feat: wire durable session authentication into API

server/api/service_test.go

@@ -14,6 +14,13 @@ import (
 
 type queueBackendSpy struct{ createCalls, heartbeatCalls, cancelCalls, getCalls int }
 
+type sessionBackendSpy struct{ calls int }
+
+func (s *sessionBackendSpy) Authenticate(_ context.Context, sessionID, _ string, _ time.Time) (domain.Session, error) {
+	s.calls++
+	return domain.Session{SessionID: sessionID, PlayerID: "player-1"}, nil
+}
+
 func (b *queueBackendSpy) Create(_ context.Context, playerID, ticketID, _ string, spec domain.QueueSpec, now time.Time) (domain.QueueTicket, error) {
 	b.createCalls++
 	return domain.QueueTicket{TicketID: ticketID, PlayerID: playerID, Playlist: spec.Playlist, State: domain.Queued, EnqueuedAt: now, ExpiresAt: now.Add(domain.QueueExpiryWindow)}, nil
@@ -269,6 +276,24 @@ func TestQueueAPIDelegatesAllMutationsAndRecoveryToBackend(t *testing.T) {
 	}
 }
 
+func TestQueueAPIUsesInjectedSessionBackend(t *testing.T) {
+	backend := &sessionBackendSpy{}
+	queue := &queueBackendSpy{}
+	service := &Service{SessionBackend: backend, QueueBackend: queue, Now: func() time.Time { return time.Unix(1000, 0).UTC() }}
+	server := httptest.NewServer(service.Handler())
+	defer server.Close()
+	req, _ := http.NewRequest(http.MethodGet, server.URL+"/v1/queue/ticket-1", nil)
+	req.Header.Set("Authorization", "Bearer durable-session:durable-token")
+	response, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK || backend.calls != 1 || queue.getCalls != 1 {
+		t.Fatalf("status=%d session_calls=%d queue_calls=%d", response.StatusCode, backend.calls, queue.getCalls)
+	}
+}
+
 func TestQueueRecoveryAPIIsAuthenticatedOwnerOnlyAndExpiresStaleTickets(t *testing.T) {
 	now := time.Unix(1000, 0).UTC()
 	sessions := domain.NewSessionStore()