Add tests for whitespace-only resolved identity (CL-6286)

Adversarial review: "string >= 1" on ResolvedCallerSchema is a LENGTH
constraint, not a content one -- " " has length 1 and passes it, so a
whitespace-only tenantId/principalId was still seated as a "valid" scope.
Same bug class PR #34 fixed in optionalEnv (v.length > 0 accepted "   ").

Extends the malformed-output regression test (deps.test.ts and the
end-to-end test in routes.test.ts) to cover a whitespace-only id alongside
the empty-string case. Red against the current resolveCaller, which still
seats it; the next commit rejects it.

Author: TheGreatAxios

src/routes/deps.test.ts

@@ -230,6 +230,30 @@ describe("resolveCaller", () => {
     expect(sets.tenant).toBeUndefined();
   });
 
+  test("rejects a whitespace-only tenantId/principalId with 500, never seating it", async () => {
+    // "string >= 1" is a LENGTH constraint -- " " has length 1 and would
+    // pass it. This is the same class of bug PR #34 fixed in optionalEnv
+    // (v.length > 0 accepted "   "); this test is the regression guard for
+    // it at this boundary.
+    const { ctx, sets, jsonCalls } = fakeContext();
+    const routeDeps: RouteDeps = {
+      ...deps(grantsWith()),
+      callerResolver: () => ({ tenantId: " ", principalId: "\t\n" }),
+    };
+    let nextCalled = false;
+    await resolveCaller(routeDeps)(ctx, async () => {
+      nextCalled = true;
+    });
+    expect(nextCalled).toBe(false);
+    expect(jsonCalls).toHaveLength(1);
+    expect(jsonCalls[0]?.status).toBe(500);
+    expect(jsonCalls[0]?.body).toMatchObject({
+      error: { code: "invalid_resolved_caller" },
+    });
+    expect(sets.principal).toBeUndefined();
+    expect(sets.tenant).toBeUndefined();
+  });
+
   test("rejects a resolved value missing principalId with 500", async () => {
     const { ctx, jsonCalls } = fakeContext();
     const routeDeps: RouteDeps = {

src/routes/routes.test.ts

@@ -615,23 +615,33 @@ describe("memory HTTP routes — resolver trust-boundary and row-fabrication con
     expect(added).toHaveLength(0);
   });
 
-  test("a resolver returning an empty-string identity is rejected, not seated as a garbage scope", async () => {
-    // A grant that would (wrongly) authorize the empty-string principal if
-    // the malformed identity were ever seated — proving rejection happens
-    // before grantGuard, not that no grant happened to match.
-    const { app, added } = buildAppWithCallerResolver(
-      [grant("", "add")],
-      () => ({ tenantId: "", principalId: "" }),
-    );
-    const res = await app.request(
-      "/api/tenants/t1/memory/add",
-      jsonPost({ title: "t", text: "body" }),
-    );
-    expect(res.status).toBe(500);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("invalid_resolved_caller");
-    expect(added).toHaveLength(0);
-  });
+  test.each([
+    ["empty-string", { tenantId: "", principalId: "" }],
+    // "string >= 1" would be a LENGTH constraint only -- " " has length 1
+    // and would pass it, seating a whitespace-only scope wearing the same
+    // costume as the empty-string case above. This is the regression guard
+    // for that boundary (same bug class PR #34 fixed in optionalEnv).
+    ["whitespace-only", { tenantId: " ", principalId: "\t\n" }],
+  ] as const)(
+    "a resolver returning a %s identity is rejected, not seated as a garbage scope",
+    async (_label, resolved) => {
+      // A grant that would (wrongly) authorize the malformed principal if
+      // the identity were ever seated — proving rejection happens before
+      // grantGuard, not that no grant happened to match.
+      const { app, added } = buildAppWithCallerResolver(
+        [grant(resolved.principalId, "add")],
+        () => resolved,
+      );
+      const res = await app.request(
+        "/api/tenants/t1/memory/add",
+        jsonPost({ title: "t", text: "body" }),
+      );
+      expect(res.status).toBe(500);
+      const body = (await res.json()) as { error: { code: string } };
+      expect(body.error.code).toBe("invalid_resolved_caller");
+      expect(added).toHaveLength(0);
+    },
+  );
 
   /**
    * `principalRowFor`/`tenantRowFor` (deps.ts) fabricate `PrincipalRow`/