fix im p0 backend issues

server/session_test.go

@@ -19,6 +19,48 @@ type testTenantStore struct {
 	err    error
 }
 
+type testLoginDeviceStore struct {
+	devices map[types.Uid][]types.DeviceDef
+	updates int
+	err     error
+}
+
+func (s *testLoginDeviceStore) Update(tenantID types.TenantID, uid types.Uid, oldDeviceID string, dev *types.DeviceDef) error {
+	s.updates++
+	if s.err != nil {
+		return s.err
+	}
+	if dev != nil {
+		dev.TenantID = tenantID
+		s.devices[uid] = append(s.devices[uid], *dev)
+	}
+	return nil
+}
+
+func (s *testLoginDeviceStore) GetAll(_ types.TenantID, uids ...types.Uid) (map[types.Uid][]types.DeviceDef, int, error) {
+	if s.err != nil {
+		return nil, 0, s.err
+	}
+	result := make(map[types.Uid][]types.DeviceDef)
+	count := 0
+	for _, uid := range uids {
+		result[uid] = append([]types.DeviceDef(nil), s.devices[uid]...)
+		count += len(result[uid])
+	}
+	return result, count, nil
+}
+
+func (s *testLoginDeviceStore) Delete(_ types.TenantID, uid types.Uid, deviceID string) error {
+	devices := s.devices[uid]
+	for i, device := range devices {
+		if device.DeviceId == deviceID {
+			s.devices[uid] = append(devices[:i], devices[i+1:]...)
+			return nil
+		}
+	}
+	return types.ErrNotFound
+}
+
 func (s testTenantStore) GetByCode(string) (*types.Tenant, error) {
 	return s.tenant, s.err
 }
@@ -46,6 +88,40 @@ func test_makeSession(uid types.Uid) *Session {
 	}
 }
 
+func TestLoginDeviceSecurityNoticeOnlyForNewDevice(t *testing.T) {
+	uid := types.Uid(42)
+	devices := &testLoginDeviceStore{devices: map[types.Uid][]types.DeviceDef{
+		uid: {{TenantID: 7, DeviceId: "known-device", Platform: "ios"}},
+	}}
+	security := &testSecurityStore{}
+	oldDevices := store.Devices
+	oldSecurity := store.Security
+	store.Devices = devices
+	store.Security = security
+	t.Cleanup(func() {
+		store.Devices = oldDevices
+		store.Security = oldSecurity
+	})
+
+	known, err := isNewLoginDevice(7, uid, "known-device")
+	if err != nil || known {
+		t.Fatalf("known device detected as new: new=%v err=%v", known, err)
+	}
+	newDevice, err := isNewLoginDevice(7, uid, "new-device")
+	if err != nil || !newDevice {
+		t.Fatalf("new device was not detected: new=%v err=%v", newDevice, err)
+	}
+
+	createLoginDeviceSecurityNotice(7, uid, "new-device", "ios", "UnitTestUA", time.Date(2026, 9, 6, 12, 0, 0, 0, time.UTC))
+	if len(security.notifications) != 1 {
+		t.Fatalf("expected one security notification, got %d", len(security.notifications))
+	}
+	notification := security.notifications[0]
+	if notification.EventType != "security.login_device" || notification.Title == "" || notification.Action["device_id"] != "new-device" {
+		t.Fatalf("unexpected login device notification: %#v", notification)
+	}
+}
+
 func TestDispatchHello(t *testing.T) {
 	oldTenants := store.Tenants
 	store.Tenants = testTenantStore{tenant: &types.Tenant{