fix: harden request handling, pipeline containment, and startup boundaries

backend/tests/test_spotify_auth.py

@@ -6,12 +6,14 @@ import hashlib
 import time
 
 import httpx2
+import pytest
 
 from app.adapters.spotify.auth import (
     TokenSet,
     derive_code_challenge,
     refresh_access_token,
 )
+from app.adapters.spotify.session import PendingLogins
 
 
 def test_code_challenge_is_unpadded_base64url_sha256() -> None:
@@ -43,3 +45,18 @@ def test_refresh_keeps_existing_refresh_token_when_omitted() -> None:
 def test_token_expiry_uses_sixty_second_skew() -> None:
     assert TokenSet("access", "refresh", time.monotonic() + 59).is_expired
     assert not TokenSet("access", "refresh", time.monotonic() + 61).is_expired
+
+
+def test_pending_login_add_sweeps_expired_entries(monkeypatch: pytest.MonkeyPatch) -> None:
+    current_time = 0.0
+    monkeypatch.setattr(
+        "app.adapters.spotify.session.time.monotonic",
+        lambda: current_time,
+    )
+    pending_logins = PendingLogins()
+    pending_logins.add("expired", "old-verifier")
+
+    current_time = 601.0
+    pending_logins.add("current", "new-verifier")
+
+    assert set(pending_logins._entries) == {"current"}