create-windy 0.5.1 → 0.6.0

package/template/apps/server/src/ai-runtime-readiness/operation-port.test.ts

@@ -0,0 +1,193 @@
+import { expect, test } from "bun:test";
+import { documentManifest } from "../document/output-artifact-manifest.test-support.js";
+import { createModuleAiOperationReadinessPort } from "./operation-port.js";
+import {
+  createPort,
+  deploymentIdentity,
+  expectProbeFailure,
+  observedAt,
+  offersDigest,
+  operationKey,
+  readySnapshot,
+  unavailableSnapshot,
+} from "./operation-port.test-support.js";
+
+test("Readiness Port 对其它模块与缺失 Operation 返回同一常量结果", async () => {
+  const input = {
+    moduleName: "foreign",
+    guardContext: {} as never,
+    signal: new AbortController().signal,
+    sources: [],
+    runtime: {} as never,
+    now: () => new Date(observedAt),
+  };
+  const foreign = createModuleAiOperationReadinessPort({
+    ...input,
+    modules: [documentManifest()],
+  });
+  const missing = createModuleAiOperationReadinessPort({
+    ...input,
+    modules: [],
+  });
+  const expected = await missing.inspect({ operationKey });
+  await expect(foreign.inspect({ operationKey })).resolves.toEqual(expected);
+  expect(expected).toMatchObject({
+    runtimeKind: "agent",
+    status: "unavailable",
+    deployment: null,
+    offers: [],
+    unavailableReasons: [{ code: "RUNTIME_NOT_CONFIGURED" }],
+  });
+});
+
+test("Readiness Port 仅对本模块 Operation 返回其实际 kind", async () => {
+  const port = createModuleAiOperationReadinessPort({
+    moduleName: "evidence",
+    guardContext: {} as never,
+    signal: new AbortController().signal,
+    modules: [documentManifest()],
+    sources: [],
+    runtime: {} as never,
+    now: () => new Date(observedAt),
+  });
+  await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+    runtimeKind: "document",
+    unavailableReasons: [{ code: "RUNTIME_NOT_CONFIGURED" }],
+  });
+});
+
+test("Readiness Port 对 200 body 执行公共 parser 与 projector", async () => {
+  const port = createPort(async () =>
+    Response.json(readySnapshot(), { status: 200 }),
+  );
+
+  await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+    status: "ready",
+    operationKey,
+    deployment: { identity: deploymentIdentity, offersDigest },
+    unavailableReasons: [],
+  });
+});
+
+test("Readiness Port 对 503 body 同样执行公共 parser 与 projector", async () => {
+  const port = createPort(async () =>
+    Response.json(unavailableSnapshot(), { status: 503 }),
+  );
+
+  await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+    status: "unavailable",
+    deployment: null,
+    unavailableReasons: [{ code: "RUNTIME_NOT_CONFIGURED", retryable: true }],
+  });
+});
+
+test("Readiness Port 拒绝 503 + ready body", async () => {
+  const port = createPort(async () =>
+    Response.json(readySnapshot(), { status: 503 }),
+  );
+  await expectProbeFailure(port);
+});
+
+test("Readiness Port 拒绝 200 + unavailable body", async () => {
+  const port = createPort(async () =>
+    Response.json(unavailableSnapshot(), { status: 200 }),
+  );
+  await expectProbeFailure(port);
+});
+
+for (const status of [401, 500, 302]) {
+  test(`Readiness Port 拒绝 ${status} 即使 body 声称 ready`, async () => {
