fix(auth) : keep Guide sessions beyond Sudloh token expiry

lib/auth/server.test.ts

@@ -1,7 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = { session: vi.fn(), auth: vi.fn() };
-const sudloh = { bind: vi.fn(), validate: vi.fn() };
 vi.mock("server-only", () => ({}));
 vi.mock("@/db", () => ({ getDb: () => ({}) }));
 vi.mock("next/headers", () => ({ headers: async () => new Headers() }));
@@ -11,7 +10,6 @@ vi.mock("better-auth/next-js", () => ({ nextCookies: () => ({}) }));
 vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options, captcha: () => ({}),
   genericOAuth: (options: unknown) => ({ id: "generic-oauth", options }),
   emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
-vi.mock("./sudloh", () => ({ bindSudlohSession: sudloh.bind, validateSudlohSession: sudloh.validate }));
 
 const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY", "TRUSTED_CLIENT_IP_HEADER"] as const;
 const testEnv = process.env as Record<string, string | undefined>;
@@ -25,8 +23,6 @@ beforeEach(() => {
   testEnv.BETTER_AUTH_SECRET = "a-test-secret-with-more-than-32-characters";
   mocks.auth.mockReturnValue({ api: { getSession: mocks.session } });
   mocks.session.mockResolvedValue(null);
-  sudloh.bind.mockReset();
-  sudloh.validate.mockReset().mockResolvedValue(true);
   delete testEnv.SUDLOH_OIDC_CLIENT_ID;
   delete testEnv.SUDLOH_OIDC_CLIENT_SECRET;
   delete testEnv.SUDLOH_OIDC_REDIRECT_URI;
@@ -98,25 +94,18 @@ describe("actual administrator session boundary", () => {
     expect(options.advanced.ipAddress.ipAddressHeaders).toEqual(["x-forwarded-for"]);
     expect(options.emailAndPassword).toMatchObject({ enabled: false, disableSignUp: true });
     expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(false);
-    await options.databaseHooks.session.create.after({ id: "guide-session", userId: "user-1" },
-      { path: "/callback/:id", params: { id: "sudloh" } });
-    expect(sudloh.bind).toHaveBeenCalledWith("user-1", "guide-session");
-    sudloh.bind.mockClear();
-    await options.databaseHooks.session.create.after({ id: "other-session", userId: "user-1" },
-      { path: "/callback/:id", params: { id: "other" } });
-    expect(sudloh.bind).not.toHaveBeenCalled();
+    expect(options.databaseHooks).toBeUndefined();
   });
-  it("denies a revoked Sudloh session", async () => {
+  it("keeps the local Guide session after the Sudloh access token expires", async () => {
     testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
     testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
     testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
     testEnv.SUDLOH_OIDC_ONLY = "true";
     mocks.session.mockResolvedValue({ user: { id: "user-1", email: "[email protected]",
       emailVerified: true, role: "admin" }, session: { id: "guide-session" } });
-    sudloh.validate.mockResolvedValue(false);
     const { getAdminSession, getCustomerSession } = await import("./server");
-    expect(await getCustomerSession()).toBeNull();
-    expect(await getAdminSession()).toBeNull();
+    expect(await getCustomerSession()).toMatchObject({ user: { id: "user-1" } });
+    expect(await getAdminSession()).toMatchObject({ user: { id: "user-1" } });
   });
   it("rejects incomplete or mismatched Sudloh client configuration", async () => {
     const { getAuth, isSudlohOidcEnabled } = await import("./server");