test(sdk-api): pin v1-leg password rotation behavior

[pranavjain97]

What

Follow-up to #9715 (WCN-2640). The merged unit test "shares one encryption session across keychain password updates" asserted encryptionSession reached the deprecated v1-leg via a stubbed updatePassword, implying the v1-leg consumes the session. It does not: src/v1/keychains.ts validates only oldPassword/newPassword, ignores encryptionSession/encryptionVersion, and preserves each envelope's version (isV2Envelope ? 2 : 1). The assertion passed only because the stub swallowed all args.

Changes

• test/unit/bitgoAPI.ts: renamed the test to "creates one encryption session, passes it to both keychain update calls, and destroys it" and documented that the session is consumed by the coin-leg only; call-site assertions retained.
• test/unit/v1/keychains.ts (new): exercises the real v1-leg Keychains.prototype.updatePassword with nocked POST /user/encrypted, pinning the wire contract:
  • session encrypt/destroy are never called (v1-leg does not use sessions);
  • re-encryption preserves per-envelope versions (v1 -> encryptionVersion: 1, v2 -> 2) even when the caller passes encryptionVersion: 2 + a session (v1 stays v1 during a v2 rotation);
  • keychains that fail decryption with the old password are kept unchanged.

Verification

• npx tsc --noEmit -p modules/sdk-api/tsconfig.json — clean
• npx mocha test/unit/v1/keychains.ts test/unit/bitgoAPI.ts — 67 passing
• npx eslint --quiet on both files — clean
• npx prettier --check — clean

[linear-code]

WCN-2640

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run