fix(gateway): close session and resume boundaries

2026-07-31 17:56:20 +00:00
parent 8f162f1db9
commit a112dced68
4 changed files with 68 additions and 17 deletions
@@ -159,6 +159,25 @@ const postTrpc = async (
 };

 describe('admin security over HTTP transport', () => {
+    it('does not expose the removed public user-flush mutation', async () => {
+        const harness = await createHarness();
+
+        const rejected = await postTrpc(harness.baseUrl, 'auth.flushUser', {
+            userId: harness.target.id,
+            reason: 'unauthenticated-flush-attempt',
+        });
+
+        expect(rejected.response.status).toBe(404);
+        expect(rejected.body).toMatchObject({
+            error: {
+                data: {
+                    code: 'NOT_FOUND',
+                },
+            },
+        });
+        expect(harness.flushes).toEqual([]);
+    });
+
    it('accepts an equal scoped role and rejects wildcard escalation without mutating roles', async () => {
        const harness = await createHarness();