fix(auth): unify imported sessions with account gating

tests/reddit-session-importer.test.ts

@@ -15,11 +15,16 @@ const credentials = {
 
 describe('RedditSessionImporter', () => {
   it('verifies both parts of the dump before activating the account', async () => {
-    const browser = { importRedditCookies: vi.fn(), isSessionValid: vi.fn(async () => true) };
+    const browser = {
+      importRedditCookies: vi.fn(),
+      isSessionValid: vi.fn(async () => true),
+      getAuthenticatedUsername: vi.fn(async () => 'bot-account'),
+    };
     const matrix = { whoami: vi.fn(async () => credentials.userId) };
     const chat = { setMatrixClient: vi.fn() };
     const save = vi.fn();
-    const importer = new RedditSessionImporter(browser, chat as never, vi.fn(() => matrix as never), save);
+    const accountAuth = { markAuthenticated: vi.fn() };
+    const importer = new RedditSessionImporter(browser, chat as never, vi.fn(() => matrix as never), save, accountAuth as never);
 
     await importer.import(cookies, credentials);
 
@@ -27,15 +32,21 @@ describe('RedditSessionImporter', () => {
     expect(browser.importRedditCookies).toHaveBeenCalledWith(cookies);
     expect(chat.setMatrixClient).toHaveBeenCalledWith(matrix);
     expect(save).toHaveBeenCalledWith(credentials);
+    expect(accountAuth.markAuthenticated).toHaveBeenCalledWith({
+      accountId: credentials.userId,
+      redditUsername: 'bot-account',
+      matrixUserId: credentials.userId,
+    });
   });
 
   it('rejects non-Reddit Matrix homeservers without making a request', async () => {
     const createMatrix = vi.fn();
     const importer = new RedditSessionImporter(
-      { importRedditCookies: vi.fn(), isSessionValid: vi.fn() },
+      { importRedditCookies: vi.fn(), isSessionValid: vi.fn(), getAuthenticatedUsername: vi.fn() },
       { setMatrixClient: vi.fn() } as never,
       createMatrix,
       vi.fn(),
+      { markAuthenticated: vi.fn() } as never,
     );
 
     await expect(importer.import(cookies, { ...credentials, homeserver: 'https://attacker.example' }))