fix(auth): restore include-injected enableSession after cross-engine testing

Both placements were tested against Lucee, macOS RustCFML, and the Linux
RustCFML build: the declared-method form fails the RustCFML mixin copy
on both platforms; the include-injected form passes Lucee and macOS
RustCFML. Restore the include (auth.cfm + ladder) as the best-known
cross-engine state.

Signed-off-by: Peter Amiri <peter@alurium.com>

Author: bpamiri

vendor/wheels/Global.cfc

@@ -531,6 +531,24 @@ component output="false" {
 		}
 	}
 
+	// Auth wiring facade (enableSession) — same mapping-absolute include
+	// ladder as the other global files above.
+	try {
+		include "/wheels/global/auth.cfm";
+	} catch (any e) {
+		if (!$isMissingMappedInclude(e)) {
+			rethrow;
+		}
+		try {
+			include "global/auth.cfm";
+		} catch (any e2) {
+			if (!$isMissingMappedInclude(e2)) {
+				rethrow;
+			}
+			include "../vendor/wheels/global/auth.cfm";
+		}
+	}
+
 	// User-defined global functions
 	try {
 		include "/app/global/functions.cfm";
@@ -564,72 +582,4 @@ component output="false" {
 	// "The key [...] was not found in the struct. Valid keys are ([VARKEY])".
 	$promoteIncludedGlobalsToThis();
 
-	/**
-	 * One-line session-auth wiring for `config/services.cfm`.
-	 *
-	 * The auth subsystem ships complete (Authenticator strategy registry +
-	 * SessionStrategy with login/logout/currentUser and SID rotation) but
-	 * wiring it by hand spans two files: map the singletons here, then
-	 * register the strategy in `app/events/onapplicationstart.cfm`.
-	 * `enableSession()` collapses that into one idempotent call:
-	 *
-	 *     // config/services.cfm
-	 *     enableSession(sessionKey = "wheels.auth");
-	 *
-	 * The DI container is available in services.cfm (it is NOT available in
-	 * config/app.cfm — services.cfm is loaded after the container is built).
-	 * Manual wiring keeps working; this helper is the convenience path.
-	 *
-	 * Declared as a real method (not an include-injected global): the
-	 * include-injection + promotion path proved unreliable on RustCFML's
-	 * Linux build, where the function silently went missing from the Global
-	 * instance.
-	 */
-	public any function enableSession(string sessionKey = "wheels.auth", any onLogin = "", any onLogout = "") {
-		// Guard: enableSession() belongs in config/services.cfm, where the
-		// container exists. Fail with a pointer rather than an opaque scope
-		// error when it is called from a context without one.
-		try {
-			var di = injector();
-		} catch (any e) {
-			Throw(
-				type = "Wheels.Injector",
-				message = "enableSession() requires the DI container — call it from config/services.cfm (loaded at application start).",
-				detail = e.message
-			);
-		}
-		if (!isObject(di)) {
-			Throw(
-				type = "Wheels.Injector",
-				message = "enableSession() requires the DI container — call it from config/services.cfm (loaded at application start)."
-			);
-		}
-
-		// Map the singletons only when they aren't already mapped, so manual
-		// wiring and repeat calls stay idempotent.
-		if (!di.containsInstance("authenticator")) {
-			di.map("authenticator").to("wheels.auth.Authenticator").asSingleton();
-		}
-		if (!di.containsInstance("sessionStrategy")) {
-			di.map("sessionStrategy").to("wheels.auth.SessionStrategy").asSingleton();
-		}
-
-		// Resolve with explicit initArguments: the singleton cache honors the
-		// first resolution's arguments, so a custom sessionKey/callbacks stick
-		// even if something else resolved the strategy first with defaults.
-		var authenticator = service("authenticator");
-		var strategy = di.getInstance(
-			"sessionStrategy",
-			{ sessionKey: arguments.sessionKey, onLogin: arguments.onLogin, onLogout: arguments.onLogout }
-		);
-
-		// Register once. Repeat calls (dev reloads, double-includes) must not
-		// stack duplicate registrations.
-		if (!authenticator.hasStrategy("session")) {
-			authenticator.registerStrategy(name = "session", strategy = strategy);
-		}
-
-		return strategy;
-	}
-
 }

vendor/wheels/global/auth.cfm

@@ -0,0 +1,64 @@
+<cfscript>
+/**
+ * One-line session-auth wiring for `config/services.cfm`.
+ *
+ * The auth subsystem ships complete (Authenticator strategy registry +
+ * SessionStrategy with login/logout/currentUser and SID rotation) but
+ * wiring it by hand spans two files: map the singletons here, then
+ * register the strategy in `app/events/onapplicationstart.cfm`.
+ * `enableSession()` collapses that into one idempotent call:
+ *
+ *     // config/services.cfm
+ *     enableSession(sessionKey = "wheels.auth");
+ *
+ * The DI container is available in services.cfm (it is NOT available in
+ * config/app.cfm — services.cfm is loaded after the container is built).
+ * Manual wiring keeps working; this helper is the convenience path.
+ */
+public any function enableSession(string sessionKey = "wheels.auth", any onLogin = "", any onLogout = "") {
+	// Guard: enableSession() belongs in config/services.cfm, where the
+	// container exists. Fail with a pointer rather than an opaque scope
+	// error when it is called from a context without one.
+	try {
+		var di = injector();
+	} catch (any e) {
+		Throw(
+			type = "Wheels.Injector",
+			message = "enableSession() requires the DI container — call it from config/services.cfm (loaded at application start).",
+			detail = e.message
+		);
+	}
+	if (!isObject(di)) {
+		Throw(
+			type = "Wheels.Injector",
+			message = "enableSession() requires the DI container — call it from config/services.cfm (loaded at application start)."
+		);
+	}
+
+	// Map the singletons only when they aren't already mapped, so manual
+	// wiring and repeat calls stay idempotent.
+	if (!di.containsInstance("authenticator")) {
+		di.map("authenticator").to("wheels.auth.Authenticator").asSingleton();
+	}
+	if (!di.containsInstance("sessionStrategy")) {
+		di.map("sessionStrategy").to("wheels.auth.SessionStrategy").asSingleton();
+	}
+
+	// Resolve with explicit initArguments: the singleton cache honors the
+	// first resolution's arguments, so a custom sessionKey/callbacks stick
+	// even if something else resolved the strategy first with defaults.
+	var authenticator = service("authenticator");
+	var strategy = di.getInstance(
+		"sessionStrategy",
+		{ sessionKey: arguments.sessionKey, onLogin: arguments.onLogin, onLogout: arguments.onLogout }
+	);
+
+	// Register once. Repeat calls (dev reloads, double-includes) must not
+	// stack duplicate registrations.
+	if (!authenticator.hasStrategy("session")) {
+		authenticator.registerStrategy(name = "session", strategy = strategy);
+	}
+
+	return strategy;
+}
+</cfscript>