✅ test(repository): cover STS session creation on aiobotocore path

The migration changed the _get_caller_identity_arn session-creation line
(self._session = get_session()), but the existing test pre-set _session,
leaving that branch uncovered and failing the 100% patch-coverage gate.
Add a success-path test that forces _session=None so the branch runs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sodre

tests/unit/test_repository.py

@@ -1612,6 +1612,37 @@ async def test_get_caller_identity_handles_sts_failure(self, repo):
         assert repo._caller_identity_fetched is True
         assert repo._caller_identity_arn is None
 
+    @pytest.mark.asyncio
+    async def test_get_caller_identity_creates_session_when_missing(self, repo):
+        """When no session exists yet, the STS path creates one via get_session()."""
+        from unittest.mock import AsyncMock, MagicMock, patch
+
+        # Force the session-creation branch (no cached session/identity)
+        repo._session = None
+        repo._caller_identity_fetched = False
+        repo._caller_identity_arn = None
+
+        mock_sts_client = AsyncMock()
+        mock_sts_client.get_caller_identity.return_value = {
+            "Arn": "arn:aws:iam::123456789012:user/test"
+        }
+        mock_sts_client.__aenter__ = AsyncMock(return_value=mock_sts_client)
+        mock_sts_client.__aexit__ = AsyncMock(return_value=None)
+
+        mock_session = MagicMock()
+        mock_session.create_client.return_value = mock_sts_client
+
+        with patch(
+            "zae_limiter.repository.get_session", return_value=mock_session
+        ) as mock_get_session:
+            arn = await repo._get_caller_identity_arn()
+
+        # Session was created and the ARN resolved
+        assert arn == "arn:aws:iam::123456789012:user/test"
+        mock_get_session.assert_called_once()
+        assert mock_session.create_client.call_args.args[0] == "sts"
+        assert repo._caller_identity_fetched is True
+
     @pytest.mark.asyncio
     async def test_get_audit_retention_days_from_stack_options(self, repo):
         """Should return audit_retention_days from stack_options if available."""

tests/unit/test_sync_repository.py

@@ -1171,6 +1171,30 @@ def test_get_caller_identity_handles_sts_failure(self, repo):
         assert repo._caller_identity_fetched is True
         assert repo._caller_identity_arn is None
 
+    def test_get_caller_identity_creates_session_when_missing(self, repo):
+        """When no session exists yet, the STS path creates one via boto3.Session()."""
+        from unittest.mock import MagicMock, patch
+
+        repo._session = None
+        repo._caller_identity_fetched = False
+        repo._caller_identity_arn = None
+        mock_sts_client = MagicMock()
+        mock_sts_client.get_caller_identity.return_value = {
+            "Arn": "arn:aws:iam::123456789012:user/test"
+        }
+        mock_sts_client.__enter__ = MagicMock(return_value=mock_sts_client)
+        mock_sts_client.__exit__ = MagicMock(return_value=None)
+        mock_session = MagicMock()
+        mock_session.client.return_value = mock_sts_client
+        with patch(
+            "zae_limiter.sync_repository.boto3.Session", return_value=mock_session
+        ) as mock_get_session:
+            arn = repo._get_caller_identity_arn()
+        assert arn == "arn:aws:iam::123456789012:user/test"
+        mock_get_session.assert_called_once()
+        assert mock_session.client.call_args.args[0] == "sts"
+        assert repo._caller_identity_fetched is True
+
     def test_get_audit_retention_days_from_stack_options(self, repo):
         """Should return audit_retention_days from stack_options if available."""
         from zae_limiter.models import StackOptions