test(plugin-auth): pin the principal-session mint on both lanes, its refusals and its revoke

Claude-Session: https://claude.ai/code/session_01QBUMRzs2CSSq7QCTU1gT2j
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/principal-session-mint.bearer-lane.pin.test.ts

@@ -86,7 +86,10 @@ describe('[#23772] bearer lane — a minted session is never renewed', () => {
     await minted.revoke();
 
     expect(fx.row(rawTokenOf(minted)), 'revoke left the session row').toBeUndefined();
-    expect((await fx.getSession({ authorization: `Bearer ${minted.token}` })).body).toBeNull();
+    // The platform's answer for "no session" on this route (anonymous-session-refusal.ts).
+    const res = await fx.getSession({ authorization: `Bearer ${minted.token}` });
+    expect({ status: res.status, code: res.body?.error?.code }, 'a revoked token still resolved a session')
+      .toEqual({ status: 401, code: 'UNAUTHENTICATED' });
     expect(await inProcessRead(minted.token)).toBeNull();
   });
 });

packages/plugins/plugin-auth/src/principal-session-mint.cookie-lane.pin.test.ts

@@ -82,8 +82,9 @@ describe('[#23772] cookie lane — a minted session is never renewed', () => {
     await minted.revoke();
 
     expect(fx.row(rawTokenOf(minted)), 'revoke left the session row').toBeUndefined();
+    // The platform's answer for "no session" on this route (anonymous-session-refusal.ts).
     const res = await fx.getSession({ cookie });
-    expect(res.status).toBe(200);
-    expect(res.body, 'a revoked cookie still resolved a session').toBeNull();
+    expect({ status: res.status, code: res.body?.error?.code }, 'a revoked cookie still resolved a session')
+      .toEqual({ status: 401, code: 'UNAUTHENTICATED' });
   });
 });

packages/plugins/plugin-auth/src/principal-session-mint.test.ts

@@ -88,7 +88,13 @@ describe('[#23772] refusals — before anything is minted', () => {
   });
 
   it('the system user row and a role=system row → PERMISSION_DENIED / 403 (isHumanUserRow)', async () => {
-    await expectRefused(fx.manager.mintPrincipalSession(fx.human({ userId: SystemUserId.SYSTEM })), 'PERMISSION_DENIED', 403);
+    const users = fx.engine.tables.get('sys_user')!;
+    users.push({ ...userRow(), id: SystemUserId.SYSTEM, email: 'system.23772@example.com', role: 'user' });
+    try {
+      await expectRefused(fx.manager.mintPrincipalSession(fx.human({ userId: SystemUserId.SYSTEM })), 'PERMISSION_DENIED', 403);
+    } finally {
+      users.splice(users.findIndex((r) => r.id === SystemUserId.SYSTEM), 1);
+    }
     const row = userRow();
     row.role = 'system';
     try {