test(integration): swap bad-auth probe to portfolio.balance()

[TexasCoding]

Summary

test_bad_auth_returns_auth_error was calling client.markets.list(limit=1) to exercise the auth-error path. Kalshi started serving public market data unauthenticated, so the call now returns 200 with bad credentials and the test reports "DID NOT RAISE KalshiAuthError".

Swapped to client.portfolio.balance() — account-scoped, always auth-required. Added a docstring note so future maintainers know why endpoint choice matters here.

Verification

• tests/integration/test_errors.py::TestErrorPaths::test_bad_auth_returns_auth_error ✅ against live demo

Progress on #124

Closes 1 of 11. Running tally: A (#126 = 4) + B (this = 1) = 5 of 11. Remaining 6 cluster around not_found errors (test_order_groups × 3, test_orders × 3) and the demo subaccount-slot exhaustion (1). Each in a follow-up PR.

Refs #124

Test plan

• Local integration run against demo passes
• CI green

[claude]

Code Review — PR #127

Overview

This PR fixes test_bad_auth_returns_auth_error, which broke when Kalshi began serving GET /markets unauthenticated. The fix swaps the probe endpoint from client.markets.list(limit=1) to client.portfolio.balance() and adds a docstring explaining the choice. Small diff (6 additions, 1 deletion), good motivation.

---

✅ What's Done Well

• Surgical change. Touches exactly what the bug requires — the one call that no longer exercises the auth path. Nothing else is modified.
• Docstring explains the WHY. Per project conventions in CLAUDE.md, comments should document non-obvious constraints. The note that markets.list() was previously used and why it stopped working is precisely the kind of hidden constraint future maintainers need. Well placed.
• Endpoint choice is sound. portfolio.balance() calls self._require_auth() at the resource layer, so it has an explicit SDK-level auth guard in addition to server-side enforcement. It's as stable an auth probe as you'll find in this API.
• No new imports or dependencies. client.portfolio is already wired up; no scaffolding needed.
• Test structure unchanged. The throwaway-client pattern (valid RSA key, wrong key_id) is preserved correctly, and the try/finally: client.close() guard is still in place.

---

Suggestions / Minor Notes

1. Consider asserting on the error message or endpoint in the docstring (non-blocking)

The docstring says why portfolio.balance() was chosen, but doesn't mention what to look for if this test starts failing silently again in the future (i.e., if Kalshi makes GET /portfolio/balance public). A single sentence like:

If this test starts returning 200 instead of raising, check whether Kalshi has made /portfolio/balance public and pick another account-scoped endpoint.

would be a useful forward-looking hint, since you've now burned one endpoint already.

2. sync_client fixture not used (intentional, but worth confirming)

The other tests in this class accept sync_client: KalshiClient as a fixture arg. This test correctly builds its own client with invalid credentials. Just confirming this is intentional and not a missed parameter — it is, since you need the bad-auth client, not the configured one.

3. Async coverage (pre-existing gap, not introduced here)

The module docstring notes that error mapping is tested sync-only because _map_error() is shared. That's fine and consistent with the existing test philosophy. No action needed for this PR.

---

Verdict

Approve. The fix is correct, minimal, and well-documented. The PR description clearly articulates the root cause (Kalshi changed server behavior) and the verification steps. No issues blocking merge.