After extracting authenticateInSession to AuthService, the mock doesn't populate the session. Replace session-attribute assertions with verify() calls that confirm the controller correctly delegates to authService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>