@fuzdev/fuz_app 0.104.0 → 0.106.0

package/dist/testing/integration.js

@@ -17,11 +17,11 @@ import './assert_dev_env.js';
  * @module
  */
 import { describe, test, assert, afterAll } from 'vitest';
-import { find_auth_route, assert_response_matches_spec, assert_no_error_info_leakage, } from './integration_helpers.js';
-import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
-import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
+import { find_auth_route, assert_response_matches_spec, assert_no_error_info_leakage } from './integration_helpers.js';
+import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
+import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE } from './error_coverage.js';
 import { is_public_auth } from '../http/auth_shape.js';
-import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec, } from '../auth/account_action_specs.js';
+import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec } from '../auth/account_action_specs.js';
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 import { LoginOutput, AccountStatusOutput } from '../auth/account_route_schema.js';
 import { test_if } from './cross_backend/capabilities.js';
@@ -99,7 +99,7 @@ export const describe_standard_integration_tests = (options) => {
                 // (same spirit as the [401, 403, 429] ignore in the attack-surface
                 // tightness defaults); otherwise #10 adding /logout's 403 to the spine
                 // surface tips the ratio under threshold here though the gate is tested.
-                ignore_statuses: [403],
+                ignore_statuses: [403]
             });
         });
         // --- 1. Login/logout lifecycle ---
@@ -113,12 +113,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(res.status, 200);
                 const body = await res.json();
@@ -136,12 +136,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: 'wrong-password',
-                    }),
+                        password: 'wrong-password'
+                    })
                 });
                 assert.strictEqual(res.status, 401);
                 const body = await res.clone().json();
@@ -157,12 +157,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: 'nonexistent_user',
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(res.status, 401);
                 const body = await res.clone().json();
@@ -178,12 +178,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: `  ${fixture.account.username}  `,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(res.status, 200);
                 const body = await res.json();
@@ -201,12 +201,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(login_res.status, 200);
                 // Extract cookie from Set-Cookie
@@ -218,7 +218,7 @@ export const describe_standard_integration_tests = (options) => {
                 const create_headers = () => ({
                     host: 'localhost',
                     origin: 'http://localhost:5173',
-                    cookie: `${cookie_name}=${login_cookie}`,
+                    cookie: `${cookie_name}=${login_cookie}`
                 });
                 // Verify works
                 const verify_res = await rpc_call_for_spec({
@@ -226,13 +226,13 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: create_headers(),
+                    headers: create_headers()
                 });
                 assert.strictEqual(verify_res.status, 200);
                 // Logout
                 const logout_res = await fixture.transport(logout_route.path, {
                     method: 'POST',
-                    headers: create_headers(),
+                    headers: create_headers()
                 });
                 assert.strictEqual(logout_res.status, 200);
                 const logout_body = await logout_res.json();
@@ -244,7 +244,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: create_headers(),
+                    headers: create_headers()
                 });
                 assert.strictEqual(verify_after.status, 401);
             });
@@ -260,9 +260,9 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
-                    body: JSON.stringify({ username, password }),
+                    body: JSON.stringify({ username, password })
                 });
                 // wrong password for existing user
                 const wrong_pw_res = await make_login(fixture.account.username, 'wrong-password-999');
@@ -291,12 +291,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(res.status, 200);
                 const body = await res.json();
@@ -332,7 +332,7 @@ export const describe_standard_integration_tests = (options) => {
                 const status_path = login_route.path.replace(/\/login$/, '/status');
                 const res = await fixture.transport(status_path, {
                     method: 'GET',
-                    headers: fixture.create_session_headers({ host: 'localhost' }),
+                    headers: fixture.create_session_headers({ host: 'localhost' })
                 });
                 assert.strictEqual(res.status, 200, `expected 200 from ${status_path} — capabilities.account_status is true, so the ` +
                     `account surface must bundle GET /status. A 404 means the backend declares the ` +
@@ -356,12 +356,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(res.status, 200);
                 const set_cookie = res.headers.get('set-cookie');
@@ -382,7 +382,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -393,7 +393,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { cookie: `${cookie_name}=random_garbage_value` },
+                    headers: { cookie: `${cookie_name}=random_garbage_value` }
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -415,7 +415,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
-                    headers,
+                    headers
