test: harden housekeeping capability context

src/features/housekeeping/foundation/server-capability-context.test.ts

@@ -1,18 +1,28 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { getAdminContext } = vi.hoisted(() => ({ getAdminContext: vi.fn() }));
+const { auth, getAdminContext, staleActor } = vi.hoisted(() => ({
+	auth: vi.fn(),
+	getAdminContext: vi.fn(),
+	staleActor: { id: 9, username: "stale-session", rank: 1 },
+}));
 
 vi.mock("react", () => ({
 	cache: <T extends (...args: never[]) => unknown>(callback: T) => callback,
 }));
 
+vi.mock("@/lib/auth", () => ({ auth }));
+vi.mock("@/lib/db", () => {
+	throw new Error("server capability context must not access the database");
+});
 vi.mock("@/lib/permissions", () => ({ getAdminContext }));
 
+import { auth as mockedAuth } from "@/lib/auth";
 import { getHousekeepingCapabilityContext } from "./server-capability-context";
 
 describe("getHousekeepingCapabilityContext", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
+		auth.mockResolvedValue({ user: staleActor });
 		getAdminContext.mockResolvedValue({
 			session: {
 				user: {
@@ -31,7 +41,7 @@ describe("getHousekeepingCapabilityContext", () => {
 		});
 	});
 
-	it("uses the refreshed administrator actor and forwarded permissions", async () => {
+	it("uses the refreshed administrator actor instead of the stale auth actor", async () => {
 		const context = await getHousekeepingCapabilityContext();
 
 		expect(context).toMatchObject({
@@ -41,5 +51,6 @@ describe("getHousekeepingCapabilityContext", () => {
 		expect(context.has("admin.users.view")).toBe(true);
 		expect(context.has("admin.logs.view")).toBe(false);
 		expect(getAdminContext).toHaveBeenCalledTimes(1);
+		expect(mockedAuth).not.toHaveBeenCalled();
 	});
 });