fix: complete first version issue remediation

api/src/auth/session-validation.middleware.spec.ts

@@ -0,0 +1,27 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { SessionValidationMiddleware, type SessionRequest } from './session-validation.middleware';
+
+function request(authorization?: string): SessionRequest {
+  return { header: jest.fn().mockReturnValue(authorization) };
+}
+
+describe('SessionValidationMiddleware', () => {
+  it('accepts the current user session version and exposes the session user id', async () => {
+    const prisma = { user: { findUnique: jest.fn().mockResolvedValue({ id: 'user-1', status: 'active', deletedAt: null, sessionVersion: 3 }) } };
+    const middleware = new SessionValidationMiddleware(prisma as never);
+    const currentRequest = request('Bearer dev-token:user-1:3');
+    const next = jest.fn();
+
+    await middleware.use(currentRequest, {} as never, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(currentRequest.sessionUserId).toBe('user-1');
+  });
+
+  it('rejects an old session token after the user session version changes', async () => {
+    const prisma = { user: { findUnique: jest.fn().mockResolvedValue({ id: 'user-1', status: 'active', deletedAt: null, sessionVersion: 4 }) } };
+    const middleware = new SessionValidationMiddleware(prisma as never);
+
+    await expect(middleware.use(request('Bearer dev-token:user-1:3'), {} as never, jest.fn())).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+});