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
                 assert.ok(list_res.result.sessions.length >= 1);
@@ -426,7 +426,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_revoke_action_spec,
                     params: { session_id },
-                    headers,
+                    headers
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
                 assert.strictEqual(revoke_res.result.ok, true);
@@ -437,7 +437,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers,
+                    headers
                 });
                 assert.strictEqual(after.status, 401);
             });
@@ -450,7 +450,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers,
+                    headers
                 });
                 assert.strictEqual(before.status, 200);
                 // Revoke all sessions
@@ -459,7 +459,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
-                    headers,
+                    headers
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // Verify fails after revocation
@@ -468,7 +468,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers,
+                    headers
                 });
                 assert.strictEqual(after.status, 401);
             });
@@ -482,7 +482,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
                 const headers = fixture.create_session_headers({
-                    'content-type': 'application/json',
+                    'content-type': 'application/json'
                 });
                 // Change password
                 const change_res = await fixture.transport(password_route.path, {
@@ -490,8 +490,8 @@ export const describe_standard_integration_tests = (options) => {
                     headers,
                     body: JSON.stringify({
                         current_password: DEFAULT_TEST_PASSWORD,
-                        new_password: 'new-password-456',
-                    }),
+                        new_password: 'new-password-456'
+                    })
                 });
                 assert.strictEqual(change_res.status, 200);
                 const change_body = await change_res.json();
@@ -504,7 +504,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.strictEqual(verify_after.status, 401);
                 // Login with new password works
@@ -513,12 +513,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: 'new-password-456',
-                    }),
+                        password: 'new-password-456'
+                    })
                 });
                 assert.strictEqual(login_res.status, 200);
                 const login_body = await login_res.json();
@@ -531,12 +531,12 @@ export const describe_standard_integration_tests = (options) => {
                 const res = await fixture.transport(password_route.path, {
                     method: 'POST',
                     headers: fixture.create_session_headers({
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     }),
                     body: JSON.stringify({
                         current_password: 'wrong-password-999',
-                        new_password: 'new-password-456',
-                    }),
+                        new_password: 'new-password-456'
+                    })
                 });
                 assert.strictEqual(res.status, 401);
                 error_collector.record(route_specs, 'POST', password_route.path, 401);
@@ -546,7 +546,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.strictEqual(verify_res.status, 200);
             });
@@ -565,7 +565,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.strictEqual(res.status, 200);
             });
@@ -580,7 +580,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: fixture.create_bearer_headers(),
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(res.status, 200);
             });
@@ -595,7 +595,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: 'Bearer secret_fuz_token_invalid' },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -611,7 +611,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: bearer_headers,
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(ok_res.status, 200);
                 // With Origin — bearer silently discarded (browser context), falls through to no auth.
@@ -620,7 +620,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { ...bearer_headers, origin: 'http://localhost:5173' },
+                    headers: { ...bearer_headers, origin: 'http://localhost:5173' }
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -634,8 +634,8 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-revoke' },
-                    headers: fixture.create_session_headers(),
+                    params: { name: 'test-revoke', scope: { kind: 'full' } },
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token, id } = create_res.result;
@@ -650,7 +650,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(use_res.status, 200);
                 // Revoke via RPC
@@ -659,7 +659,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_revoke_action_spec,
                     params: { token_id: id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
                 // Token should no longer work — fresh transport same reason as
@@ -670,7 +670,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(after_res.status, 401);
             });
@@ -703,7 +703,7 @@ export const describe_standard_integration_tests = (options) => {
                 const non_admin = await fixture.create_account({ username: 'non_admin_admin_probe' });
                 const res = await fixture.transport(admin_route.path, {
                     method: admin_route.method,
-                    headers: { cookie: `${cookie_name}=${non_admin.session_cookie}` },
+                    headers: { cookie: `${cookie_name}=${non_admin.session_cookie}` }
                 });
