fix broken tests

server/webapi/handlers/buddylist_test.go

@@ -894,19 +894,20 @@ func TestRequireSession(t *testing.T) {
 			expectNextCalled:   false,
 		},
 		{
-			name:   "Error_AnonymousSession",
-			aimsid: "anon-session",
+			name:   "Error_NilOSCARSession",
+			aimsid: "no-oscar-session",
 			setupMocks: func(sm *MockWebAPISessionManager, aimsid string) {
 				sess := &state.WebAPISession{
 					AimSID:       aimsid,
-					ScreenName:   state.DisplayScreenName("Guest_abc"),
+					ScreenName:   state.DisplayScreenName("someuser"),
 					LastAccessed: time.Now(),
-					// OSCARSession is nil - anonymous session.
+					// OSCARSession is nil - a broken server invariant, since
+					// startSession never creates a session without one.
 				}
 				sm.On("GetSession", mock.Anything, aimsid).Return(sess, nil)
 			},
-			expectedStatusCode: http.StatusUnauthorized,
-			expectedResponse:   `{"response":{"statusCode":401,"statusText":"invalid or expired session"}}`,
+			expectedStatusCode: http.StatusInternalServerError,
+			expectedResponse:   `{"response":{"statusCode":500,"statusText":"internal server error"}}`,
 			expectNextCalled:   false,
 		},
 		{

server/webapi/handlers/preference_test.go

@@ -189,9 +189,10 @@ func TestPreferenceHandler_SetPreferences_NoOSCARSession(t *testing.T) {
 	rr := httptest.NewRecorder()
 	requireSession(handler.SessionManager, handler.SetPreferences).ServeHTTP(rr, req)
 
-	// Anonymous (nil OSCAR) sessions are rejected by the session middleware
-	// before the handler runs, so no feedbag lookup occurs.
-	assert.Equal(t, http.StatusUnauthorized, rr.Code)
-	assert.Contains(t, rr.Body.String(), "invalid or expired session")
+	// A nil OSCARSession is a broken server invariant (guests are unsupported),
+	// so the session middleware rejects it with a 500 before the handler runs
+	// and no feedbag lookup occurs.
+	assert.Equal(t, http.StatusInternalServerError, rr.Code)
+	assert.Contains(t, rr.Body.String(), "internal server error")
 	fs.AssertNotCalled(t, "Query", mock.Anything, mock.Anything, mock.Anything)
 }

server/webapi/handlers/presence_test.go

@@ -467,8 +467,8 @@ func TestPresenceHandler_SetState_MyInfoNormalizesAimID(t *testing.T) {
 }
 
 func TestPresenceHandler_SetState_NoOSCARSession_Rejected(t *testing.T) {
-	// Anonymous (web-only, no OSCAR) sessions are rejected by the session
-	// middleware before the handler runs.
+	// A nil OSCARSession is a broken server invariant (guests are unsupported),
+	// so the session middleware rejects it with a 500 before the handler runs.
 	sessionMgr, aimsid := createTestSessionManager("testuser")
 
 	handler := &PresenceHandler{
@@ -482,8 +482,8 @@ func TestPresenceHandler_SetState_NoOSCARSession_Rejected(t *testing.T) {
 	rr := httptest.NewRecorder()
 	requireSession(handler.SessionManager, handler.SetState).ServeHTTP(rr, req)
 
-	assert.Equal(t, http.StatusUnauthorized, rr.Code)
-	assert.Contains(t, rr.Body.String(), "invalid or expired session")
+	assert.Equal(t, http.StatusInternalServerError, rr.Code)
+	assert.Contains(t, rr.Body.String(), "internal server error")
 }
 
 func TestIsICQScreenName(t *testing.T) {