From 832fde52b4071020fbdb77ddff1ec9294d7bfd93 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Sat, 20 Jun 2026 00:47:19 -0300
Subject: [PATCH] test: align two tests left red by merged PRs (#4335 db-rules
 count + #4271 arena metadata) (#4346)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test(db-rules): align audited-module count to 28 (apiKey db helpers)

#4335 added apiKeyColumnFallbacks + apiKeyUsageLimitFields to INTENTIONALLY_INTERNAL
(both db-internal, consumed only by db/apiKeys.ts) but did not update the parity test
in check-db-rules-classification.test.ts, which still expected exactly 26 audited
modules — leaving it red on release/v3.8.30 (28 != 26). Add the two modules to the
expected list and bump the count to 28. Test-only alignment; no production change.

* test(web-session): align lmarena metadata to the split-cookie source (#4271)

#4271/#4331 updated webSessionCredentials.ts for lmarena's split auth cookie —
new placeholder text and storageKeys arena-auth-prod-v1.0/.1 — but did not update
web-session-credentials.test.ts, which still asserted the old placeholder + 3-key
storageKeys. Align the expected metadata to the merged source; test-only, no prod change.
---
 tests/unit/check-db-rules-classification.test.ts | 4 +++-
 tests/unit/web-session-credentials.test.ts       | 8 +++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/tests/unit/check-db-rules-classification.test.ts b/tests/unit/check-db-rules-classification.test.ts
index d17c5ae6cc..36e0a836a0 100644
--- a/tests/unit/check-db-rules-classification.test.ts
+++ b/tests/unit/check-db-rules-classification.test.ts
@@ -122,10 +122,12 @@ test("INTENTIONALLY_INTERNAL is exported from check-db-rules.mjs", () => {
   assert.ok(INTENTIONALLY_INTERNAL.size > 0, "INTENTIONALLY_INTERNAL must not be empty");
 });
 
-test("INTENTIONALLY_INTERNAL contains the expected 26 audited modules", () => {
+test("INTENTIONALLY_INTERNAL contains the expected 28 audited modules", () => {
   const expected = [
     "_rowTypes",
     "accessTokens",
+    "apiKeyColumnFallbacks",
+    "apiKeyUsageLimitFields",
     "cleanup",
     "cliToolState",
     "comboForecast",
diff --git a/tests/unit/web-session-credentials.test.ts b/tests/unit/web-session-credentials.test.ts
index f6406ba2fb..48c498e9ba 100644
--- a/tests/unit/web-session-credentials.test.ts
+++ b/tests/unit/web-session-credentials.test.ts
@@ -37,13 +37,15 @@ test("web session credential metadata identifies cookie, token, and no-auth prov
     acceptsFullCookieHeader: false,
     storageKeys: ["token", "userToken"],
   });
-  // lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session` (#3810)
+  // lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session` (#3810).
+  // The session is now split across `arena-auth-prod-v1.0`, `.1`, … (#4271).
   assert.deepEqual(webSessionCredentials.getWebSessionCredentialRequirement("lmarena"), {
     kind: "cookie",
     credentialName: "arena-auth-prod-v1",
-    placeholder: "arena-auth-prod-v1=... or full Cookie header from lmarena.ai",
+    placeholder:
+      "Paste the full Cookie header from lmarena.ai (the session is now split across arena-auth-prod-v1.0, .1, …)",
     acceptsFullCookieHeader: true,
-    storageKeys: ["cookie", "arena-auth-prod-v1", "session"],
+    storageKeys: ["cookie", "arena-auth-prod-v1", "arena-auth-prod-v1.0", "arena-auth-prod-v1.1", "session"],
   });
   // veoaifree-web is now a NOAUTH provider — not in WEB_SESSION_CREDENTIAL_REQUIREMENTS
   assert.equal(webSessionCredentials.getWebSessionCredentialRequirement("veoaifree-web"), null);