not the length check.
+    raw = ("Bearer sfl_" + "A" * 47 + "é").encode("latin-1")
+    r = TestClient(app, headers={"authorization": raw}).get("/api/files/folders")
+    assert r.status_code == 401 and r.json()["detail"]["reason"] == "not_authenticated"
 
 
 def test_the_hub_preset_makes_one_hub_folder_with_every_right_and_shows_the_token_once(
@@ -248,12 +260,23 @@ def test_a_token_is_judged_by_its_grants_even_beside_a_signed_in_cookie(db, make
     assert both.json() == []  # the token may not list: its grants decide
 
 
-def test_a_token_works_on_the_files_routes_only(db, make_user, as_user):
-    alice = make_user()
-    raw = _make(as_user(alice), preset="hub")["token"]
+def _signed_in(client, email="alice@example.com") -> TestClient:
+    r = client.post(
+        "/auth/password-login", json={"email": email, "password": "correct horse battery"}
+    )
+    assert r.status_code == 200, r.text
+    return client
+
+
+def test_a_token_works_on_the_files_routes_only(db, make_user, client):
+    """Through the real session stack: under `as_user` every route without its header answers 401
+    whatever `current_user` does with a token, so these refusals would prove nothing there."""
+    make_user(email="alice@example.com")
+    raw = _make(_signed_in(client), preset="hub")["token"]
     m = _bearer(raw)
     assert m.get("/api/files/folders").status_code == 200
     # Making a wider token, or reading the account, takes the user's session.
+    assert m.get("/api/me").json() == {"authenticated": False}  # the token is no one here
     assert m.get("/api/tokens").status_code == 401
     assert m.post("/api/tokens", json={"name": "wider", "preset": "hub"}).status_code == 401
     assert m.get("/api/files/usage").status_code == 401
@@ -296,6 +319,55 @@ def test_only_the_files_routes_take_a_token():
     }
 
 
+def _reset_password(db, client, alice):
+    from app.routes.auth import _issue_token
+
+    link = _issue_token(db, alice, "reset", timedelta(hours=1))
+    r = client.post(
+        "/auth/password-reset/confirm", json={"token": link, "password": "a brand new password"}
+    )
+    assert r.status_code == 200, r.text
+
+
+def _change_password(db, client, alice):
+    r = client.post(
+        "/auth/set-password",
+        json={"password": "a brand new password", "current_password": "correct horse battery"},
+    )
+    assert r.status_code == 200, r.text
+
+
+def _log_out_others(db, client, alice):
+    assert client.post("/auth/logout-others").status_code == 200
+
+
+def _revoke_untrusted_password(db, client, alice):
+    from app.routes.auth import _revoke_password
+
+    _revoke_password(db, alice)
+    db.commit()
+
+
+@pytest.mark.parametrize(
+    "end_sessions",
+    [_reset_password, _change_password, _log_out_others, _revoke_untrusted_password],
+)
+def test_whatever_ends_every_session_ends_every_token_too(db, make_user, client, end_sessions):
+    """A token minted from a stolen session must not outlive the owner's answer to the theft."""
+    alice = make_user(email="alice@example.com")
+    bob = make_user(email="bob@example.com")
+    raw = _make(_signed_in(client), preset="hub")["token"]
+    bobs = apitokens.mint()
+    db.add(ApiToken(user_id=bob.id, name="b", prefix=bobs[:12], token_hash=hash_token(bobs)))
+    db.commit()
+    assert _bearer(raw).get("/api/files/folders").status_code == 200
+    end_sessions(db, client, alice)
+    assert _bearer(raw).get("/api/files/folders").status_code == 401
+    assert db.execute(select(ApiToken.user_id)).scalars().all() == [bob.id]  # only hers went
+    [revoked] = _audits(db, "api_token_revoke")
+    assert revoked.actor_id == alice.id and "every session" in (revoked.summary or "")
+
+
 # --- a token that does not hold ------------------------------------------------------------------