@fuzdev/fuz_app 0.33.0 → 0.35.0

package/dist/testing/integration.js

@@ -21,7 +21,7 @@ import { AUTH_MIGRATION_NS } from '../auth/migrations.js';
 import { create_test_app } from './app_server.js';
 import { create_pglite_factory, create_describe_db, AUTH_INTEGRATION_TRUNCATE_TABLES, } from './db.js';
 import { find_auth_route, assert_response_matches_spec, create_expired_test_cookie, assert_no_error_info_leakage, } from './integration_helpers.js';
-import { find_rpc_action, rpc_call, rpc_call_non_browser, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
+import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
 import { RateLimiter } from '../rate_limiter.js';
 import { run_migrations } from '../db/migrate.js';
 import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
@@ -221,10 +221,11 @@ export const describe_standard_integration_tests = (options) => {
                     cookie: `${cookie_name}=${login_cookie}`,
                 });
                 // Verify works
-                const verify_res = await rpc_call({
+                const verify_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: create_headers(),
                 });
                 assert.strictEqual(verify_res.status, 200);
@@ -238,10 +239,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(logout_body.ok, true);
                 assert.strictEqual(logout_body.username, test_app.backend.account.username, 'Logout response should include the username');
                 // Verify fails after logout (session revoked)
-                const verify_after = await rpc_call({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: create_headers(),
                 });
                 assert.strictEqual(verify_after.status, 401);
@@ -309,20 +311,22 @@ export const describe_standard_integration_tests = (options) => {
         describe('session security', () => {
             test('no cookie on protected route returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(res.status, 401);
             });
             test('corrupted cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=random_garbage_value` },
                 });
                 assert.strictEqual(res.status, 401);
@@ -330,10 +334,11 @@ export const describe_standard_integration_tests = (options) => {
             test('expired cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${expired_cookie}` },
                 });
                 assert.strictEqual(res.status, 401);
@@ -345,33 +350,33 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const headers = test_app.create_session_headers();
                 // List own sessions to get the session ID
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.sessions.length >= 1);
-                const session_id = list_body.sessions[0].id;
+                assert.ok(list_res.result.sessions.length >= 1);
+                const session_id = list_res.result.sessions[0].id;
                 // Revoke that session by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_action_spec.method,
+                    spec: account_session_revoke_action_spec,
                     params: { session_id },
                     headers,
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.ok, true);
-                assert.strictEqual(revoke_body.revoked, true);
+                assert.strictEqual(revoke_res.result.ok, true);
+                assert.strictEqual(revoke_res.result.revoked, true);
                 // Session should no longer work
-                const after = await rpc_call({
+                const after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(after.status, 401);
@@ -380,26 +385,29 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const headers = test_app.create_session_headers();
                 // Verify works
-                const before = await rpc_call({
+                const before = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(before.status, 200);
                 // Revoke all sessions
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_all_action_spec.method,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // Verify fails after revocation
-                const after = await rpc_call({
+                const after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers,
                 });
                 assert.strictEqual(after.status, 401);
@@ -431,10 +439,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(typeof change_body.sessions_revoked === 'number', 'Expected sessions_revoked count');
                 assert.ok(change_body.sessions_revoked >= 1, 'Expected at least 1 session revoked');
                 // Old session should be invalid
-                const verify_after = await rpc_call({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(verify_after.status, 401);
@@ -472,10 +481,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(res.status, 401);
                 error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
                 // Session should still be valid (password didn't change)
-                const verify_res = await rpc_call({
+                const verify_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(verify_res.status, 200);
@@ -507,23 +517,26 @@ export const describe_standard_integration_tests = (options) => {
             });
             test('valid origin is accepted', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.strictEqual(res.status, 200);
             });
             test('no origin header is allowed (direct access)', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                // Probe the "no Origin / no Referer" path; `rpc_call_non_browser`
-                // suppresses the default `origin` header.
-                const res = await rpc_call_non_browser({
+                // Probe the "no Origin / no Referer" path; `suppress_default_origin`
+                // skips the default `origin` header.
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${test_app.backend.session_cookie}` },
+                    suppress_default_origin: true,
                 });
                 assert.notStrictEqual(res.status, 403);
             });
@@ -532,21 +545,25 @@ export const describe_standard_integration_tests = (options) => {
         describe('bearer auth', () => {
             test('valid bearer token authenticates', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call_non_browser({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: test_app.create_bearer_headers(),
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(res.status, 200);
             });
             test('invalid bearer token returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call_non_browser({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: 'Bearer secret_fuz_token_invalid' },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -554,18 +571,21 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const bearer_headers = test_app.create_bearer_headers();
                 // Without Origin — works.
