fix(workspaces): align postgres connection diagnostics

backend/test/auth-diagnostics.test.ts

@@ -60,6 +60,40 @@ function registryYaml(role: "user" | "admin", passwordHash = validPasswordHash):
   ].join("\n");
 }
 
+test("reports upstream authentication ready when its protected session root is valid", async () => {
+  const report = await createAuthDiagnoser({
+    authMode: "upstream",
+    authStateRoot: "/safe/auth-state",
+    sessionRootValidator: acceptSessionRoot,
+  }).inspect({ live: true });
+
+  expect(report).toEqual({
+    ready: true,
+    mode: "upstream",
+    checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }],
+  });
+});
+
+test("upstream authentication still fails when its protected session root is invalid", async () => {
+  const sentinel = "synthetic-upstream-session-root-secret";
+  const report = await createAuthDiagnoser({
+    authMode: "upstream",
+    authStateRoot: "/safe/auth-state",
+    sessionRootValidator: async () => { throw new Error(sentinel); },
+  }).inspect({ live: true });
+
+  expect(report).toEqual({
+    ready: false,
+    mode: "upstream",
+    checks: [{
+      level: "error",
+      code: "auth_session_store_invalid",
+      message: "The authentication session store is invalid.",
+    }],
+  });
+  expect(JSON.stringify(report)).not.toContain(sentinel);
+});
+
 test("reports deterministic live OIDC checks and silently ignores unrelated groups", async () => {
   const oidcDiagnose = vi.fn(async () => undefined);
   const fetch = vi.fn<typeof globalThis.fetch>(async (input) => {