@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/__tests__/routes.test.ts

@@ -1,24 +1,8 @@
 import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config
-const mockConfig = {
-  port: 3000,
-  host: '0.0.0.0',
-  apiKeys: ['test-api-key'],
-  baseUrl: 'http://localhost:3000',
-  pollTimeout: 1,
-  heartbeatInterval: 20,
-  jwtExpiresIn: 3600,
-  disconnectTimeout: 300,
-  webCorsOrigins: [],
-  wsIdleTimeout: 30,
-  wsKeepaliveInterval: 20,
-}
-
-mock.module('../config', () => ({
-  config: mockConfig,
-  getBaseUrl: () => 'http://localhost:3000',
-}))
+mock.module('../config', () => mockConfigModule({ pollTimeout: 1 }))
 
 import { Hono } from 'hono'
 import {
@@ -88,6 +72,12 @@ function toWebSessionId(sessionId: string): string {
   return `session_${sessionId.slice('cse_'.length)}`
 }
 
+// Auth helper for web route tests: issues a session token and returns Bearer header.
+// Tokens are issued fresh per call so they survive storeReset() in beforeEach.
+function _auth(user: string): string {
+  return `Bearer ${issueToken(user).token}`
+}
+
 describe('V1 Session Routes', () => {
   let app: Hono
 
@@ -619,9 +609,12 @@ describe('Web Session Routes', () => {
   })
 
   test('POST /web/sessions — creates and auto-binds session', async () => {
-    const res = await app.request('/web/sessions?uuid=user-1', {
+    const res = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({ title: 'Web Session' }),
     })
     expect(res.status).toBe(200)
@@ -632,14 +625,19 @@ describe('Web Session Routes', () => {
 
   test('GET /web/sessions — returns sessions owned by UUID', async () => {
     // Create and bind
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const listRes = await app.request('/web/sessions?uuid=user-1')
+    const listRes = await app.request('/web/sessions', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(listRes.status).toBe(200)
     const sessions = await listRes.json()
     expect(sessions).toHaveLength(1)
@@ -651,13 +649,17 @@ describe('Web Session Routes', () => {
     storeBindSession(codeSession.id, 'user-1')
     const compatId = toWebSessionId(codeSession.id)
 
-    const listRes = await app.request('/web/sessions?uuid=user-1')
+    const listRes = await app.request('/web/sessions', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(listRes.status).toBe(200)
     const sessions = await listRes.json()
     expect(sessions).toHaveLength(1)
     expect(sessions[0].id).toBe(compatId)
 
-    const allRes = await app.request('/web/sessions/all?uuid=user-1')
+    const allRes = await app.request('/web/sessions/all', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(allRes.status).toBe(200)
     const summaries = await allRes.json()
     expect(summaries).toHaveLength(1)
@@ -671,18 +673,26 @@ describe('Web Session Routes', () => {
 
   test('GET /web/sessions/all — lists only sessions owned by requesting UUID', async () => {
     // Create 2 sessions via different users
-    await app.request('/web/sessions?uuid=user-1', {
+    await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
-    await app.request('/web/sessions?uuid=user-2', {
+    await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-2'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
 
-    const allRes = await app.request('/web/sessions/all?uuid=user-1')
+    const allRes = await app.request('/web/sessions/all', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(allRes.status).toBe(200)
     const sessions = await allRes.json()
     expect(sessions).toHaveLength(1) // only user-1's session, not user-2's
@@ -704,7 +714,9 @@ describe('Web Session Routes', () => {
     const { storeUpdateSession } = await import('../store')
     storeUpdateSession(inactive.id, { status: 'inactive' })
 
-    const listRes = await app.request('/web/sessions?uuid=user-1')
+    const listRes = await app.request('/web/sessions', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(listRes.status).toBe(200)
     const sessions = await listRes.json()
     const sessionIds = sessions.map((session: { id: string }) => session.id)
@@ -712,7 +724,9 @@ describe('Web Session Routes', () => {
     expect(sessionIds).toContain(inactive.id)
     expect(sessionIds).toContain(open.id)
 
-    const allRes = await app.request('/web/sessions/all?uuid=user-1')
+    const allRes = await app.request('/web/sessions/all', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(allRes.status).toBe(200)
     const summaries = await allRes.json()
     const summaryIds = summaries.map((session: { id: string }) => session.id)
@@ -722,14 +736,19 @@ describe('Web Session Routes', () => {
   })
 
   test('GET /web/sessions/:id — returns owned session', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const getRes = await app.request(`/web/sessions/${id}?uuid=user-1`)
+    const getRes = await app.request(`/web/sessions/${id}`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(getRes.status).toBe(200)
   })
 
