Align API tests with hardened auth and department access

services/nginx/app/modules/selfserve/traits/selfserve_lane_invoice_t.php

@@ -224,7 +224,7 @@ trait selfserve_lane_invoice_t
         $billing_customer_number = $this->getCustomerNumber();
         $draft_customer_number = (new economic())->getTransactionDraftCustomerNumber();
         $order = (new orders_o())->add(
-            $billing_customer_number,
+            $draft_customer_number ?? $billing_customer_number,
             self::INVOICE_SYSTEM_USER_ID,
             '',
             '',

services/nginx/app/tests/Api/AuthApiTest.php

@@ -131,10 +131,10 @@ it('rejects invalid auth session tokens', function (): void {
     ]);
 
     $response
-        ->assertStatus(500)
+        ->assertStatus(401)
         ->assertEnvelope()
         ->assertSuccess(false)
-        ->assertMessageContains('Token not found');
+        ->assertMessage('Invalid token');
 });
 
 it('logs out and invalidates the token for future session calls', function (): void {
@@ -161,10 +161,10 @@ it('logs out and invalidates the token for future session calls', function (): v
     $followUpSession = api_client()->get('/auth/session', $session['headers']);
 
     $followUpSession
-        ->assertStatus(500)
+        ->assertStatus(401)
         ->assertEnvelope()
         ->assertSuccess(false)
-        ->assertMessageContains('Token not found');
+        ->assertMessage('Invalid token');
 });
 
 it('logs out and invalidates cached subuser sessions', function (): void {
@@ -208,8 +208,8 @@ it('rejects invalid logout tokens', function (): void {
     ]);
 
     $response
-        ->assertStatus(500)
+        ->assertStatus(401)
         ->assertEnvelope()
         ->assertSuccess(false)
-        ->assertMessageContains('Token not found');
+        ->assertMessage('Invalid token');
 });

services/nginx/app/tests/Api/PlateScannersApiTest.php

@@ -14,6 +14,7 @@ it('returns the updated lane id after editing a scanner whose null lane was alre
         'add_department_lane',
         'add_number_plate_scanner',
         'edit_number_plate_scanner',
+        'department_access_' . (int)$department['id'],
     ]);
 
     $laneName = 'Lane ' . uniqid('', false);

services/nginx/app/tests/Api/StripeApiTest.php

@@ -304,6 +304,7 @@ it('returns a setup required error when creating a payment intent for a departme
     ]);
     $session = api_fixtures()->createUserSession([
         'charge_order',
+        'department_access_' . (int)$department['id'],
     ]);
 
     $response = api_client()->post('/orders/module/stripe/payment_intent', [

services/nginx/app/tests/Support/Api/ApiFixtures.php

@@ -934,7 +934,7 @@ final class ApiFixtures
     {
         $subuser = $this->createSubuser($subuserAttributes);
         $this->grantSubuser((int)$subuser['id'], $customerNumber, $permissions);
-        $token = $this->createAuthToken((int)$subuser['id'], 'AUTH_TOKEN_SUBUSER');
+        $token = (new \subusers_o())->select((int)$subuser['id'])->generateSession();
 
         return [
             'user' => [