+    const port = createPort(
+      async () =>
+        new Response(JSON.stringify(readySnapshot()), {
+          status,
+          headers: { "content-type": "application/json" },
+        }),
+    );
+    await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+      status: "unavailable",
+      unavailableReasons: [
+        { code: "DOWNSTREAM_PROBE_FAILED", retryable: true },
+      ],
+    });
+  });
+}
+
+test("Readiness Port 拒绝超过上限的 JSON body", async () => {
+  const port = createPort(async () =>
+    Response.json({ ...readySnapshot(), padding: "x".repeat(65 * 1024) }),
+  );
+  await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+    status: "unavailable",
+    unavailableReasons: [{ code: "DOWNSTREAM_PROBE_FAILED", retryable: true }],
+  });
+});
+
+test("Readiness Port 将 transport rejection 收敛为稳定安全 reason", async () => {
+  const port = createPort(async () => {
+    throw new Error("https://runtime.internal Bearer do-not-leak");
+  });
+
+  const result = await port.inspect({ operationKey });
+  expect(result).toMatchObject({
+    status: "unavailable",
+    unavailableReasons: [{ code: "DOWNSTREAM_PROBE_FAILED", retryable: true }],
+  });
+  expect(JSON.stringify(result)).not.toContain("do-not-leak");
+});
+
+test("Readiness Port 对 probe timeout 使用相同稳定 reason", async () => {
+  const port = createPort(
+    (signal) =>
+      new Promise<Response>((_resolve, reject) => {
+        const fail = () => reject(new Error("timeout-secret"));
+        if (signal?.aborted) fail();
+        else signal?.addEventListener("abort", fail, { once: true });
+      }),
+    5,
+  );
+
+  const result = await port.inspect({ operationKey });
+  expect(result).toMatchObject({
+    status: "unavailable",
+    unavailableReasons: [{ code: "DOWNSTREAM_PROBE_FAILED", retryable: true }],
+  });
+  expect(JSON.stringify(result)).not.toContain("timeout-secret");
+});
+
+test("Readiness Port 在 health 忽略 signal 时仍强制 deadline", async () => {
+  let settleHealth: ((response: Response) => void) | undefined;
+  const pending = new Promise<Response>((resolve) => {
+    settleHealth = resolve;
+  });
+  const port = createPort(() => pending, 5);
+  await expectProbeFailure(port);
+  settleHealth?.(Response.json(readySnapshot()));
+  await new Promise((resolve) => setTimeout(resolve, 1));
+});
+
+test("Readiness Port 安全消费 deadline 后才到达的 rejection", async () => {
+  let rejectHealth: ((error: Error) => void) | undefined;
+  const pending = new Promise<Response>((_resolve, reject) => {
+    rejectHealth = reject;
+  });
+  const port = createPort(() => pending, 5);
+  await expectProbeFailure(port);
+  rejectHealth?.(new Error("late-secret"));
+  await new Promise((resolve) => setTimeout(resolve, 1));
+});
+
+test("Readiness Port 对卡住的 response body 也使用 probe timeout", async () => {
+  const port = createPort(
+    async () =>
+      new Response(new ReadableStream({ pull() {} }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+    5,
+  );
+  await expect(port.inspect({ operationKey })).resolves.toMatchObject({
+    status: "unavailable",
+    unavailableReasons: [{ code: "DOWNSTREAM_PROBE_FAILED", retryable: true }],
+  });
+});

