fix

apps/api/internal/httpapi/admin_dev_impersonation_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
+func TestRouterProductionMountsImpersonationBehindAuth(t *testing.T) {
 	t.Parallel()
 	s := testAPIServer()
 	s.Config.AppEnv = "production"
@@ -16,6 +16,7 @@ func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
 		"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
 		"/api/admin/dev/stop-impersonate",
 		"/api/admin/dev/switchable-users",
+		"/api/admin/users/00000000-0000-0000-0000-000000000001/dev-password",
 	} {
 		rec := httptest.NewRecorder()
 		method := http.MethodPost
@@ -23,10 +24,9 @@ func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
 			method = http.MethodGet
 		}
 		h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
-		// Unauthenticated session yields 401; production must not expose the route as 200/403 from the handler.
-		// Mounted routes behind RequireSession return 401; unmounted chi paths under /api/admin still hit RequireSession then 404 for unknown — either way not a successful switch.
+		// Unauthenticated: RequireSession → 401. Must not succeed without a session.
 		if rec.Code == http.StatusOK {
-			t.Fatalf("%s returned 200 in production", path)
+			t.Fatalf("%s returned 200 without auth in production", path)
 		}
 	}
 }