-                const ok_res = await rpc_call_non_browser({
+                const ok_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: bearer_headers,
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(ok_res.status, 200);
                 // With Origin — bearer silently discarded (browser context), falls through to no auth.
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { ...bearer_headers, origin: 'http://localhost:5173' },
                 });
                 assert.strictEqual(res.status, 401);
@@ -576,38 +596,42 @@ export const describe_standard_integration_tests = (options) => {
             test('revoked API token returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // Create a new token via RPC
-                const create_res = await rpc_call({
+                const create_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_create_action_spec.method,
+                    spec: account_token_create_action_spec,
                     params: { name: 'test-revoke' },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token, id } = create_res.result;
                 // Verify token works
-                const use_res = await rpc_call_non_browser({
+                const use_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(use_res.status, 200);
                 // Revoke via RPC
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_revoke_action_spec.method,
+                    spec: account_token_revoke_action_spec,
                     params: { token_id: id },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
                 // Token should no longer work
-                const after_res = await rpc_call_non_browser({
+                const after_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(after_res.status, 401);
             });
@@ -634,18 +658,20 @@ export const describe_standard_integration_tests = (options) => {
                 // Create a second account
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A revokes all their own sessions
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_all_action_spec.method,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // User B's session should still work
-                const verify_b = await rpc_call({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${user_b.session_cookie}` },
                 });
                 assert.strictEqual(verify_b.status, 200);
@@ -655,32 +681,32 @@ export const describe_standard_integration_tests = (options) => {
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's session ID by listing as user B
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.sessions.length >= 1);
-                const session_id_b = list_body.sessions[0].id;
+                assert.ok(list_res.result.sessions.length >= 1);
+                const session_id_b = list_res.result.sessions[0].id;
                 // User A tries to revoke user B's session by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_revoke_action_spec.method,
+                    spec: account_session_revoke_action_spec,
                     params: { session_id: session_id_b },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.revoked, false, 'Should not revoke another account session');
+                assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account session');
                 // User B's session should still work
-                const verify_b = await rpc_call({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.strictEqual(verify_b.status, 200);
@@ -690,33 +716,34 @@ export const describe_standard_integration_tests = (options) => {
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's token ID by listing as user B
-                const list_res = await rpc_call({
+                const list_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_list_action_spec.method,
+                    spec: account_token_list_action_spec,
+                    params: null,
                     headers: user_b_headers,
                 });
                 assert.ok(list_res.ok, 'account_token_list should succeed');
-                const list_body = list_res.result;
-                assert.ok(list_body.tokens.length >= 1);
-                const token_id_b = list_body.tokens[0].id;
+                assert.ok(list_res.result.tokens.length >= 1);
+                const token_id_b = list_res.result.tokens[0].id;
                 // User A tries to revoke user B's token by ID
-                const revoke_res = await rpc_call({
+                const revoke_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_revoke_action_spec.method,
+                    spec: account_token_revoke_action_spec,
                     params: { token_id: token_id_b },
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
-                const revoke_body = revoke_res.result;
-                assert.strictEqual(revoke_body.revoked, false, 'Should not revoke another account token');
+                assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account token');
                 // User B's bearer token should still work
-                const verify_b = await rpc_call_non_browser({
+                const verify_b = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${user_b.api_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_b.status, 200);
             });
@@ -724,16 +751,16 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A lists sessions
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_session_list_action_spec.method,
+                    spec: account_session_list_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_session_list should succeed');
-                const body = res.result;
                 // Sessions should only belong to user A's account
-                for (const session of body.sessions) {
+                for (const session of res.result.sessions) {
                     assert.strictEqual(session.account_id, test_app.backend.account.id, `Session ${session.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
@@ -741,16 +768,16 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const user_b = await test_app.create_account({ username: 'user_b' });
                 // User A lists tokens
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_list_action_spec.method,
+                    spec: account_token_list_action_spec,
+                    params: null,
                     headers: test_app.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_token_list should succeed');
-                const body = res.result;
                 // Tokens should only belong to user A's account
-                for (const token of body.tokens) {
+                for (const token of res.result.tokens) {
                     assert.strictEqual(token.account_id, test_app.backend.account.id, `Token ${token.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
@@ -864,24 +891,54 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // Hit several auth-required RPC methods without credentials to
                 // broaden error coverage beyond just /login. RPC 401s are tracked
-                // against the shared endpoint path.
