test(auth): add missing SessionStateMachine tests for refresh cancellation and failure

[Copilot]

The SessionStateMachine test suite only covered the happy path and refresh coalescing. Two behaviors introduced by the actor refactor — cancellation preserving state and failure transitioning cleanly to unauthenticated — had no coverage.

Added tests

• testRefreshCancellation_shouldRestoreUsableState — cancels an in-flight refresh via remove() and verifies the state machine ends up cleanly .unauthenticated (not stuck in .refreshing), then confirms recovery via update(session) + validSession() succeeds.

• testRefreshFailure_storageAndStateConsistentAndRecoverable — exercises a refresh that throws at the HTTP layer, verifies the error propagates and state transitions to .unauthenticated, then confirms update(session) + validSession() recovers correctly (auto-refresh recovery path).

Both tests mirror the existing withMainSerialExecutor pattern for deterministic concurrency on Apple platforms.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ocsp.apple.com
  • Triggering command: /usr/share/swift/usr/bin/swift-build /usr/share/swift/usr/bin/swift-build --target AuthTests grep -l tub ests/PostgrestQueryBuilderTests.swift tnet/tools/grep tub .swift tnet/tools/bash grep -l tub ts/EventEmitterT2 ep tub fig.swift grep grep (dns block)
  • Triggering command: /usr/share/swift/usr/bin/swift-test /usr/share/swift/usr/bin/swift-test --filter SessionManagerTests/testRefreshCancellation_shouldRestoreUsableState -fPIC -g -g -fno-omit-frame-pointer urces/SwiftBasicFormat/BasicFormat.swift urces/SwiftBasicFormat/InferIndentation.swift urces/SwiftBasicFormat/Syntax+Extensions.swift urces/SwiftBasicFormat/SyntaxProtocol+Formatted.swift urces/SwiftBasicFormat/Trivia+FormatExtensions.swift m/Ma�� /supabase-swift/-DDEBUG=1 /swift-crypto/So-fblocks e-swift debug/Modules git 8f0d2ca924db-target --alternate-refsx86_64-REDACTED-linux-gnu known-linux-gnu/-O0 (dns block)
  • Triggering command: /usr/share/swift/usr/bin/swift-test /usr/share/swift/usr/bin/swift-test --filter SessionManagerTests --skip-build -C debug/Modules/SwiftSyntaxBuilder.swiftmodule .build/x86_64-un-fno-omit-frame-pointer debug/SwiftSyntaxBuilder.build/SwiftSyntaxBuilder.swiftmodule.o 6f70fa9eab24c1fdgit known-linux-gnu/-C (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)