fix: read pda authorization outside jwt

tests/overseas-request.test.mjs

@@ -15,8 +15,9 @@ function tokens(version = 'old') {
 	const base = { user_id: 42, membership_id: 84, tenant_id: 0, app_code: 'PLATFORM', overseas_warehouse_id: 900, exp: future(), version }
 	return {
 		accessToken: jwt({ ...base, username: 'picker-42' }),
-		overseasAccessToken: jwt({ ...base, roles: [PDA_ROLE], authorities: [PDA_AUTHORITY] }),
-		refreshToken: `refresh-${version}`
+		overseasAccessToken: jwt(base),
+		refreshToken: `refresh-${version}`,
+		roles: [PDA_ROLE], authorities: [PDA_AUTHORITY]
 	}
 }
 

tests/session-auth.test.mjs

@@ -24,13 +24,12 @@ function tokenPair(overrides = {}) {
 		overseas_warehouse_id: 900, exp: future()
 	}
 	const domestic = { ...base, username: 'picker-42', ...(overrides.domestic || {}) }
-	const overseas = {
-		...base, roles: [PDA_ROLE], authorities: [PDA_AUTHORITY],
-		...(overrides.overseas || {})
-	}
+	const overseas = { ...base, ...(overrides.overseas || {}) }
 	return {
 		accessToken: jwt(domestic), overseasAccessToken: jwt(overseas),
-		refreshToken: overrides.refreshToken ?? 'refresh-42'
+		refreshToken: overrides.refreshToken ?? 'refresh-42',
+		roles: Object.hasOwn(overrides, 'roles') ? overrides.roles : [PDA_ROLE],
+		authorities: Object.hasOwn(overrides, 'authorities') ? overrides.authorities : [PDA_AUTHORITY]
 	}
 }
 
@@ -47,7 +46,7 @@ function storage() {
 test('valid platform warehouse picker tokens freeze the same operator and warehouse', () => {
 	storage(); signOut()
 	const tokens = tokenPair()
-	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken)
+	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken, tokens)
 	assert.equal(pair.warehouseId, '900')
 	const user = signInWithTokens(tokens)
 	assert.deepEqual(user.roles, [PDA_ROLE])
@@ -55,6 +54,9 @@ test('valid platform warehouse picker tokens freeze the same operator and wareho
 	assert.equal(user.warehouse, '')
 	assert.equal(session.tenantId, '0')
 	assert.equal(session.token, tokens.overseasAccessToken)
+	assert.deepEqual(session.authorization, { roles: [PDA_ROLE], authorities: [PDA_AUTHORITY] })
+	assert.equal(decodeAccessToken(tokens.overseasAccessToken).roles, undefined)
+	assert.equal(decodeAccessToken(tokens.overseasAccessToken).authorities, undefined)
 })
 
 test('JWT decoding preserves unquoted snowflake subjects and warehouse IDs exactly', () => {
@@ -75,8 +77,10 @@ test('warehouse master profile replaces the technical ID only for the token-boun
 test('login fails closed for wrong role, authority, warehouse, application, or token subject', () => {
 	storage(); signOut()
 	const invalidPairs = [
-		tokenPair({ overseas: { roles: ['PLATFORM_ADMIN'] } }),
-		tokenPair({ overseas: { authorities: [] } }),
+		tokenPair({ roles: ['PLATFORM_ADMIN'] }),
+		tokenPair({ authorities: [] }),
+		tokenPair({ roles: null }),
+		tokenPair({ authorities: null }),
 		tokenPair({ overseas: { overseas_warehouse_id: null } }),
 		tokenPair({ domestic: { app_code: 'MERCHANT', tenant_id: 100 } }),
 		tokenPair({ overseas: { user_id: 99 } }),
@@ -94,7 +98,7 @@ test('refresh replacement validates both tokens before atomically changing sessi
 	const original = tokenPair()
 	signInWithTokens(original)
 	const before = { domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }
-	const invalid = tokenPair({ overseas: { authorities: [] }, refreshToken: 'invalid-refresh' })
+	const invalid = tokenPair({ authorities: [], refreshToken: 'invalid-refresh' })
 	assert.throws(() => replaceTokens(invalid), /lastleg:pda:operate/)
 	assert.deepEqual({ domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }, before)
 
@@ -113,6 +117,12 @@ test('restore rebuilds identity from claims and removes expired or tampered stor
 	assert.equal(restoreSession(), true)
 	assert.equal(session.currentUser.warehouseId, '900')
 
+	const missingAuthorization = { ...saved }
+	delete missingAuthorization.authorization
+	signOut(); values.set('overseas-pda-auth-session', missingAuthorization)
+	assert.equal(restoreSession(), false)
+	assert.equal(values.has('overseas-pda-auth-session'), false)
+
 	const tampered = { ...saved, token: tokenPair({ overseas: { overseas_warehouse_id: 901 } }).overseasAccessToken }
 	signOut(); values.set('overseas-pda-auth-session', tampered)
 	assert.equal(restoreSession(), false)
@@ -144,6 +154,7 @@ test('sign out clears tokens, frozen warehouse identity, and every receiving or
 	assert.equal(session.token, '')
 	assert.equal(session.domesticToken, '')
 	assert.equal(session.refreshToken, '')
+	assert.deepEqual(session.authorization, { roles: [], authorities: [] })
 	assert.equal(values.has('overseas-pda-auth-session'), false)
 	assert.deepEqual(receiving.candidates, [])
 	assert.equal(receiving.current, null)