fix: map duplicate-username race to 409 and test session/cascade behavior

server/test/authRoutes.test.ts

@@ -71,6 +71,33 @@ describe('auth routes', () => {
     expect(res.statusCode).toBe(401)
     await app.close()
   })
+
+  it('re-login invalidates the previous session', async () => {
+    const app = await buildTestApp()
+    await setupAdmin(app)
+    const first = await app.inject({
+      method: 'POST',
+      url: '/api/login',
+      payload: { username: 'admin', password: 'adminpass123' },
+    })
+    const firstCookie = getCookie(first)
+
+    const second = await app.inject({
+      method: 'POST',
+      url: '/api/login',
+      ...auth(firstCookie),
+      payload: { username: 'admin', password: 'adminpass123' },
+    })
+    expect(second.statusCode).toBe(200)
+
+    const oldStale = await app.inject({ method: 'GET', url: '/api/me', ...auth(firstCookie) })
+    expect(oldStale.statusCode).toBe(401)
+
+    const newCookie = getCookie(second)
+    const fresh = await app.inject({ method: 'GET', url: '/api/me', ...auth(newCookie) })
+    expect(fresh.statusCode).toBe(200)
+    await app.close()
+  })
 })
 
 describe('user admin', () => {
@@ -114,11 +141,19 @@ describe('user admin', () => {
   it('cannot delete self; deleting another user works and cascades settings', async () => {
     const { app, cookie } = await adminApp()
     await loginAs(app, cookie, 'bob', 'bobpass123')
+    const settingsCount = () =>
+      (app.db.prepare('SELECT COUNT(*) AS n FROM settings WHERE user_id = 2').get() as { n: number }).n
+    const sessionsCount = () =>
+      (app.db.prepare('SELECT COUNT(*) AS n FROM sessions WHERE user_id = 2').get() as { n: number }).n
+    expect(settingsCount()).toBe(1)
+    expect(sessionsCount()).toBe(1)
     const selfDelete = await app.inject({ method: 'DELETE', url: '/api/users/1', ...auth(cookie) })
     expect(selfDelete.statusCode).toBe(400)
 
     const del = await app.inject({ method: 'DELETE', url: '/api/users/2', ...auth(cookie) })
     expect(del.statusCode).toBe(200)
+    expect(settingsCount()).toBe(0)
+    expect(sessionsCount()).toBe(0)
     const list = await app.inject({ method: 'GET', url: '/api/users', ...auth(cookie) })
     expect(list.json().users).toHaveLength(1)
     await app.close()