session: add unit tests for concurrent bypass requests

Tests cover:
- Multiple concurrent pending requests from different agents
- BypassPendingByID lookup
- ResolveBypass removes only the resolved request
- ResolveBypass fails for non-existent ID
- Empty session has no pending requests

cmd/olliesrv/internal/session/session_test.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"testing"
 	"time"
+
+	"ollie/toolsrv/protocol"
 )
 
 func TestSetCwd_ExpandsTilde(t *testing.T) {
@@ -159,3 +161,91 @@ done:
 		}
 	}
 }
+
+// --- Bypass request tracking tests ---
+
+func TestBypassPending_MultipleConcurrent(t *testing.T) {
+	s := &Session{ID: "test-session"}
+
+	// Add multiple bypass requests
+	req1 := &protocol.BypassRequest{ID: "req-1", Cmd: "rm -rf /tmp/a", Cwd: "/home/user", Env: map[string]string{"OLLIE_UNAME": "agent1"}}
+	req2 := &protocol.BypassRequest{ID: "req-2", Cmd: "rm -rf /tmp/b", Cwd: "/home/user", Env: map[string]string{"OLLIE_UNAME": "agent2"}}
+	req3 := &protocol.BypassRequest{ID: "req-3", Cmd: "rm -rf /tmp/c", Cwd: "/home/user", Env: map[string]string{"OLLIE_UNAME": "agent1"}}
+
+	s.SetBypassPending(req1, nil)
+	s.SetBypassPending(req2, nil)
+	s.SetBypassPending(req3, nil)
+
+	// Should have all three pending
+	pending := s.BypassPending()
+	if len(pending) != 3 {
+		t.Errorf("Expected 3 pending requests, got %d", len(pending))
+	}
+
+	// BypassPendingByID should find each
+	if got := s.BypassPendingByID("req-1"); got == nil || got.Cmd != "rm -rf /tmp/a" {
+		t.Errorf("BypassPendingByID(req-1) failed")
+	}
+	if got := s.BypassPendingByID("req-2"); got == nil || got.Cmd != "rm -rf /tmp/b" {
+		t.Errorf("BypassPendingByID(req-2) failed")
+	}
+	if got := s.BypassPendingByID("req-3"); got == nil || got.Cmd != "rm -rf /tmp/c" {
+		t.Errorf("BypassPendingByID(req-3) failed")
+	}
+
+	// Non-existent ID should return nil
+	if got := s.BypassPendingByID("req-999"); got != nil {
+		t.Errorf("BypassPendingByID(req-999) should return nil, got %v", got)
+	}
+}
+
+func TestBypassResolve_RemovesFromMap(t *testing.T) {
+	s := &Session{ID: "test-session"}
+
+	req1 := &protocol.BypassRequest{ID: "req-1", Cmd: "cmd1", Env: map[string]string{"OLLIE_UNAME": "agent1"}}
+	req2 := &protocol.BypassRequest{ID: "req-2", Cmd: "cmd2", Env: map[string]string{"OLLIE_UNAME": "agent2"}}
+
+	s.SetBypassPending(req1, nil)
+	s.SetBypassPending(req2, nil)
+
+	// Resolve req-1 (will fail on toolsrv connection, but map update should succeed)
+	err := s.ResolveBypass("req-1", true)
+	// Error expected because no dialFn, but the request should be removed
+	if err == nil {
+		t.Log("ResolveBypass succeeded (unexpected but ok for this test)")
+	}
+
+	// req-1 should be gone, req-2 should remain
+	pending := s.BypassPending()
+	if len(pending) != 1 {
+		t.Errorf("Expected 1 pending request after resolve, got %d", len(pending))
+	}
+	if s.BypassPendingByID("req-1") != nil {
+		t.Errorf("req-1 should be removed after resolve")
+	}
+	if s.BypassPendingByID("req-2") == nil {
+		t.Errorf("req-2 should still be pending")
+	}
+}
+
+func TestBypassResolve_NonExistent(t *testing.T) {
+	s := &Session{ID: "test-session"}
+
+	err := s.ResolveBypass("nonexistent", true)
+	if err == nil {
+		t.Errorf("ResolveBypass should fail for non-existent ID")
+	}
+}
+
+func TestBypassPending_Empty(t *testing.T) {
+	s := &Session{ID: "test-session"}
+
+	pending := s.BypassPending()
+	if len(pending) != 0 {
+		t.Errorf("Expected 0 pending requests for new session, got %d", len(pending))
+	}
+
+	if s.BypassPendingByID("any") != nil {
+		t.Errorf("BypassPendingByID should return nil for new session")
+	}
+}