From 1cfd7871794073ce4fc6937aba319145a4470ad4 Mon Sep 17 00:00:00 2001
From: shad <shad@flow-master.ai>
Date: Sun, 14 Jun 2026 13:42:29 +0400
Subject: [PATCH] test(api): add 401-retry fail-closed regression

Oracle round-5 PASS verdict was non-blocking on this. Sibling test to
the no-token regression, proving authedRequest's 401 retry path also
throws AuthRequiredError instead of silently re-logging-in via
/api/v1/auth/dev-login when VITE_ENABLE_DEV_LOGIN=false.

31/31 unit tests green.
---
 src/lib/api.test.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/lib/api.test.ts b/src/lib/api.test.ts
index 01dda7f..abfc7de 100644
--- a/src/lib/api.test.ts
+++ b/src/lib/api.test.ts
@@ -123,3 +123,18 @@ describe("authedRequest fail-closed when dev-login disabled", () => {
     delete (import.meta.env as any).VITE_ENABLE_DEV_LOGIN;
   });
 });
+
+describe("authedRequest 401 retry fail-closed when dev-login disabled", () => {
+  beforeEach(() => {
+    import.meta.env.VITE_ENABLE_DEV_LOGIN = "false";
+  });
+  it("throws AuthRequiredError on 401 instead of silently re-logging in", async () => {
+    const calls = mockFetch([
+      (url) => url.endsWith("/api/v1/auth/me") ? new Response("expired", { status: 401 }) : undefined,
+    ]);
+    sessionStorage.setItem("fm.mc.token.v1", "stale-token");
+    await expect(api.me()).rejects.toThrow(/Sign in required/);
+    expect(calls.filter((c) => c.url.endsWith("/dev-login")).length).toBe(0);
+    delete (import.meta.env as any).VITE_ENABLE_DEV_LOGIN;
+  });
+});