@@ -760,9 +779,9 @@ describe('Web Session Routes', () => {
       }),
     })
 
-    const getRes = await app.request(
-      `/web/sessions/${toWebSessionId(id)}?uuid=user-1`,
-    )
+    const getRes = await app.request(`/web/sessions/${toWebSessionId(id)}`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(getRes.status).toBe(200)
     const body = await getRes.json()
     expect(body.automation_state).toEqual({
@@ -774,35 +793,48 @@ describe('Web Session Routes', () => {
   })
 
   test('GET /web/sessions/:id — 403 for non-owner', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const getRes = await app.request(`/web/sessions/${id}?uuid=user-2`)
+    const getRes = await app.request(`/web/sessions/${id}`, {
+      headers: { Authorization: _auth('user-2') },
+    })
     expect(getRes.status).toBe(403)
   })
 
   test('GET /web/sessions/:id/history — returns events', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`)
+    const histRes = await app.request(`/web/sessions/${id}/history`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(histRes.status).toBe(200)
     const body = await histRes.json()
     expect(body.events).toEqual([])
   })
 
   test('GET /web/sessions/:id/history — returns task_state snapshots', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -817,7 +849,9 @@ describe('Web Session Routes', () => {
       'inbound',
     )
 
-    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`)
+    const histRes = await app.request(`/web/sessions/${id}/history`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(histRes.status).toBe(200)
     const body = await histRes.json()
     expect(body.events).toHaveLength(1)
@@ -833,35 +867,45 @@ describe('Web Session Routes', () => {
     storeBindSession(codeSession.id, 'user-1')
     const compatId = toWebSessionId(codeSession.id)
 
-    const getRes = await app.request(`/web/sessions/${compatId}?uuid=user-1`)
+    const getRes = await app.request(`/web/sessions/${compatId}`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(getRes.status).toBe(200)
     const session = await getRes.json()
     expect(session.id).toBe(compatId)
 
-    const histRes = await app.request(
-      `/web/sessions/${compatId}/history?uuid=user-1`,
-    )
+    const histRes = await app.request(`/web/sessions/${compatId}/history`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(histRes.status).toBe(200)
     const history = await histRes.json()
     expect(history.events).toEqual([])
   })
 
   test('GET /web/sessions/:id/history — 403 for non-owner', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-2`)
+    const histRes = await app.request(`/web/sessions/${id}/history`, {
+      headers: { Authorization: _auth('user-2') },
+    })
     expect(histRes.status).toBe(403)
   })
 
   test('GET /web/sessions/:id — 404 after session deleted', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -873,7 +917,9 @@ describe('Web Session Routes', () => {
     })
 
     // Session still exists (archived), so we can still get it
-    const getRes = await app.request(`/web/sessions/${id}?uuid=user-1`)
+    const getRes = await app.request(`/web/sessions/${id}`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     // After archive, session status is "archived" but still exists
     expect(getRes.status).toBe(200)
   })
@@ -881,9 +927,12 @@ describe('Web Session Routes', () => {
   test('GET /web/sessions/:id/history — 404 for non-existent session', async () => {
     // Bind to a non-existent session won't work, but if ownership was set
     // and session deleted, we need to test the 404 path
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -892,14 +941,19 @@ describe('Web Session Routes', () => {
     const { storeDeleteSession } = await import('../store')
     storeDeleteSession(id)
 
-    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`)
+    const histRes = await app.request(`/web/sessions/${id}/history`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(histRes.status).toBe(404)
   })
 
   test('POST /web/sessions with invalid environment_id — handles work item error', async () => {
-    const res = await app.request('/web/sessions?uuid=user-1', {
+    const res = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({ environment_id: 'env_nonexistent' }),
     })
     // Session is still created even if work item fails
@@ -909,16 +963,19 @@ describe('Web Session Routes', () => {
   })
 
   test('GET /web/sessions/:id/events — returns SSE stream', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const eventsRes = await app.request(
-      `/web/sessions/${id}/events?uuid=user-1`,
-    )
+    const eventsRes = await app.request(`/web/sessions/${id}/events`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(eventsRes.status).toBe(200)
     expect(eventsRes.headers.get('Content-Type')).toBe('text/event-stream')
 
@@ -937,9 +994,9 @@ describe('Web Session Routes', () => {
     storeBindSession(codeSession.id, 'user-1')
     const compatId = toWebSessionId(codeSession.id)
 
