chore: import upstream snapshot with attribution

server/auth/authenticator_test.go

@@ -0,0 +1,34 @@
+package auth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestAuthenticateNoCredentials covers the store-free paths: absent or malformed
+// credentials must resolve to "unauthenticated" without touching the store.
+// Token-valid paths are exercised by the API/fileserver integration tests.
+func TestAuthenticateNoCredentials(t *testing.T) {
+	ctx := context.Background()
+	a := &Authenticator{secret: "test-secret"} // nil store: these paths never reach it.
+
+	t.Run("Authenticate returns nil without an Authorization header", func(t *testing.T) {
+		assert.Nil(t, a.Authenticate(ctx, ""))
+	})
+	t.Run("Authenticate returns nil for a malformed bearer token", func(t *testing.T) {
+		assert.Nil(t, a.Authenticate(ctx, "Bearer not-a-valid-jwt"))
+	})
+
+	t.Run("AuthenticateToUser returns nil without any credentials", func(t *testing.T) {
+		user, err := a.AuthenticateToUser(ctx, "", "")
+		assert.NoError(t, err)
+		assert.Nil(t, user)
+	})
+	t.Run("AuthenticateToUser returns nil for a malformed bearer and no cookie", func(t *testing.T) {
+		user, err := a.AuthenticateToUser(ctx, "Bearer not-a-valid-jwt", "")
+		assert.NoError(t, err)
+		assert.Nil(t, user)
+	})
+}