fix(auth): make diagnostics match runtime safety

backend/src/auth/authentik-group-catalog.ts

@@ -107,7 +107,10 @@ function validContentLength(response: Response): boolean {
 }
 
 async function readBounded(response: Response, signal: AbortSignal): Promise<Uint8Array | undefined> {
-  if (!validContentLength(response)) return undefined;
+  if (!validContentLength(response)) {
+    cancelResponse(response);
+    return undefined;
+  }
   const reader = response.body?.getReader();
   if (!reader) return new Uint8Array();
   const chunks: Uint8Array[] = [];
@@ -144,12 +147,15 @@ function exactResult(name: string, parsed: unknown): GroupResult {
     || Array.isArray(record.pagination)) return "unreachable";
   const next = (record.pagination as { next?: unknown }).next;
   if (next !== null && next !== undefined) return "ambiguous";
-  if (record.results.length === 0) return "missing";
-  if (record.results.length !== 1) return "ambiguous";
-  const result = record.results[0];
-  if (!result || typeof result !== "object" || Array.isArray(result)
-    || (result as { name?: unknown }).name !== name) return "missing";
-  return "present";
+  const resultNames: string[] = [];
+  for (const result of record.results) {
+    if (!result || typeof result !== "object" || Array.isArray(result)
+      || typeof (result as { name?: unknown }).name !== "string") return "unreachable";
+    resultNames.push((result as { name: string }).name);
+  }
+  const exactMatches = resultNames.filter((candidate) => candidate === name).length;
+  if (exactMatches === 0) return "missing";
+  return exactMatches === 1 ? "present" : "ambiguous";
 }
 
 export function createAuthentikGroupCatalog(options: AuthentikGroupCatalogOptions): GroupCatalog {