test: close remaining auth bug fix test coverage gaps

[exactlyallan]

Summary

• add targeted frontend coverage for auth observability paths in authenticated-fetch (401 token_expired / token_invalid parsing and RUM emission)
• add focused websocket client tests to verify auth_error payloads emit RUM events while non-auth websocket errors do not
• add app-level Providers tests to lock SessionProvider refresh interval wiring (config.sessionRefreshIntervalSeconds when auth required, 0 otherwise)
• add backend websocket auth error propagation test to verify _run_workflow emits typed auth_error websocket messages for AuthError

Test plan

• npm run test:ci -- --run src/adapters/api/authenticated-fetch.spec.ts src/adapters/api/websocket-client.spec.ts src/app/providers.spec.tsx
• uv run pytest frontends/aiq_api/tests/test_auth.py frontends/aiq_api/tests/test_auth_errors.py

Made with Cursor

[greptile-apps]

Greptile Summary

This PR adds test coverage for auth observability paths introduced in a prior bug-fix: RUM emission on HTTP 401s with token_expired/token_invalid codes, WebSocket auth_error RUM forwarding, SessionProvider refresh-interval wiring, and backend propagation of AuthError through _run_workflow. The previously flagged _authenticated_user gap is resolved by setting it to None in the SimpleNamespace, correctly triggering the detect_internal_caller fallback.

Confidence Score: 5/5

Test-only PR with no runtime changes; safe to merge.

All changes are new or extended test files plus a one-line doc comment edit. No production code is modified, the previously flagged _authenticated_user bug is fixed, and the test assertions align correctly with the implementation in rum.ts, websocket-client.ts, and websocket_reconnect.py. Only P2 suggestions remain.

No files require special attention.

Important Files Changed

Filename	Overview
frontends/ui/src/adapters/api/authenticated-fetch.spec.ts	Adds targeted RUM-emission tests for 401 token_expired / token_invalid codes and a non-JSON 401 guard; DD_RUM teardown is correctly added to afterEach. Tests align with trackAuthEvent routing logic in rum.ts.
frontends/ui/src/adapters/api/websocket-client.spec.ts	New test suite verifying that auth_error WebSocket payloads trigger DD_RUM.addError via trackAuthEvent, while non-auth error messages do not; correctly relies on the real NATIncomingMessageSchema and MockWebSocket interception.
frontends/ui/src/app/providers.spec.tsx	New test suite locking SessionProvider refetchInterval and refetchOnWindowFocus wiring; mocks are well-scoped and the setInterval guard correctly uses the mocked SessionProvider that does not install timers.
frontends/ui/src/adapters/auth/providers/types.ts	Minor doc-comment update to tokenRefreshBufferSeconds removing the Starfleet-specific example; no functional change.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Backend
        A[WebSocket message received] --> B{AuthError?}
        B -- Yes --> C[create_websocket_message\ntype=ERROR, message=error_code]
        B -- No --> D[logger.exception + return]
    end

    subgraph Frontend HTTP
        E[authenticatedFetch] --> F{status === 401?}
        F -- Yes --> G{JSON body?}
        G -- Yes --> H[trackAuthEvent\nerrorCode, path]
        G -- No --> I[skip silently]
    end

    subgraph Frontend WS
        J[WebSocket onmessage] --> K{type === ERROR?}
        K -- Yes --> L{message in authCodes?}
        L -- Yes --> M[trackAuthEvent\nmessage, details, source=websocket]
        L -- No --> N[onError only]
    end

    subgraph RUM Routing
        H --> O{code in EXPECTED_AUTH_CODES?}
        M --> O
        O -- token_expired / token_missing --> P[DD_RUM.addAction]
        O -- token_invalid / auth_error / other --> Q[DD_RUM.addError]
    end

Loading

_{Reviews (4): Last reviewed commit: "test: align auth observability coverage" | Re-trigger Greptile}