                 assert.strictEqual(res.status, 403);
                 const body = await res.json();
@@ -719,7 +719,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // User B's session should still work
@@ -728,7 +728,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { cookie: `${cookie_name}=${user_b.session_cookie}` },
+                    headers: { cookie: `${cookie_name}=${user_b.session_cookie}` }
                 });
                 assert.strictEqual(verify_b.status, 200);
             });
@@ -742,7 +742,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
-                    headers: user_b_headers,
+                    headers: user_b_headers
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
                 assert.ok(list_res.result.sessions.length >= 1);
@@ -753,7 +753,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_revoke_action_spec,
                     params: { session_id: session_id_b },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
                 assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account session');
@@ -763,7 +763,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: user_b_headers,
+                    headers: user_b_headers
                 });
                 assert.strictEqual(verify_b.status, 200);
             });
@@ -777,7 +777,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
-                    headers: user_b_headers,
+                    headers: user_b_headers
                 });
                 assert.ok(list_res.ok, 'account_token_list should succeed');
                 assert.ok(list_res.result.tokens.length >= 1);
@@ -788,7 +788,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_revoke_action_spec,
                     params: { token_id: token_id_b },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
                 assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account token');
@@ -799,7 +799,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${user_b.api_token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(verify_b.status, 200);
             });
@@ -812,7 +812,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, 'account_session_list should succeed');
                 // Sessions should only belong to user A's account
@@ -829,7 +829,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, 'account_token_list should succeed');
                 // Tokens should only belong to user A's account
@@ -853,12 +853,12 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: 'nonexistent_user_xyz',
-                        password: 'any-password',
-                    }),
+                        password: 'any-password'
+                    })
                 });
                 assert.strictEqual(res.status, 401);
                 await assert_response_matches_spec(route_specs, 'POST', login_route.path, res);
@@ -870,7 +870,7 @@ export const describe_standard_integration_tests = (options) => {
                 const res = await fixture.transport(logout_route.path, {
                     method: 'POST',
                     headers: fixture.create_session_headers({ 'content-type': 'application/json' }),
-                    body: JSON.stringify({}),
+                    body: JSON.stringify({})
                 });
                 assert.strictEqual(res.status, 200);
                 await assert_response_matches_spec(route_specs, 'POST', logout_route.path, res);
@@ -884,9 +884,9 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
-                    body: JSON.stringify({}),
+                    body: JSON.stringify({})
                 });
                 assert.strictEqual(res.status, 401);
                 await assert_response_matches_spec(route_specs, 'POST', logout_route.path, res);
@@ -916,7 +916,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(session_list.status, 401);
                 error_collector.record(route_specs, 'POST', rpc_path, 401);
@@ -925,7 +925,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(session_revoke_all.status, 401);
                 error_collector.record(route_specs, 'POST', rpc_path, 401);
@@ -934,7 +934,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(token_list.status, 401);
                 error_collector.record(route_specs, 'POST', rpc_path, 401);
@@ -942,8 +942,8 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: unauthed },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'unauth-probe' },
-                    headers: { host: 'localhost' },
+                    params: { name: 'unauth-probe', scope: { kind: 'full' } },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(token_create.status, 401);
                 error_collector.record(route_specs, 'POST', rpc_path, 401);
@@ -952,7 +952,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(verify.status, 401);
                 error_collector.record(route_specs, 'POST', rpc_path, 401);
@@ -962,7 +962,7 @@ export const describe_standard_integration_tests = (options) => {
                     const res = await unauthed(logout_route.path, {
                         method: 'POST',
                         headers: { host: 'localhost', 'content-type': 'application/json' },
-                        body: JSON.stringify({}),
+                        body: JSON.stringify({})
                     });
                     assert.strictEqual(res.status, 401, 'POST /logout without auth should return 401');
                     error_collector.record(route_specs, 'POST', logout_route.path, 401);
@@ -978,7 +978,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { host: 'localhost' },
+                    headers: { host: 'localhost' }
                 });
                 assert.strictEqual(res.status, 401);
                 assert.ok(!res.ok);
@@ -1003,11 +1003,11 @@ export const describe_standard_integration_tests = (options) => {
                 const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
                 const bearer_headers = fixture.create_bearer_headers({
-                    'content-type': 'application/json',
+                    'content-type': 'application/json'
                 });
                 const res = await fixture.fresh_transport()(logout_route.path, {
                     method: 'POST',
-                    headers: { ...bearer_headers, origin: 'http://localhost:5173' },
+                    headers: { ...bearer_headers, origin: 'http://localhost:5173' }
                 });
                 assert.strictEqual(res.status, 401, 'Bearer with Origin should be discarded → unauthenticated');
                 error_collector.record(route_specs, 'POST', logout_route.path, 401);
@@ -1017,11 +1017,11 @@ export const describe_standard_integration_tests = (options) => {
                 const password_route = find_auth_route(route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
                 const bearer_headers = fixture.create_bearer_headers({
-                    'content-type': 'application/json',
+                    'content-type': 'application/json'
                 });
                 const res = await fixture.fresh_transport()(password_route.path, {
                     method: 'POST',
-                    headers: { ...bearer_headers, referer: 'http://localhost:5173/admin' },
+                    headers: { ...bearer_headers, referer: 'http://localhost:5173/admin' }
                 });
                 assert.strictEqual(res.status, 401, 'Bearer with Referer should be discarded → unauthenticated');
                 error_collector.record(route_specs, 'POST', password_route.path, 401);
@@ -1038,8 +1038,8 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-token' },
-                    headers: fixture.create_session_headers(),
+                    params: { name: 'test-token', scope: { kind: 'full' } },
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token: raw_token } = create_res.result;
@@ -1051,7 +1051,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${raw_token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(verify_before.status, 200, 'Bearer token should work before password change');
                 // Change password (still REST)
@@ -1060,8 +1060,8 @@ export const describe_standard_integration_tests = (options) => {
                     headers: fixture.create_session_headers({ 'content-type': 'application/json' }),
                     body: JSON.stringify({
                         current_password: DEFAULT_TEST_PASSWORD,
-                        new_password: 'new-password-456',
-                    }),
+                        new_password: 'new-password-456'
+                    })
                 });
                 assert.strictEqual(change_res.status, 200);
                 const change_body = await change_res.json();
@@ -1074,7 +1074,7 @@ export const describe_standard_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${raw_token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(verify_after.status, 401, 'Bearer token should be rejected after password change');
             });
@@ -1108,7 +1108,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: 'alice@example.com' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(invite_res.ok, `invite_create failed: ${invite_res.ok ? '' : JSON.stringify(invite_res.error)}`);
                 // Try to sign up with a different email — should fail (no matching invite)
@@ -1117,13 +1117,13 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: 'eve_attacker',
                         password: 'test-password-123456',
-                        email: 'eve@attacker.com',
-                    }),
+                        email: 'eve@attacker.com'
+                    })
                 });
                 assert.strictEqual(signup_res.status, 403, 'Signup with non-matching email should be rejected');
                 const body = await signup_res.json();
@@ -1160,7 +1160,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: test_email },
-                    headers: admin_headers,
+                    headers: admin_headers
                 });
                 assert.ok(invite_res.ok, `invite_create failed: ${invite_res.ok ? '' : JSON.stringify(invite_res.error)}`);
                 // Attempt 1: signup with a non-matching email (no invite match) → 403
@@ -1169,13 +1169,13 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: 'nomatch_user',
                         password: 'test-password-123456',
-                        email: 'wrong-email@example.com',
-                    }),
+                        email: 'wrong-email@example.com'
+                    })
                 });
                 assert.strictEqual(no_match_res.status, 403, 'Expected 403 for non-matching invite');
                 const no_match_body = await no_match_res.json();
@@ -1186,7 +1186,7 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: conflict_email },
-                    headers: admin_headers,
+                    headers: admin_headers
                 });
                 assert.ok(invite2_res.ok, `invite2_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
                 // Attempt 2: signup with the invited email but a colliding username → 409
@@ -1195,13 +1195,13 @@ export const describe_standard_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: existing_user.account.username,
                         password: 'test-password-123456',
-                        email: conflict_email,
-                    }),
+                        email: conflict_email
+                    })
                 });
                 assert.strictEqual(conflict_res.status, 409, 'Expected 409 for username conflict');
                 const conflict_body = await conflict_res.json();