Record usernames for manual provisioning requests

tests/unit/auth-guard.test.ts

@@ -47,6 +47,20 @@ beforeEach(() => {
 afterEach(() => { vi.useRealTimers(); vi.unstubAllEnvs(); });
 
 describe('browser authentication guard', () => {
+    it('carries the session username through an authenticated action, ignoring requester fields from the client', async () => {
+        const { currentRequestUsername } = await import('../../src/lib/server/auth/request-context.js');
+        signIn('operator');
+        const call = requestFor('/api/provisioning', { method: 'POST', body: { requested_by: 'someone-else' },
+            resolve: async event => {
+                await event.request.json();
+                expect(currentRequestUsername()).toBe('tester');
+                return new Response('queued');
+            }
+        });
+        expect((await call.invoke()).status).toBe(200);
+        expect(currentRequestUsername()).toBeNull();
+    });
+
     it.each(['GET', 'HEAD'])('allows anonymous leaderboard %s requests even before account setup', async method => {
         for (const setup of [false, true]) {
             auth.setup = setup;