Bun tests fail: 4 pre-existing failures in OAuthProvider + sessionValidator

[heskew]

Summary

Four tests fail under bun test but pass under node --test. Failures are pre-existing on main (reproduced at commit 9eb0d0f).

Failing tests

test/lib/OAuthProvider.test.js

• OAuthProvider > CSRF Token Management > should store metadata with token
  • AssertionError: strictEqual 0 !== 1 at line 243
  • storedTokens.size is 0 after generateCSRFToken() — the mock table write didn't land
• OAuthProvider > CSRF Token Management > should verify and consume valid token
  • AssertionError: null == true at line 256
  • verifyCSRFToken() returns null because the prior generate call didn't store anything

test/lib/sessionValidator.test.js

• should use default validation interval when not specified
• should not validate tokens with expiration (Google-style)
  • AssertionError: Should NOT validate tokens that have expiration (use refresh flow instead)

Environment

• Bun: 1.3.10 (local), 1.3.12 (CI)
• Node: v24.13.0 — tests pass on Node 20/22/24
• All failures originate in bun test only

Reproduce

git checkout main
bun test
# 418 pass, 2 skip, 4 fail

What's likely going on

All four failures hinge on the Bun-specific test harness (test/bun-preload.js mocks the harperdb module). A state mutation or timing difference between Bun and Node is causing mocked table writes to appear not to land in the CSRF tests, and the sessionValidator tests look like they're hitting a different code path under Bun's promise/microtask scheduler.

Why CI didn't catch it earlier

Last main CI run reported Test with Bun: success on 9eb0d0f, but local bun test on that same commit shows 4 failures. Either flaky CI environment or a Bun version drift between then and now. Either way the tests are not reliably passing.

Next step

Triage cause: mock harness vs. Bun behavior vs. source regression. First pass — run one failing test in isolation to rule out cross-test state (bun test test/lib/OAuthProvider.test.js -t "should store metadata with token").