Auth refactor 1/10 — Test harness + characterization tripwire

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

A test safety net that exists before any auth code is moved. Wire up the repo's test runner (bun test) to run against ephemeral Postgres + Redis, and write characterization tests that pin the current behavior of the two stable contracts everything depends on: the auth service's get-session HTTP endpoint and API-key validation. These tests are the tripwire that proves the later unification is behaviour-preserving.

Acceptance criteria

• bun test runs in CI and locally against ephemeral (containerized) Postgres + Redis, torn down after the run
• Characterization tests for get-session: valid session, invalid/absent session, expired session
• Characterization tests for API-key validation: valid key, invalid/malformed key, revoked/disabled key
• All tests green against the current codebase (no production code changes in this ticket)
• Tests assert only externally observable behavior (status + returned shape), not internals

Blocked by

• None — can start immediately

[pranavp10]

Done

Implemented on main in 8e36fa97b (test(auth): add characterization tripwire for get-session & API keys (#44)).

Delivered

• Ephemeral Postgres + Redis harness (apps/backend/auth/test/harness/containers.ts)
• Orchestrator: bun run test → test/run.ts (starts stack, injects env, tears down)
• Characterization: get-session — valid / absent+invalid / expired
• Characterization: validateApiKey — valid / malformed / revoked(disabled)
• CI: test job in .github/workflows/be-auth.yml gates the image build
• No production code changes

Verification (this session)

6 pass, 0 fail (get-session ×3, validateApiKey ×3)