The sessions required for Internal SR API calls are now loaded via an iframe

tests/crmSrDetails.test.cjs

@@ -2,6 +2,44 @@ const assert = require("node:assert/strict");
 const { test } = require("node:test");
 const { loadBackground, response } = require("./support/characterization.cjs");
 const type = "opportunitiesExtension.requestInternalServiceRequest";
+for (const family of ["chrome", "firefox"]) {
+  test(`${family}: 401 is returned to the caller without opening tabs`, async () => {
+    let count = 0;
+    const h = loadBackground({ family, fetch: async () => ++count < 3 ? response({}, 401) : response({ items: [] }) });
+    const result = await h.dispatch({ type, srId: "123" });
+    assert.equal(result.ok, false);
+    assert.equal(result.httpStatus, 401);
+    assert.equal(count, 1);
+    assert.equal(h.tabs.length, 0);
+    assert.deepEqual(h.removedTabs, []);
+    assert.deepEqual(result.debugRequests.map(entry => entry.httpStatus), [401]);
+  });
+}
+test("concurrent 401 responses do not cause background tab recovery", async () => {
+  let calls = 0;
+  const h = loadBackground({ fetch: async url => {
+    if (++calls <= 2) return response({}, 401);
+    const id = new URL(url).searchParams.get("q");
+    return response({ items: [{ ServiceRequest_SRToInternalSR_Tgt: [{ Title: id }] }] });
+  } });
+  const results = await Promise.all([h.dispatch({ type, srId: "1" }), h.dispatch({ type, srId: "2" })]);
+  assert.equal(h.tabs.length, 0);
+  assert.deepEqual(h.removedTabs, []);
+  assert.ok(results.every(result => result.httpStatus === 401));
+});
+test("background never creates recovery tabs after an error", async () => {
+  for (const status of [401, 500]) {
+    let count = 0;
+    const h = loadBackground({ fetch: async () => response({}, ++count === 1 ? 401 : status) });
+    const result = await h.dispatch({ type, srId: "1" });
+    assert.equal(result.ok, false);
+    assert.equal(count, 1);
+    assert.deepEqual(h.removedTabs, []);
+  }
+  const h = loadBackground({ fetch: async () => response({}, 403) });
+  assert.equal((await h.dispatch({ type, srId: "1" })).ok, false);
+  assert.equal(h.tabs.length, 0);
+});
 for (const family of ["chrome", "firefox"]) {
   test(`${family}: SR detail GET uses exact scope and Session authentication`, async () => {
     const calls = [];