fix: keep test scaffolding out of the binary and bump the toolchain

go.mod

@@ -1,6 +1,8 @@
 module raybeam
 
-go 1.25.1
+go 1.26
+
+toolchain go1.26.5
 
 require (
 	github.com/go-ldap/ldap/v3 v3.4.14

internal/server/ldap_client.go

@@ -0,0 +1,13 @@
+package server
+
+import (
+	ldap "github.com/netresearch/simple-ldap-go"
+)
+
+// LDAPClient interface defines the LDAP operations needed by the server.
+// This interface allows for mock implementations in tests.
+type LDAPClient interface {
+	FindUserBySAMAccountName(sAMAccountName string) (*ldap.User, error)
+	FindUsersBySAMAccountNames(sAMAccountNames []string) ([]*ldap.User, error)
+	CheckPasswordForSAMAccountName(sAMAccountName, password string) (*ldap.User, error)
+}

internal/server/test_helpers.go → internal/server/test_helpers_test.go

@@ -11,21 +11,18 @@ import (
 	"go.etcd.io/bbolt"
 )
 
-// LDAPClient interface defines the LDAP operations needed by the server.
-// This interface allows for mock implementations in tests.
-type LDAPClient interface {
-	FindUserBySAMAccountName(sAMAccountName string) (*ldap.User, error)
-	FindUsersBySAMAccountNames(sAMAccountNames []string) ([]*ldap.User, error)
-	CheckPasswordForSAMAccountName(sAMAccountName, password string) (*ldap.User, error)
-}
-
 // MockLDAP implements LDAPClient for testing.
 type MockLDAP struct {
 	users    map[string]*ldap.User
 	password string // single password for all test users
 }
 
 // setObjectDN uses reflection to set the DN field in an ldap.Object (which has unexported fields).
+//
+// simple-ldap-go exposes no constructor that takes a DN — Object.dn is written
+// only by objectFromEntry when decoding a directory response — so a fixture
+// cannot be built through the public API. This lives in a _test.go file so the
+// unsafe write is compiled into the test binary only.
 func setObjectDN(obj interface{}, dn string) {
 	// Get the reflect.Value of the object
 	v := reflect.ValueOf(obj).Elem()