-    const eventsRes = await app.request(
-      `/web/sessions/${compatId}/events?uuid=user-1`,
-    )
+    const eventsRes = await app.request(`/web/sessions/${compatId}/events`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(eventsRes.status).toBe(200)
     expect(eventsRes.headers.get('Content-Type')).toBe('text/event-stream')
 
@@ -953,23 +1010,29 @@ describe('Web Session Routes', () => {
   })
 
   test('GET /web/sessions/:id/events — 403 for non-owner', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
 
-    const eventsRes = await app.request(
-      `/web/sessions/${id}/events?uuid=user-2`,
-    )
+    const eventsRes = await app.request(`/web/sessions/${id}/events`, {
+      headers: { Authorization: _auth('user-2') },
+    })
     expect(eventsRes.status).toBe(403)
   })
 
   test('GET /web/sessions/:id/events — 409 for archived session', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -979,7 +1042,9 @@ describe('Web Session Routes', () => {
       headers: AUTH_HEADERS,
     })
 
-    const res = await app.request(`/web/sessions/${id}/events?uuid=user-1`)
+    const res = await app.request(`/web/sessions/${id}/events`, {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(res.status).toBe(409)
     const body = await res.json()
     expect(body.error.type).toBe('session_closed')
@@ -998,23 +1063,26 @@ describe('Web Control Routes', () => {
     app = createApp()
 
     // Create and bind session
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     sessionId = (await createRes.json()).id
   })
 
   test('POST /web/sessions/:id/events — sends user message', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/events?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'user', content: 'hello' }),
+    const res = await app.request(`/web/sessions/${sessionId}/events`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'user', content: 'hello' }),
+    })
     expect(res.status).toBe(200)
     const body = await res.json()
     expect(body.status).toBe('ok')
@@ -1026,111 +1094,114 @@ describe('Web Control Routes', () => {
     storeBindSession(rawSessionId, 'user-1')
     const compatId = toWebSessionId(rawSessionId)
 
-    const eventsRes = await app.request(
-      `/web/sessions/${compatId}/events?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'user', content: 'hello' }),
+    const eventsRes = await app.request(`/web/sessions/${compatId}/events`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'user', content: 'hello' }),
+    })
     expect(eventsRes.status).toBe(200)
 
-    const controlRes = await app.request(
-      `/web/sessions/${compatId}/control?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          type: 'permission_response',
-          approved: true,
-          request_id: 'r1',
-        }),
+    const controlRes = await app.request(`/web/sessions/${compatId}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({
+        type: 'permission_response',
+        approved: true,
+        request_id: 'r1',
+      }),
+    })
     expect(controlRes.status).toBe(200)
 
     const interruptRes = await app.request(
-      `/web/sessions/${compatId}/interrupt?uuid=user-1`,
+      `/web/sessions/${compatId}/interrupt`,
       {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: {
+          Authorization: _auth('user-1'),
+          'Content-Type': 'application/json',
+        },
       },
     )
     expect(interruptRes.status).toBe(200)
   })
 
   test('POST /web/sessions/:id/events — 403 for non-owner', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/events?uuid=user-2`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'user', content: 'hello' }),
+    const res = await app.request(`/web/sessions/${sessionId}/events`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-2'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'user', content: 'hello' }),
+    })
     expect(res.status).toBe(403)
   })
 
   test('POST /web/sessions/:id/control — sends control request', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/control?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          type: 'permission_response',
-          approved: true,
-          request_id: 'r1',
-        }),
+    const res = await app.request(`/web/sessions/${sessionId}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({
+        type: 'permission_response',
+        approved: true,
+        request_id: 'r1',
+      }),
+    })
     expect(res.status).toBe(200)
   })
 
   test('POST /web/sessions/:id/interrupt — interrupts session', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/interrupt?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+    const res = await app.request(`/web/sessions/${sessionId}/interrupt`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+    })
     expect(res.status).toBe(200)
   })
 
   test('POST /web/sessions/:id/interrupt — 403 for non-owner', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/interrupt?uuid=user-2`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+    const res = await app.request(`/web/sessions/${sessionId}/interrupt`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-2'),
+        'Content-Type': 'application/json',
       },
-    )
+    })
     expect(res.status).toBe(403)
   })
 
   test('POST /web/sessions/:id/control — 403 for non-owner', async () => {
-    const res = await app.request(
-      `/web/sessions/${sessionId}/control?uuid=user-2`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'permission_response', approved: true }),
+    const res = await app.request(`/web/sessions/${sessionId}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-2'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'permission_response', approved: true }),
+    })
     expect(res.status).toBe(403)
   })
 
   test('POST /web/sessions/:id/events — 403 for non-existent session with no ownership', async () => {
-    const res = await app.request(
-      '/web/sessions/nonexistent/events?uuid=user-1',
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'user', content: 'hello' }),
+    const res = await app.request('/web/sessions/nonexistent/events', {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'user', content: 'hello' }),
+    })
     expect(res.status).toBe(403)
   })
 