-                const rpc_methods = [
-                    account_session_list_action_spec.method,
-                    account_session_revoke_all_action_spec.method,
-                    account_token_list_action_spec.method,
-                    account_token_create_action_spec.method,
-                    account_verify_action_spec.method,
-                ];
-                for (const method of rpc_methods) {
-                    const res = await rpc_call({
-                        app: test_app.app,
-                        path: rpc_path,
-                        method,
-                        headers: { host: 'localhost' },
-                    });
-                    assert.strictEqual(res.status, 401, `${method} without auth should return 401 (dispatcher runs auth before params)`);
-                    error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
-                }
+                // against the shared endpoint path. The dispatcher runs auth before
+                // params validation, so any well-formed param body works — we just
+                // need each call to be type-correct wrt its spec.
+                const session_list = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_session_list_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(session_list.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const session_revoke_all = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_session_revoke_all_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(session_revoke_all.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const token_list = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_token_list_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(token_list.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const token_create = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_token_create_action_spec,
+                    params: { name: 'unauth-probe' },
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(token_create.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                const verify = await rpc_call_for_spec({
+                    app: test_app.app,
+                    path: rpc_path,
+                    spec: account_verify_action_spec,
+                    params: null,
+                    headers: { host: 'localhost' },
+                });
+                assert.strictEqual(verify.status, 401);
+                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
                 // Also exercise POST /logout without auth (still REST)
                 const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
                 if (logout_route) {
@@ -899,10 +956,11 @@ export const describe_standard_integration_tests = (options) => {
         describe('error response information leakage', () => {
             test('401 responses contain no leaky fields', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(res.status, 401);
@@ -918,10 +976,11 @@ export const describe_standard_integration_tests = (options) => {
             test('expired session cookie returns 401', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
-                const res = await rpc_call({
+                const res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { cookie: `${cookie_name}=${expired_cookie}` },
                 });
                 assert.strictEqual(res.status, 401, 'Expired session cookie should be rejected');
@@ -980,10 +1039,10 @@ export const describe_standard_integration_tests = (options) => {
                 const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route');
                 // Create an API token via RPC
-                const create_res = await rpc_call({
+                const create_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_token_create_action_spec.method,
+                    spec: account_token_create_action_spec,
                     params: { name: 'test-token' },
                     headers: test_app.create_session_headers(),
                 });
@@ -991,11 +1050,13 @@ export const describe_standard_integration_tests = (options) => {
                 const { token: raw_token } = create_res.result;
                 assert.ok(raw_token, 'Expected raw token in create response');
                 // Verify bearer token works
-                const verify_before = await rpc_call_non_browser({
+                const verify_before = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${raw_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_before.status, 200, 'Bearer token should work before password change');
                 // Change password (still REST)
@@ -1012,11 +1073,13 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(typeof change_body.tokens_revoked === 'number', 'Expected tokens_revoked count');
                 assert.ok(change_body.tokens_revoked >= 1, 'Expected at least 1 token revoked');
                 // Bearer token should now be invalid
-                const verify_after = await rpc_call_non_browser({
+                const verify_after = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: account_verify_action_spec.method,
+                    spec: account_verify_action_spec,
+                    params: null,
                     headers: { authorization: `Bearer ${raw_token}` },
+                    suppress_default_origin: true,
                 });
                 assert.strictEqual(verify_after.status, 401, 'Bearer token should be rejected after password change');
             });
@@ -1039,10 +1102,10 @@ export const describe_standard_integration_tests = (options) => {
                     roles: ['admin'],
                 });
                 // Create invite for alice@example.com via RPC
-                const invite_res = await rpc_call({
+                const invite_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: 'alice@example.com' },
                     headers: { cookie: `${cookie_name}=${admin.session_cookie}` },
                 });
@@ -1086,10 +1149,10 @@ export const describe_standard_integration_tests = (options) => {
                 const admin_headers = { cookie: `${cookie_name}=${admin.session_cookie}` };
                 // Create an invite for a specific test email via RPC
                 const test_email = 'signup-test@example.com';
-                const invite_res = await rpc_call({
+                const invite_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: test_email },
                     headers: admin_headers,
                 });
@@ -1116,14 +1179,14 @@ export const describe_standard_integration_tests = (options) => {
                 const existing_user = await test_app.create_account({ username: 'existing_user' });
                 // Create invite for a different email via RPC
                 const conflict_email = 'conflict-test@example.com';
-                const invite2_res = await rpc_call({
+                const invite2_res = await rpc_call_for_spec({
                     app: test_app.app,
                     path: rpc_path,
-                    method: invite_create_action_spec.method,
+                    spec: invite_create_action_spec,
                     params: { email: conflict_email },
                     headers: admin_headers,
                 });
-                assert.ok(invite2_res.ok, `invite_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
+                assert.ok(invite2_res.ok, `invite2_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
                 // Attempt 2: signup with the invited email but a colliding username → 409
                 const conflict_res = await test_app.app.request(signup_route.path, {
                     method: 'POST',