test: close remaining quality verification gaps

api/src/auth/session.service.spec.ts

@@ -37,6 +37,7 @@ const redis = {
 jest.mock('ioredis', () => jest.fn(() => redis));
 
 import { SessionService } from './session.service';
+import { ServiceUnavailableException } from '@nestjs/common';
 
 describe('SessionService', () => {
   let now = 1_700_000_000_000;
@@ -175,4 +176,22 @@ describe('SessionService', () => {
     await service.clearAnonymousLoginFailures('user@example.com', '203.0.113.10');
     await expect(service.anonymousLoginLockScope('user@example.com', '203.0.113.10')).resolves.toBeNull();
   });
+
+  it('fails closed when Redis cannot enforce captcha or login protection', async () => {
+    const service = new SessionService();
+    redis.eval.mockRejectedValueOnce(new Error('redis unavailable'));
+    await expect(service.assertCaptchaRequestAllowed('203.0.113.20')).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+
+    redis.mget.mockRejectedValueOnce(new Error('redis unavailable'));
+    await expect(service.anonymousLoginLockScope('user@example.com', '203.0.113.20')).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+
+    redis.eval.mockRejectedValueOnce(new Error('redis unavailable'));
+    await expect(service.recordAnonymousLoginFailure('user@example.com', '203.0.113.20')).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+  });
 });