package/template/apps/server/src/ai-runtime-readiness/operation-port.ts

@@ -0,0 +1,172 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import {
+  projectAiOperationReadinessV1,
+  type AiReadinessReasonCodeV1,
+  type AiRuntimeKindV1,
+  type ModuleAiOperationReadinessPortV1,
+  type ModuleAiOperationReadinessV1,
+} from "@southwind-ai/server-sdk";
+import { evaluateAccessGuards } from "../access-guards.js";
+import type { RequestGuardContext } from "../guards.js";
+import { findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import {
+  readBoundedHealthJson,
+  settleBeforeHealthDeadline,
+} from "./health-response.js";
+import { AiRuntimeReadinessTrustStoreV1 } from "./trust-store.js";
+
+export interface AiRuntimeReadinessSourceV1 {
+  readonly kind: AiRuntimeKindV1;
+  health(signal?: AbortSignal): Promise<Response>;
+}
+
+/** Per-request Host adapter: no cross-module discovery or cached aggregation. */
+export function createModuleAiOperationReadinessPort(input: {
+  readonly moduleName?: string;
+  readonly guardContext?: RequestGuardContext;
+  readonly signal?: AbortSignal;
+  readonly modules: readonly ModuleManifest[];
+  readonly sources: readonly AiRuntimeReadinessSourceV1[];
+  readonly runtime: ReturnType<typeof createServerRuntime>;
+  readonly now?: () => Date;
+  /** Tests may shorten the bound; production defaults to five seconds. */
+  readonly probeTimeoutMs?: number;
+  readonly trustStore?: AiRuntimeReadinessTrustStoreV1;
+}): ModuleAiOperationReadinessPortV1 {
+  const operations = new Map(
+    input.modules.flatMap((module) =>
+      (module.aiOperations ?? []).map(
+        (operation) => [operation.key, { module, operation }] as const,
+      ),
+    ),
+  );
+  const sources = new Map(input.sources.map((source) => [source.kind, source]));
+  const now = input.now ?? (() => new Date());
+  const probeTimeoutMs = input.probeTimeoutMs ?? 5_000;
+  const trustStore = input.trustStore ?? new AiRuntimeReadinessTrustStoreV1();
+  if (!Number.isSafeInteger(probeTimeoutMs) || probeTimeoutMs < 1)
+    throw new Error("AI runtime probe timeout is invalid");
+  return {
+    async inspect({ operationKey }) {
+      const entry = operations.get(operationKey);
+      const ownedEntry =
+        entry && (!input.moduleName || entry.module.name === input.moduleName)
+          ? entry
+          : undefined;
+      const operation = ownedEntry?.operation;
+      const source = operation && sources.get(operation.kind);
+      if (!operation?.readiness || !source) {
+        return unavailable(
+          operationKey,
+          operation?.kind ?? "agent",
+          now(),
+          "RUNTIME_NOT_CONFIGURED",
+        );
+      }
+      if (input.moduleName) {
+        if (!input.guardContext || !input.signal)
+          return unavailable(
+            operationKey,
+            operation.kind,
+            now(),
+            "RUNTIME_NOT_CONFIGURED",
+          );
+        const feature = findFeature(
+          ownedEntry.module.features,
+          operation.featureKey,
+        );
+        const guards = await evaluateAccessGuards(
+          input.runtime,
+          input.guardContext,
+          {
+            permission: { permissionKey: operation.permissionKey },
+            feature,
+          },
+        );
+        if (!guards.decision.allowed)
+          return unavailable(
+            operationKey,
+            operation.kind,
+            now(),
+            "RUNTIME_NOT_CONFIGURED",
+          );
+      }
+      const deadlineController = new AbortController();
+      const deadline = setTimeout(
+        () => deadlineController.abort("ai-runtime-health-deadline"),
+        probeTimeoutMs,
+      );
+      const probeSignal = input.signal
+        ? AbortSignal.any([input.signal, deadlineController.signal])
+        : deadlineController.signal;
+      try {
+        const response = await settleBeforeHealthDeadline(
+          Promise.resolve().then(() => source.health(probeSignal)),
+          probeSignal,
+        );
+        const snapshot = await readBoundedHealthJson(response, probeSignal);
+        const requirement = {
+          schemaVersion: 1,
+          operationKey,
+          runtimeKind: operation.kind,
+          expectedDeployment: operation.readiness.expectedDeployment,
+          variant: operation.readiness.variant,
+          requiredCapabilities: operation.requiredCapabilities,
+          inputModalities: operation.readiness.inputModalities,
+          outputModalities: operation.readiness.outputModalities,
+          limits: operation.limits,
+          resources: {
+            minConcurrentRuns: operation.readiness.minConcurrentRuns,
+            minQueueDepth: operation.readiness.minQueueDepth,
+          },
+        } as const;
+        const projectedAt = now().toISOString();
+        const projected = projectAiOperationReadinessV1(requirement, snapshot, {
+          now: projectedAt,
+          trustedFullAttestation: trustStore.get(requirement),
+        });
+        if (
+          (response.status === 200 && projected.status !== "ready") ||
+          (response.status === 503 && projected.status !== "unavailable")
+        )
+          throw new Error("AI runtime health status/body mismatch");
+        trustStore.observeFull(requirement, snapshot, projectedAt);
+        probeSignal.throwIfAborted();
+        return projected;
+      } catch {
+        return unavailable(
+          operationKey,
+          operation.kind,
+          now(),
+          "DOWNSTREAM_PROBE_FAILED",
+        );
+      } finally {
+        clearTimeout(deadline);
+      }
+    },
+  };
+}
+
+function unavailable(
+  operationKey: string,
+  runtimeKind: AiRuntimeKindV1,
+  now: Date,
+  code: Extract<
+    AiReadinessReasonCodeV1,
+    "RUNTIME_NOT_CONFIGURED" | "DOWNSTREAM_PROBE_FAILED"
+  >,
+): ModuleAiOperationReadinessV1 {
+  return {
+    schemaVersion: 1,
+    operationKey,
+    runtimeKind,
+    observedAt: now.toISOString(),
+    status: "unavailable",
+    deployment: null,
+    offers: [],
+    unavailableReasons: [
+      { code, retryable: code === "DOWNSTREAM_PROBE_FAILED" },
+    ],
+  };
+}

