# REF-TASK-006 — Split authentication HTTP tests by route family

**Status:** Implemented  
**Kind:** Test-only refactor  
**Depends on:** None

## Problem and evidence

`backend/src/auth-http.test.ts` is about 2,033 lines and covers CSRF/session basics, login/logout,
profile and password changes, password recovery, throttling, email test routes, and Mocking Bird.
Its `makeApp` setup also supplies unrelated product/order collaborators because it exercises the
composed app. This makes route-local changes slow to navigate and prepares poorly for splitting
`auth-http.ts`.

## Proposed change

Create focused test files for session/authentication, account settings, password recovery, and
developer email tools. Move a typed app builder and default inert collaborators into backend test
support, while allowing each file to override only its subject. Preserve composed-app coverage for
registration/security hooks that cannot be proven by an isolated registrar.

## Constraints and sequence

First move tests verbatim and compare count/names. Extract setup only after the moved suites pass.
Do not weaken exact-origin, CSRF, no-store, throttling, session-rotation, generic recovery response,
or production-disablement assertions. Keep synthetic secrets/identities synthetic.

## Validation

Run each split file after moving it, then the full backend fast suite, `pnpm traceability:check`,
and `pnpm quality`. Production build, integration, and E2E are not required for the test-only
change.

## Guidance / ADR

REF-TASK-018 should document backend HTTP test organization. No ADR.