USER-WP-0039: show account-site and Authelia uid on the account page (NK-WP-0051-T03)

The Identity section now names both session uids on separate lines and
marks a mismatch, using the existing server-side Authelia /api/state
lookup. Unknown Authelia uid reads 'not signed in / unknown'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

tests/test_account_identity_disclosure.py

@@ -55,11 +55,62 @@ class AccountIdentityDisclosureTests(unittest.TestCase):
         _, body = invoke(
             self.app, "/", cookie="ue_session=member; authelia_session=super-secret-session"
         )
-        self.assertIn(b"Signed in as", body)
-        self.assertIn(b"sample.user", body)
-        self.assertNotIn(b"platform-root", body)
+        # The account-site session stays; the other Authelia uid is only shown.
+        self.assertIn(b"Signed in as <strong>sample.user</strong>", body)
+        self.assertNotIn(b"Signed in as <strong>platform-root</strong>", body)
         self.assertNotIn(b'href="/login"', body)
-        self.assertEqual([], self.app.identity_lookup.headers)
+        self.assertNotIn(b"super-secret-session", body)
+        self.assertEqual(1, len(self.app.identity_lookup.headers))
+
+    # NK-WP-0051-T03: two labelled uid lines and a visible mismatch marker.
+    def _uid_lines(self, path, lookup_result, cookie="ue_session=member; authelia_session=super-secret-session"):
+        self.app.identity_lookup = RecordingLookup(lookup_result)
+        response, body = invoke(self.app, path, cookie=cookie)
+        self.assertEqual("200 OK", response["status"])
+        return body
+
+    def test_signed_in_page_names_both_session_uids(self):
+        for path in ["/", "/onboarding"]:
+            with self.subTest(path=path):
+                body = self._uid_lines(path, "sample.user")
+                self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong></dd>', body)
+                self.assertIn(b'<dd data-session="authelia"><strong>sample.user</strong></dd>', body)
+                self.assertIn(b"Account site session <code>uid</code>", body)
+                self.assertIn(b"Authelia session <code>uid</code>", body)
+                self.assertNotIn(b"session-uid-mismatch", body)
+                self.assertEqual(1, len(self.app.identity_lookup.headers))
+
+    def test_differing_authelia_uid_is_marked(self):
+        for path in ["/", "/onboarding"]:
+            with self.subTest(path=path):
+                body = self._uid_lines(path, "bernd.worsch-3")
+                self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong></dd>', body)
+                self.assertIn(b'<dd data-session="authelia"><strong>bernd.worsch-3</strong></dd>', body)
+                self.assertIn(b'role="alert" class="session-uid-mismatch"', body)
+                self.assertIn(b"These sessions differ.", body)
+                self.assertIn(b"https://kc.example/account/logout", body)
+                self.assertNotIn(b"super-secret-session", body)
+
+    def test_unknown_authelia_uid_is_not_guessed(self):
+        cases = [
+            (None, "ue_session=member; authelia_session=opaque"),
+            (TimeoutError("slow"), "ue_session=member; authelia_session=opaque"),
+            ("<script>x</script>", "ue_session=member; authelia_session=opaque"),
+            ("sample.user", "ue_session=member"),
+        ]
+        for result, cookie in cases:
+            with self.subTest(result=result, cookie=cookie):
+                body = self._uid_lines("/", result if cookie.count("authelia") else None, cookie)
+                self.assertIn(b'<dd data-session="authelia">not signed in / unknown</dd>', body)
+                self.assertNotIn(b"session-uid-mismatch", body)
+                self.assertNotIn(b"<script>x", body)
+
+    def test_without_lookup_authelia_uid_is_unknown(self):
+        self.app.identity_lookup = None
+        _, body = invoke(self.app, "/", cookie="ue_session=member; authelia_session=opaque")
+        self.assertIn(b'<dd data-session="authelia">not signed in / unknown</dd>', body)
+        self.assertNotIn(b"session-uid-mismatch", body)
+        self.assertNotIn(b"opaque", body)
 
     def test_lookup_failure_or_unsafe_name_stays_signed_out(self):
         for result in [TimeoutError("slow"), "<script>alert(1)</script>", "platform root"]: