@fuzdev/fuz_app 0.32.0 → 0.34.0

package/dist/testing/integration.js

@@ -21,7 +21,7 @@ import { AUTH_MIGRATION_NS } from '../auth/migrations.js';
 import { create_test_app } from './app_server.js';
 import { create_pglite_factory, create_describe_db, AUTH_INTEGRATION_TRUNCATE_TABLES, } from './db.js';
 import { find_auth_route, assert_response_matches_spec, create_expired_test_cookie, assert_no_error_info_leakage, } from './integration_helpers.js';
-import { find_rpc_action, rpc_call, rpc_call_non_browser, require_rpc_endpoint_path, } from './rpc_helpers.js';
+import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
 import { RateLimiter } from '../rate_limiter.js';
 import { run_migrations } from '../db/migrate.js';
 import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
@@ -30,12 +30,19 @@ import { account_verify_action_spec, account_session_list_action_spec, account_s
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 /**
  * Build `CreateTestAppOptions` from standard options plus a database.
+ * Forwards `options.rpc_endpoints` to `app_options.rpc_endpoints` so
+ * `create_app_server` auto-mounts it per-test with the real ctx.
+ * `SuiteAppOptions` excludes `rpc_endpoints` so there's no way for
+ * `options.app_options` to collide with the suite-level field.
  */
 const build_test_app_options = (options, db) => ({
     session_options: options.session_options,
     create_route_specs: options.create_route_specs,
     db,
-    app_options: options.app_options,
+    app_options: {
+        ...options.app_options,
+        rpc_endpoints: options.rpc_endpoints,
+    },
 });
 /**
  * Standard integration test suite for fuz_app auth routes.
@@ -53,8 +60,11 @@ const build_test_app_options = (options, db) => ({
  */
 export const describe_standard_integration_tests = (options) => {
     // Hard-fail early so consumers see a clear setup error instead of a
-    // confusing test failure when `rpc_endpoints` is missing.
-    const rpc_path = require_rpc_endpoint_path(options.rpc_endpoints);
+    // confusing test failure when `rpc_endpoints` is missing. Factory-form
+    // callers are resolved with a stub ctx purely to extract the endpoint
+    // path; real handlers run per-test via `app_options.rpc_endpoints`.
+    const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
+    const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
         await run_migrations(db, [AUTH_MIGRATION_NS]);
     };
@@ -211,10 +221,11 @@ export const describe_standard_integration_tests = (options) => {
                     cookie: `${cookie_name}=${login_cookie}`,
                 });
                 // Verify works
-                const verify_res = await rpc_call({
+                const verify_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: create_headers(),
                 });
                 assert.strictEqual(verify_res.status, 200);
@@ -228,10 +239,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(logout_body.ok, true);
                 assert.strictEqual(logout_body.username, test_app.backend.account.username, 'Logout response should include the username');
                 // Verify fails after logout (session revoked)
-                const verify_after = await rpc_call({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: create_headers(),
                 });
                 assert.strictEqual(verify_after.status, 401);
@@ -299,20 +311,22 @@ export const describe_standard_integration_tests = (options) => {
         describe('session security', () => {
             test('no cookie on protected route returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(res.status, 401);
             });
             test('corrupted cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=random_garbage_value` },
                 });
                 assert.strictEqual(res.status, 401);
@@ -320,10 +334,11 @@ export const describe_standard_integration_tests = (options) => {
             test('expired cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${expired_cookie}` },
                 });
                 assert.strictEqual(res.status, 401);
@@ -335,33 +350,33 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const headers = test_app.create_session_headers();
                 // List own sessions to get the session ID
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.sessions.length >= 1);
-                const session_id = list_body.sessions[0].id;
+                assert.ok(list_res.result.sessions.length >= 1);
+                const session_id = list_res.result.sessions[0].id;
                 // Revoke that session by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_action_spec.method,
+                    spec: account_session_revoke_action_spec,
                     params: { session_id },
                     headers,
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.ok, true);
-                assert.strictEqual(revoke_body.revoked, true);
+                assert.strictEqual(revoke_res.result.ok, true);
+                assert.strictEqual(revoke_res.result.revoked, true);
                 // Session should no longer work
-                const after = await rpc_call({
+                const after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(after.status, 401);
@@ -370,26 +385,29 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const headers = test_app.create_session_headers();
                 // Verify works
-                const before = await rpc_call({
+                const before = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(before.status, 200);
                 // Revoke all sessions
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_all_action_spec.method,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // Verify fails after revocation
-                const after = await rpc_call({
+                const after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(after.status, 401);
@@ -421,10 +439,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(typeof change_body.sessions_revoked === 'number', 'Expected sessions_revoked count');
                 assert.ok(change_body.sessions_revoked >= 1, 'Expected at least 1 session revoked');
                 // Old session should be invalid
-                const verify_after = await rpc_call({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(verify_after.status, 401);
@@ -462,10 +481,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(res.status, 401);
                 error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
                 // Session should still be valid (password didn't change)
-                const verify_res = await rpc_call({
+                const verify_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(verify_res.status, 200);
@@ -497,23 +517,26 @@ export const describe_standard_integration_tests = (options) => {
             });
             test('valid origin is accepted', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(res.status, 200);
             });
             test('no origin header is allowed (direct access)', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                // Probe the "no Origin / no Referer" path; `rpc_call_non_browser`
-                // suppresses the default `origin` header.
-                const res = await rpc_call_non_browser({
+                // Probe the "no Origin / no Referer" path; `suppress_default_origin`
+                // skips the default `origin` header.
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${test_app.backend.session_cookie}` },
+                    suppress_default_origin: true,
                 });
                 assert.notStrictEqual(res.status, 403);
             });
@@ -522,21 +545,25 @@ export const describe_standard_integration_tests = (options) => {
         describe('bearer auth', () => {
             test('valid bearer token authenticates', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call_non_browser({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_bearer_headers(),
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(res.status, 200);
             });
             test('invalid bearer token returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call_non_browser({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: 'Bearer secret_fuz_token_invalid' },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -544,18 +571,21 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const bearer_headers = test_app.create_bearer_headers();
                 // Without Origin — works.
-                const ok_res = await rpc_call_non_browser({
+                const ok_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: bearer_headers,
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(ok_res.status, 200);
                 // With Origin — bearer silently discarded (browser context), falls through to no auth.
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { ...bearer_headers, origin: 'http://localhost:5173' },
                 });
                 assert.strictEqual(res.status, 401);
@@ -566,38 +596,42 @@ export const describe_standard_integration_tests = (options) => {
             test('revoked API token returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // Create a new token via RPC
-                const create_res = await rpc_call({
+                const create_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_create_action_spec.method,
+                    spec: account_token_create_action_spec,
                     params: { name: 'test-revoke' },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token, id } = create_res.result;
                 // Verify token works
-                const use_res = await rpc_call_non_browser({
+                const use_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(use_res.status, 200);
                 // Revoke via RPC
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_revoke_action_spec.method,
+                    spec: account_token_revoke_action_spec,
                     params: { token_id: id },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
                 // Token should no longer work
-                const after_res = await rpc_call_non_browser({
+                const after_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(after_res.status, 401);
             });
@@ -624,18 +658,20 @@ export const describe_standard_integration_tests = (options) => {
                 // Create a second account
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A revokes all their own sessions
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_all_action_spec.method,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // User B's session should still work
-                const verify_b = await rpc_call({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${user_b.session_cookie}` },
                 });
                 assert.strictEqual(verify_b.status, 200);
@@ -645,32 +681,32 @@ export const describe_standard_integration_tests = (options) => {
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's session ID by listing as user B
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.sessions.length >= 1);
-                const session_id_b = list_body.sessions[0].id;
+                assert.ok(list_res.result.sessions.length >= 1);
+                const session_id_b = list_res.result.sessions[0].id;
                 // User A tries to revoke user B's session by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_action_spec.method,
+                    spec: account_session_revoke_action_spec,
                     params: { session_id: session_id_b },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.revoked, false, 'Should not revoke another account session');
+                assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account session');
                 // User B's session should still work
-                const verify_b = await rpc_call({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.strictEqual(verify_b.status, 200);
@@ -680,33 +716,34 @@ export const describe_standard_integration_tests = (options) => {
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's token ID by listing as user B
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_list_action_spec.method,
+                    spec: account_token_list_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.ok(list_res.ok, 'account_token_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.tokens.length >= 1);
-                const token_id_b = list_body.tokens[0].id;
+                assert.ok(list_res.result.tokens.length >= 1);
+                const token_id_b = list_res.result.tokens[0].id;
                 // User A tries to revoke user B's token by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_revoke_action_spec.method,
+                    spec: account_token_revoke_action_spec,
                     params: { token_id: token_id_b },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.revoked, false, 'Should not revoke another account token');
+                assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account token');
                 // User B's bearer token should still work
-                const verify_b = await rpc_call_non_browser({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${user_b.api_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_b.status, 200);
             });
@@ -714,16 +751,16 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A lists sessions
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_session_list should succeed');
-                const body = res.result;
                 // Sessions should only belong to user A's account
-                for (const session of body.sessions) {
+                for (const session of res.result.sessions) {
                     assert.strictEqual(session.account_id, test_app.backend.account.id, `Session ${session.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
@@ -731,16 +768,16 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A lists tokens
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_list_action_spec.method,
+                    spec: account_token_list_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_token_list should succeed');
-                const body = res.result;
                 // Tokens should only belong to user A's account
-                for (const token of body.tokens) {
+                for (const token of res.result.tokens) {
                     assert.strictEqual(token.account_id, test_app.backend.account.id, `Token ${token.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
@@ -854,24 +891,54 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // Hit several auth-required RPC methods without credentials to
                 // broaden error coverage beyond just /login. RPC 401s are tracked
-                // against the shared endpoint path.
-                const rpc_methods = [
-                    account_session_list_action_spec.method,
-                    account_session_revoke_all_action_spec.method,
-                    account_token_list_action_spec.method,
-                    account_token_create_action_spec.method,
-                    account_verify_action_spec.method,
-                ];
-                for (const method of rpc_methods) {
-                    const res = await rpc_call({
-                        app: test_app.app,
-                        path: rpc_path,
-                        method,
-                        headers: { host: 'localhost' },
-                    });
-                    assert.strictEqual(res.status, 401, `${method} without auth should return 401 (dispatcher runs auth before params)`);
-                    error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
-                }
+                // against the shared endpoint path. The dispatcher runs auth before
+                // params validation, so any well-formed param body works — we just
+                // need each call to be type-correct wrt its spec.
+                const session_list = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_session_list_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(session_list.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const session_revoke_all = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(session_revoke_all.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const token_list = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_token_list_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(token_list.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const token_create = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_token_create_action_spec,
+                    params: { name: 'unauth-probe' },
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(token_create.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const verify = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_verify_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(verify.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
                 // Also exercise POST /logout without auth (still REST)
                 const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
                 if (logout_route) {
@@ -889,10 +956,11 @@ export const describe_standard_integration_tests = (options) => {
         describe('error response information leakage', () => {
             test('401 responses contain no leaky fields', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(res.status, 401);
@@ -908,10 +976,11 @@ export const describe_standard_integration_tests = (options) => {
             test('expired session cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${expired_cookie}` },
                 });
                 assert.strictEqual(res.status, 401, 'Expired session cookie should be rejected');
@@ -970,10 +1039,10 @@ export const describe_standard_integration_tests = (options) => {
                 const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route');
                 // Create an API token via RPC
-                const create_res = await rpc_call({
+                const create_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_create_action_spec.method,
+                    spec: account_token_create_action_spec,
                     params: { name: 'test-token' },
                     headers: test_app.create_session_headers(),
                 });
@@ -981,11 +1050,13 @@ export const describe_standard_integration_tests = (options) => {
                 const { token: raw_token } = create_res.result;
                 assert.ok(raw_token, 'Expected raw token in create response');
                 // Verify bearer token works
-                const verify_before = await rpc_call_non_browser({
+                const verify_before = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${raw_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_before.status, 200, 'Bearer token should work before password change');
                 // Change password (still REST)
@@ -1002,11 +1073,13 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(typeof change_body.tokens_revoked === 'number', 'Expected tokens_revoked count');
                 assert.ok(change_body.tokens_revoked >= 1, 'Expected at least 1 token revoked');
                 // Bearer token should now be invalid
-                const verify_after = await rpc_call_non_browser({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${raw_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_after.status, 401, 'Bearer token should be rejected after password change');
             });
@@ -1021,7 +1094,7 @@ export const describe_standard_integration_tests = (options) => {
                 // `invite_create` became RPC-only in the 2026-04-23 migration.
                 // Consumers that don't wire admin RPC actions can't exercise invites;
                 // skip the test rather than fail.
-                if (!find_rpc_action(options.rpc_endpoints, invite_create_action_spec.method))
+                if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
                 // Create an admin to manage invites
                 const admin = await test_app.create_account({
@@ -1029,10 +1102,10 @@ export const describe_standard_integration_tests = (options) => {
                     roles: ['admin'],
                 });
                 // Create invite for alice@example.com via RPC
-                const invite_res = await rpc_call({
+                const invite_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: 'alice@example.com' },
                     headers: { cookie: `${cookie_name}=${admin.session_cookie}` },
                 });
@@ -1066,7 +1139,7 @@ export const describe_standard_integration_tests = (options) => {
                     return; // signup is optional
                 // `invite_create` became RPC-only in the 2026-04-23 migration.
                 // Consumers that don't wire admin RPC actions can't exercise invites.
-                if (!find_rpc_action(options.rpc_endpoints, invite_create_action_spec.method))
+                if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
                 // We need admin access — create an admin account
                 const admin = await test_app.create_account({
@@ -1076,10 +1149,10 @@ export const describe_standard_integration_tests = (options) => {
                 const admin_headers = { cookie: `${cookie_name}=${admin.session_cookie}` };
                 // Create an invite for a specific test email via RPC
                 const test_email = 'signup-test@example.com';
-                const invite_res = await rpc_call({
+                const invite_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: test_email },
                     headers: admin_headers,
                 });
@@ -1106,14 +1179,14 @@ export const describe_standard_integration_tests = (options) => {
                 const existing_user = await test_app.create_account({ username: 'existing_user' });
                 // Create invite for a different email via RPC
                 const conflict_email = 'conflict-test@example.com';
-                const invite2_res = await rpc_call({
+                const invite2_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: conflict_email },
                     headers: admin_headers,
                 });
-                assert.ok(invite2_res.ok, `invite_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
+                assert.ok(invite2_res.ok, `invite2_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
                 // Attempt 2: signup with the invited email but a colliding username → 409
                 const conflict_res = await test_app.app.request(signup_route.path, {
                     method: 'POST',