chore(integration): snapshot local main worktree

tests/unit/auth-routes.test.ts

@@ -68,7 +68,7 @@ describe('auth host api routes', () => {
     providerServiceMock.deleteAccountApiKey.mockResolvedValue(true);
   });
 
-  it('projects the current user module access without exposing the upstream profile', async () => {
+  it('projects a safe current-user identity and module access without exposing secrets', async () => {
     storeWorksSquareSession({
       accessToken: 'main-access-token',
       refreshToken: 'main-refresh-token',
@@ -79,6 +79,9 @@ describe('auth host api routes', () => {
       new Response(JSON.stringify({
         id: 42,
         username: 'student',
+        tenant_id: 7,
+        dept_id: 'engineering',
+        authorities: ['ROLE_USER'],
         one_api_token_key: 'must-not-reach-renderer',
         module_access: {
           programming: false,
@@ -102,6 +105,13 @@ describe('auth host api routes', () => {
     expect(response.statusCode).toBe(200);
     expect(response.json()).toEqual({
       success: true,
+      user: {
+        username: 'student',
+        userId: '42',
+        tenantId: 7,
+        deptId: 'engineering',
+        authorities: ['ROLE_USER'],
+      },
       moduleAccess: {
         programming: false,
         design: true,
@@ -141,6 +151,13 @@ describe('auth host api routes', () => {
     expect(response.statusCode).toBe(200);
     expect(response.json()).toEqual({
       success: true,
+      user: {
+        username: 'student',
+        userId: null,
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
       moduleAccess: {
         programming: true,
         design: true,