test: add unified auth integration coverage

graphql/server-test/package.json

@@ -29,6 +29,7 @@
     "test:watch": "jest --watch"
   },
   "devDependencies": {
+    "12factor-env": "workspace:^",
     "@0no-co/graphql.web": "^1.3.3",
     "@agentic-kit/ollama": "workspace:*",
     "@constructive-io/graphql-codegen": "workspace:^",

graphql/server-test/src/constructive-db-runtime.ts

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+import { cleanEnv, str, withDefault } from '12factor-env';
+
+const runtimeEnv = (): { applicationPath: string } => {
+  const parsed = cleanEnv(process.env, {
+    CONSTRUCTIVE_DB_APPLICATION_PATH: withDefault(str, '')
+  });
+  return { applicationPath: parsed.CONSTRUCTIVE_DB_APPLICATION_PATH.trim() };
+};
+
+/**
+ * Resolve an explicitly pinned generated Constructive DB application checkout.
+ * Empty means the cross-repository suite is not part of the current test run.
+ */
+export const getConstructiveDbApplicationPath = (): string | null => {
+  const configured = runtimeEnv().applicationPath;
+  if (!configured) return null;
+  const resolved = path.resolve(configured);
+  if (!existsSync(path.join(resolved, 'pgpm.plan'))) {
+    throw new Error(
+      `CONSTRUCTIVE_DB_APPLICATION_PATH does not contain a generated pgpm application: ${resolved}`
+    );
+  }
+  return resolved;
+};

graphql/server-test/src/index.ts

@@ -1,3 +1,5 @@
+export { getConstructiveDbApplicationPath } from './constructive-db-runtime';
+
 // Export types
 export * from './types';
 

graphql/server-test/src/server.ts

@@ -48,7 +48,10 @@ export const createTestServer = async (
     server: {
       ...opts.server,
       host,
-      port
+      port,
+      ...(serverOpts.trustProxy !== undefined && {
+        trustProxy: serverOpts.trustProxy
+      })
     }
   };
 

graphql/server-test/src/types.ts

@@ -16,6 +16,8 @@ export interface ServerOptions {
   port?: number;
   /** Host to bind the server to (defaults to localhost) */
   host?: string;
+  /** Trust the forwarded protocol when a test exercises an HTTPS callback. */
+  trustProxy?: boolean;
   /**
    * Which server to run this suite against:
    * - `true` (default): the production `@constructive-io/graphql-server`, which

packages/express-context/__tests__/loaders/sso-surface.test.ts

@@ -49,6 +49,9 @@ describe('ssoSurfaceLoader', () => {
     expect(calls[0].text).toMatch(
       /private_schema\.id = unified_auth\.private_schema_id/
     );
+    expect(calls[0].text).toMatch(
+      /private_schema\.schema_name AS private_schema/
+    );
   });
 
   it('returns undefined when this Tenant has no provisioned module', async () => {

packages/express-context/src/loaders/sso-surface.ts

@@ -15,7 +15,7 @@ import type { LoaderContext, ModuleLoader } from './types';
 import { requireDatabaseId } from './types';
 
 const SSO_SURFACE_SQL = `
-  SELECT private_schema.name AS private_schema
+  SELECT private_schema.schema_name AS private_schema
   FROM metaschema_modules_public.unified_auth_module unified_auth
   JOIN metaschema_public.schema private_schema
     ON private_schema.id = unified_auth.private_schema_id