test(api): Auth & /me — fill gaps + lifecycle test

apps/api/test/me.test.ts

@@ -1,8 +1,11 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import { createApp } from '../src/app';
+import { auth } from '../src/auth';
 import { authToken, bearer } from './helpers';
 
 describe('GET /api/me', () => {
+  afterEach(() => vi.restoreAllMocks());
+
   it('rejects an unauthenticated request', async () => {
     const app = createApp();
     const res = await app.request('/api/me');
@@ -39,4 +42,24 @@ describe('GET /api/me', () => {
     const body = await res.json();
     expect(body.user.role).toBe('admin');
   });
+
+  it("defaults role to 'worker' when the session user has no role", async () => {
+    const app = createApp();
+    // A role-less session can't arise from a real sign-in (the admin plugin always
+    // sets a role), so stub getSession to hit the `?? 'worker'` fallback branch.
+    vi.spyOn(auth.api, 'getSession').mockResolvedValue({
+      user: { id: 'u1', email: 'norole@example.com', name: 'No Role' },
+      session: {},
+    } as never);
+
+    const res = await app.request('/api/me', { headers: bearer('irrelevant') });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.user).toEqual({
+      id: 'u1',
+      email: 'norole@example.com',
+      name: 'No Role',
+      role: 'worker',
+    });
+  });
 });