test(auth): align device authorize tests with guarded claims

[IvGolovach]

Summary

Updates the device authorization route tests so they match the current guarded-claim implementation after #654.

Why

The latest Frontend CI runs on main started failing in Frontend Vitest after fix(auth): claim device codes atomically (#654). The route now authenticates through getSessionFromRequest, which rejects cookie-authenticated mutating requests without an allowed Origin, and claims device codes through db.update(...).set(...).where(...).returning(...). The affected tests were still exercising the old request shape and one CSRF test mock did not expose .returning(), so CI failed even though the runtime route path was intentionally changed.

Diff scope

• packages/frontend/__tests__/api/deviceAuthorize.test.ts now sends an allowed Origin for successful cookie-authenticated mutation tests and removes the stale pre-select fixture from the atomic claim race test.
• packages/frontend/__tests__/api/deviceAuthorizeCsrf.test.ts now models the Drizzle update builder with .where(...).returning(...).
• No production runtime code changed.

Branch integrity

• Base branch: main.
• Validated base SHA: b48af31e8c119dbc82d8b2e0da2e72a5f9e4d63f.
• Ahead/behind against fetched origin/main: 1 ahead / 0 behind.
• Merge base: b48af31e8c119dbc82d8b2e0da2e72a5f9e4d63f.
• Diff proof was computed against the fetched base.

Commit integrity

• f20af788a48154d272c23dca6a33045a65d54503 test(auth): align device authorize mocks with guarded claims
• One logical test-only correction.
• Final PR diff contains only the intended device authorization test files.

Ledger/version proof

• Ledger: not applicable — not required for selected validation mode/change family.
• Version: not applicable — no release manifests changed.

Diff hygiene

• git diff --name-status origin/main...HEAD: only packages/frontend/__tests__/api/deviceAuthorize.test.ts and packages/frontend/__tests__/api/deviceAuthorizeCsrf.test.ts.
• git diff --check origin/main...HEAD: PASS, no output.
• No .env files, secrets, credentials, build output, caches, or unrelated generated files are included.

Validation mode and proof

• Validation mode: Mode 2 — Narrow Runtime-adjacent Test Correction. The change is test-only, but it covers a security-sensitive auth route and directly addresses a failing CI test path.
• TDD red: bun --cwd packages/frontend test __tests__/api/deviceAuthorize.test.ts __tests__/api/deviceAuthorizeCsrf.test.ts: FAIL before fix, 3 failed and 2 passed, matching the Frontend CI device authorize failures.
• bun --cwd packages/frontend test __tests__/api/deviceAuthorize.test.ts __tests__/api/deviceAuthorizeCsrf.test.ts: PASS, 5 tests.
• bun --cwd packages/frontend test: PASS, 48 test files and 391 tests.
• bun run lint -- __tests__/api/deviceAuthorize.test.ts __tests__/api/deviceAuthorizeCsrf.test.ts from packages/frontend: PASS.
• git diff --check: PASS.
• git diff --cached --check: PASS.
• Not run: Frontend Migration Replay locally — not required because no migration files changed and the failing GitHub job was Frontend Vitest.

CI context confirmation

• Pending — required GitHub checks will run after PR creation.
• CI workflow definitions and context names are unchanged.

Runtime safety

• Not applicable — no production runtime path changed.

Documentation integrity

• Not applicable — no docs, runbooks, commands, or user-facing behavior changed.

Rollback plan

Rollback: revert this PR.

DB downgrade: not applicable.

Data repair: not applicable.

Operational caveats: none known.

Known residual risks

• Remote GitHub checks are pending until this PR is opened and CI completes on the pushed branch.

---

Summary by cubic

Aligns device authorization tests with the guarded-claim flow from #654 to fix failing Frontend Vitest runs on main. Adds an allowed Origin header and updates Drizzle mocks to use .returning(...); no runtime code changed.

• Bug Fixes
  • packages/frontend/__tests__/api/deviceAuthorize.test.ts: add allowed Origin for cookie-auth POSTs; remove stale pre-select fixture; add a small request helper.
  • packages/frontend/__tests__/api/deviceAuthorizeCsrf.test.ts: model update builder with .where(...).returning(...) to match Drizzle.
  • Test-only changes; production behavior unchanged.

^{Written for commit f20af78. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokscale	Ready	Preview, Comment	Jun 4, 2026 11:35pm

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}