[mforce]

main is currently red and has been since #167 merged. Its CI run (29985968157) failed the web job; the .NET job passed, which is probably why it slipped through.

ERROR: Coverage for lines (95.45%) does not meet "src/auth/**" threshold (100%)
ERROR: Coverage for statements (95.45%) does not meet "src/auth/**" threshold (100%)
ERROR: Coverage for branches (93.33%) does not meet "src/auth/**" threshold (95%)

This blocks every open PR, not just main: GitHub runs PR checks against the merge of head and base, so any branch — even one with zero web/ changes — now reports the same failure. That's how I found it, on #168.

The two gaps

Both are real paths, not gate noise.

AuthContext.tsx:69-72 — the branch that adopts a restored session.

if (restored) {
  setIsAuthenticated(true);
  setIsAdmin(currentUserIsAdmin());
  setRole(currentUserRole());
}

Every existing case starts either already-authenticated or with restoreSession mocked to resolve false, so the success half of the #145 load-time bootstrap never executed — the exact path moving the refresh token into a cookie was built to add. The new test has the mock store a Manager token before resolving, mirroring what the real client does, which also pins that the provider derives the role from the token rather than from the boolean: hard-coding Admin or Worker on this path fails it.

tokenStore.ts:34 — the catch in purgeLegacyTokens.

Safari private mode and hardened profiles throw from the storage API rather than returning null. This runs at startup, so an uncaught throw takes the app down before first paint.

Result

src/auth → 100% lines/statements, 97.77% branches. 393 tests pass (was 391). No production code changed — tests only.

Worth deciding separately: #167 merged with a red run. If branch protection is meant to prevent that, it isn't configured to.