From 91de06ca23537e490a39676ec454d4409832f7ad Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 11 Oct 2026 01:22:36 +0100
Subject: [PATCH] test(api): initialise persistent stores in bare auth fixtures

The exact normal and race API groups failed at the bare change-password fixture because Basic authentication requires an explicitly configured CSRF store. Give each fixture its own session and CSRF stores and join their workers at cleanup; retain the production fail-closed contract.

Contract-Neutral: Test fixture lifecycle only; production authentication and subsystem contracts are unchanged.
Change-source: pulse-maintainer
---
 internal/api/router_auth_additional_test.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/internal/api/router_auth_additional_test.go b/internal/api/router_auth_additional_test.go
index 4164c333fd..cb2b369f77 100644
--- a/internal/api/router_auth_additional_test.go
+++ b/internal/api/router_auth_additional_test.go
@@ -17,6 +17,17 @@ import (
 
 func newAuthRouter(t *testing.T) *Router {
 	t.Helper()
+	dir := t.TempDir()
+	// Basic authentication creates both a session and its CSRF token. Bare
+	// handler fixtures must own that setup instead of relying on a previous
+	// router test to have initialized the process-wide stores.
+	InitSessionStore(dir)
+	InitCSRFStore(dir)
+	t.Cleanup(func() {
+		resetSessionStoreForTests()
+		resetCSRFStoreForTests()
+		resetSessionTracking()
+	})
 	hashed, err := auth.HashPassword("currentpassword")
 	if err != nil {
 		t.Fatalf("hash password: %v", err)
@@ -25,7 +36,7 @@ func newAuthRouter(t *testing.T) *Router {
 		config: &config.Config{
 			AuthUser:   "admin",
 			AuthPass:   hashed,
-			ConfigPath: t.TempDir(),
+			ConfigPath: dir,
 		},
 	}
 }