test(e2e): cover intent and consent across every auth strategy

[rohanchkrabrty]

Summary

• The cross-cutting matrix for RFC 0002 through a real server: three intents against an address that does and does not have an account, at both enforcement points, one case per strategy, and the complete, incomplete and unknown-id consent sets. Every unit test in the stack holds with the rest of it mocked out; none of them answers whether a signup that goes out to a provider and comes back leaves a user row and a consent record that say the right things.
• Two suites, because app.consent is read at boot and cannot be changed on a running server. The enabled one drives mail OTP through test users, OIDC through mockoidc and passkey up to the ceremony; the disabled one is the promise the RFC makes to every existing deployment, that nothing changes.
• The rollback case injects a failing insert with a temporary trigger, because nothing reachable through the API can produce one — a bad payload is rejected before the transaction opens, and a well-formed write satisfies every constraint. It then drops the trigger and reruns the same signup successfully, so the failure is provably the injected one.
• The suites read users and user_consents directly, for the two things the API deliberately does not serve: the absence of a user row, and the contents of a consent record.
• Neither passkey finish method is reachable, and a skipped case says so rather than leaving the hole invisible — the register method puts the gate behind a WebAuthn attestation, and the login method needs an account carrying a credential only that same ceremony writes. Closing it needs a virtual authenticator, which is a new dependency and its own change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 31, 2026 7:12pm

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 33429109833

Coverage remained the same at 50.11%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	41058
Covered Lines:	20574
Line Coverage:	50.11%
Coverage Strength:	15.97 hits per line

---

💛 - Coveralls