Bind Reddit and Matrix session identities

tests/account-auth-context.test.ts

@@ -10,7 +10,7 @@ describe('AccountAuthContext', () => {
     const refreshMatrixCredentials = vi.fn();
 
     await expect(authenticateCurrentAccount({
-      getRedditUsername: vi.fn().mockResolvedValue(null),
+      getRedditIdentity: vi.fn().mockResolvedValue(null),
       refreshMatrixCredentials,
     })).resolves.toBeNull();
 
@@ -20,7 +20,7 @@ describe('AccountAuthContext', () => {
   it('fails closed until Reddit and Matrix resolve to one authenticated account', async () => {
     const auth = new AccountAuthContext(createMockLogger());
     const authenticate = vi.fn().mockResolvedValue({
-      accountId: '@t2_account:reddit.com',
+      accountId: 't2_account',
       redditUsername: 'account',
       matrixUserId: '@t2_account:reddit.com',
     });
@@ -34,7 +34,7 @@ describe('AccountAuthContext', () => {
     expect(auth.isFullyAuthenticated()).toBe(true);
     expect(auth.getSnapshot()).toMatchObject({
       status: 'authenticated',
-      accountId: '@t2_account:reddit.com',
+      accountId: 't2_account',
     });
   });
 
@@ -52,7 +52,7 @@ describe('AccountAuthContext', () => {
     const second = auth.ensureFullyAuthenticated();
     await vi.waitFor(() => expect(authenticate).toHaveBeenCalledOnce());
     resolveAuth?.({
-      accountId: '@t2_account:reddit.com',
+      accountId: 't2_account',
       redditUsername: 'account',
       matrixUserId: '@t2_account:reddit.com',
     });
@@ -63,7 +63,7 @@ describe('AccountAuthContext', () => {
   it('invalidates the whole account context when either login layer expires', async () => {
     const auth = new AccountAuthContext(createMockLogger());
     auth.markAuthenticated({
-      accountId: '@t2_account:reddit.com',
+      accountId: 't2_account',
       redditUsername: 'account',
       matrixUserId: '@t2_account:reddit.com',
     });
@@ -86,7 +86,7 @@ describe('AccountAuthContext', () => {
       now: () => now,
     });
     auth.markAuthenticated({
-      accountId: '@t2_account:reddit.com',
+      accountId: 't2_account',
       redditUsername: 'account',
       matrixUserId: '@t2_account:reddit.com',
     });
@@ -115,4 +115,20 @@ describe('AccountAuthContext', () => {
     await auth.ensureFullyAuthenticated();
     expect(authenticate).toHaveBeenCalledTimes(2);
   });
+
+  it('fails closed when Reddit and Matrix belong to different accounts', async () => {
+    const auth = new AccountAuthContext(createMockLogger());
+    auth.setAuthenticator(vi.fn().mockResolvedValue({
+      accountId: 't2_cookie',
+      redditUsername: 'cookie-account',
+      matrixUserId: '@t2_chat:reddit.com',
+    }));
+
+    await expect(auth.ensureFullyAuthenticated()).resolves.toBe(false);
+    expect(auth.getSnapshot()).toMatchObject({
+      status: 'login-required',
+      accountId: null,
+      reason: expect.stringMatching(/does not match Matrix account/),
+    });
+  });
 });