@@ -1140,35 +1211,38 @@ describe('Web Control Routes', () => {
       headers: AUTH_HEADERS,
     })
 
-    const eventsRes = await app.request(
-      `/web/sessions/${sessionId}/events?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ type: 'user', content: 'hello' }),
+    const eventsRes = await app.request(`/web/sessions/${sessionId}/events`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({ type: 'user', content: 'hello' }),
+    })
     expect(eventsRes.status).toBe(409)
 
-    const controlRes = await app.request(
-      `/web/sessions/${sessionId}/control?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          type: 'permission_response',
-          approved: true,
-          request_id: 'r1',
-        }),
+    const controlRes = await app.request(`/web/sessions/${sessionId}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({
+        type: 'permission_response',
+        approved: true,
+        request_id: 'r1',
+      }),
+    })
     expect(controlRes.status).toBe(409)
 
     const interruptRes = await app.request(
-      `/web/sessions/${sessionId}/interrupt?uuid=user-1`,
+      `/web/sessions/${sessionId}/interrupt`,
       {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: {
+          Authorization: _auth('user-1'),
+          'Content-Type': 'application/json',
+        },
       },
     )
     expect(interruptRes.status).toBe(409)
@@ -1191,7 +1265,9 @@ describe('Web Environment Routes', () => {
       body: JSON.stringify({ machine_name: 'mac1' }),
     })
 
-    const res = await app.request('/web/environments?uuid=user-1')
+    const res = await app.request('/web/environments', {
+      headers: { Authorization: _auth('user-1') },
+    })
     expect(res.status).toBe(200)
     const envs = await res.json()
     expect(envs).toHaveLength(1)
@@ -2016,9 +2092,12 @@ describe('V2 Worker Events Routes', () => {
   })
 
   test('GET /v1/code/sessions/:id/worker/events/stream — normalizes web permission approvals to control_response', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -2037,18 +2116,18 @@ describe('V2 Worker Events Routes', () => {
 
     await reader.read() // initial keepalive
 
-    const controlRes = await app.request(
-      `/web/sessions/${id}/control?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          type: 'permission_response',
-          approved: true,
-          request_id: 'req-1',
-        }),
+    const controlRes = await app.request(`/web/sessions/${id}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({
+        type: 'permission_response',
+        approved: true,
+        request_id: 'req-1',
+      }),
+    })
     expect(controlRes.status).toBe(200)
 
     const chunk = await reader.read()
@@ -2062,9 +2141,12 @@ describe('V2 Worker Events Routes', () => {
   })
 
   test('GET /v1/code/sessions/:id/worker/events/stream — normalizes web plan rejection feedback to deny control_response', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -2083,19 +2165,19 @@ describe('V2 Worker Events Routes', () => {
 
     await reader.read() // initial keepalive
 
-    const controlRes = await app.request(
-      `/web/sessions/${id}/control?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          type: 'permission_response',
-          approved: false,
-          request_id: 'req-2',
-          message: 'Need more detail',
-        }),
+    const controlRes = await app.request(`/web/sessions/${id}/control`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+      body: JSON.stringify({
+        type: 'permission_response',
+        approved: false,
+        request_id: 'req-2',
+        message: 'Need more detail',
+      }),
+    })
     expect(controlRes.status).toBe(200)
 
     const chunk = await reader.read()
@@ -2111,9 +2193,12 @@ describe('V2 Worker Events Routes', () => {
   })
 
   test('GET /v1/code/sessions/:id/worker/events/stream — normalizes web interrupts to control_request', async () => {
-    const createRes = await app.request('/web/sessions?uuid=user-1', {
+    const createRes = await app.request('/web/sessions', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
+      },
       body: JSON.stringify({}),
     })
     const { id } = await createRes.json()
@@ -2132,13 +2217,13 @@ describe('V2 Worker Events Routes', () => {
 
     await reader.read() // initial keepalive
 
-    const interruptRes = await app.request(
-      `/web/sessions/${id}/interrupt?uuid=user-1`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+    const interruptRes = await app.request(`/web/sessions/${id}/interrupt`, {
+      method: 'POST',
+      headers: {
+        Authorization: _auth('user-1'),
+        'Content-Type': 'application/json',
       },
-    )
+    })
     expect(interruptRes.status).toBe(200)
 
     const chunk = await reader.read()