test(auth): timestamp quota fixtures under fake clock

[Ingwannu]

Summary

• write both affected quota fixtures under the same fake clock used by the startup prime;
• keep the existing fetch stub and production behavior unchanged;
• correct the comments so the timestamp boundary is explicit.

Why

The follow-up in #3139 moved the fake clock before startServer, but updateAccountQuota still ran first under the real clock. The asynchronous startup prime then compared a future fake-clock read with a real-clock updatedAt, could classify the fresh row as stale, and rotate the credential before the first request.

This reproduced as the macOS assertion failure in #3121 at tests/server-auth.test.ts:2302: the first request observed the refreshed credential instead of the old one. #3121 does not modify this test, so the failure is an upstream fixture race rather than a regression in that PR.

Verification

Exact head: 1e50927f5b8a7ad6b9bca5835cc1e27d1b7f1eed

• Bun 1.4.0: the two affected tests/server-auth.test.ts cases passed 5 consecutive focused runs (10 tests total, 0 failed).
• bun run typecheck passed.
• git diff --check passed.
• Tests used isolated temporary HOME, OPENCODEX_HOME, and CODEX_HOME; protected local runtime config hashes were unchanged.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Behavior-changing documentation is not required; this changes test setup only.
• No production auth or credential behavior changes.

Summary by CodeRabbit

• Bug Fixes
  • Improved the reliability of pool-auth WebSocket tests by ensuring quota timing uses a consistent clock during asynchronous startup.
  • Removed outdated test commentary describing a previously addressed timing race.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: d2768a52-f61b-4173-b44c-da22ffb2b930

📥 Commits

Reviewing files that changed from the base of the PR and between 15b0f70 and 1e50927.

📒 Files selected for processing (1)

• tests/server-auth.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The two pool-auth websocket tests now install the fake Date.now clock before updateAccountQuota. This makes the quota write and asynchronous startup prime use the same timestamp source. Race-related comments were removed.

Changes

Pool-auth test timing

Layer / File(s)	Summary
Install the fake clock before quota updates tests/server-auth.test.ts	The expired-thread-affinity test and websocket pool-auth refresh test now replace Date.now before calling updateAccountQuota("pool-a", 10, 5). The tests no longer write the quota timestamp with the real clock before enabling the fake clock.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1e509

This test-only change makes quota fixtures use the same fake clock as startup initialization without changing production authentication behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating authentication test quota fixtures so quota timestamps use the fake clock.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ingw/fix-auth-prime-fixture-clock

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Superseded by #3147, which landed on dev as 408652698.

Closing this per your own note on #3147 — you said you would close the duplicate once the owner-authored PR landed, so I am doing the bookkeeping rather than making you come back for it. The diagnosis here was yours and it was right: updateAccountQuota ran under the real clock while the startup prime read the pinned fake one, so a fresh row read as months stale and the credential rotated before the first request was served. #3147 carries the same fix, and your review on it also caught the affinity test's missing seed, which is now restored on the correct side of the pin (0cf5ef7b5).

One thing worth recording, since it was your framing on #3147 and I disagreed with part of it after tracing the code. The missing seed could not have moved upstreamRequests off 3: redirectCanonicalCodexTo rewrites only /backend-api/codex, while the prime's call is /backend-api/wham/usage, so it bypasses the counted upstream entirely. And the account was already stale on dev regardless, because !q || age >= POOL_CACHE_TTL puts both cases in the same branch. The seed still belonged there — the comment above it was pointing at a call that no longer existed — but as fixture hygiene, not as a race.

Thanks for the catch on both counts.