package/template/apps/server/src/ai-runtime-readiness/trust-store.ts

@@ -0,0 +1,61 @@
+import {
+  parseAiRuntimeReadinessV1,
+  projectAiOperationReadinessV1,
+  type AiOperationReadinessRequirementV1,
+  type AiRuntimeOfferV1,
+  type AiRuntimeTrustedFullAttestationV1,
+} from "@southwind-ai/server-sdk";
+
+/** Host-owned process-local history. Runtime payload fields cannot populate it. */
+export class AiRuntimeReadinessTrustStoreV1 {
+  readonly #attestations = new Map<string, AiRuntimeTrustedFullAttestationV1>();
+
+  get(requirement: AiOperationReadinessRequirementV1) {
+    return this.#attestations.get(key(requirement));
+  }
+
+  observeFull(
+    requirement: AiOperationReadinessRequirementV1,
+    snapshot: unknown,
+    now: string,
+  ) {
+    const strict = projectAiOperationReadinessV1(requirement, snapshot, {
+      now,
+    });
+    if (strict.status !== "ready") return;
+    const parsed = parseAiRuntimeReadinessV1(snapshot, now);
+    if (!parsed.ok || parsed.value.status !== "ready") return;
+    this.#attestations.set(key(requirement), {
+      deployment: Object.freeze({ ...strict.deployment }),
+      offers: cloneOffers(parsed.value.offers),
+    });
+  }
+}
+
+function key(requirement: AiOperationReadinessRequirementV1) {
+  const deployment = requirement.expectedDeployment;
+  return [
+    requirement.runtimeKind,
+    deployment.key,
+    deployment.identity,
+    deployment.releaseDigest,
+    deployment.offersDigest,
+  ].join("\u0000");
+}
+
+function cloneOffers(
+  offers: readonly [AiRuntimeOfferV1, ...AiRuntimeOfferV1[]],
+): readonly [AiRuntimeOfferV1, ...AiRuntimeOfferV1[]] {
+  const cloned = offers.map((offer) =>
+    Object.freeze({
+      variant: offer.variant,
+      capabilities: Object.freeze([...offer.capabilities]),
+      inputModalities: Object.freeze([...offer.inputModalities]),
+      outputModalities: Object.freeze([...offer.outputModalities]),
+      limits: Object.freeze({ ...offer.limits }),
+    }),
+  );
+  const [first, ...rest] = cloned;
+  if (!first) throw new Error("AI Runtime full attestation 缺少 offers");
+  return Object.freeze([first, ...rest]);
+}

package/template/apps/server/src/app/ai-screenshot-intake-binding.ts

@@ -0,0 +1,22 @@
+import type { ModuleAiScreenshotIntakePortV1 } from "@southwind-ai/server-sdk";
+import type { RequestGuardContext } from "../guards.js";
+import type { ScreenshotPageRegistryV2 } from "../agent/persistent-screenshot-intake-producer.js";
+
+export type ProjectAiScreenshotIntakeFactoryV1 = (
+  moduleName: string,
+  guardContext: RequestGuardContext,
+  signal: AbortSignal,
+) => ModuleAiScreenshotIntakePortV1;
+
+/** Project-owned opt-in. A real producer must provide the bounded intake port. */
+export const projectAiScreenshotIntakeFactoryV1:
+  | ProjectAiScreenshotIntakeFactoryV1
+  | undefined = undefined;
+
+/**
+ * V2 的 bytes、Artifact 与 Run binding 均由平台持有。项目只能把受控
+ * Registry 页面映射成允许的 Operation；未配置或未知页面均由 Host 拒绝。
+ */
+export const projectAiScreenshotPageRegistryV2:
+  | ScreenshotPageRegistryV2
+  | undefined = undefined;

package/template/apps/server/src/app/document-output-artifact-bindings.ts

@@ -0,0 +1,5 @@
+import type { DocumentOutputArtifactBinding } from "../document/output-artifact-host.js";
+
+/** Project-owned explicit opt-in for derived Document outputs. */
+export const documentOutputArtifactBindings: readonly DocumentOutputArtifactBinding[] =
+  [];

package/template/apps/server/src/app/speech-output-artifact-bindings.ts

@@ -0,0 +1,5 @@
+import type { SpeechOutputArtifactBinding } from "../speech/output-artifact-binding.js";
+
+/** Project-owned explicit opt-in for derived Speech outputs. */
+export const speechOutputArtifactBindings: readonly SpeechOutputArtifactBinding[] =
+  [];

package/template/apps/server/src/application-services.ts

@@ -34,6 +34,7 @@ import { InMemorySchedulerRepository } from "./scheduler/repository.js";
 import type { ScheduledTaskDefinition } from "./scheduler/types.js";
 // @windy-module system.storage begin
 import type { createStorageRuntime } from "./storage/runtime.js";
+import type { ReportStagingService } from "./report-staging/service.js";
 // @windy-module system.storage end
 // @windy-module system.notification begin
 import type { PlatformConfig } from "@southwind-ai/config";
@@ -84,6 +85,7 @@ interface ApplicationServicesInput {
   runtime: ReturnType<typeof createServerRuntime>;
   // @windy-module system.storage begin
   storage: ReturnType<typeof createStorageRuntime>;
+  reportStaging?: ReportStagingService;
   // @windy-module system.storage end
   moduleTasks: ScheduledTaskDefinition[];
   // @windy-module system.bulk-data begin
@@ -176,9 +178,12 @@ export async function createApplicationServices(
           ],
           now,
         );
-        return {
-          ...(await input.storage.uploads.cleanupExpired(100, referencedRefs)),
-        };
+        const storage = await input.storage.uploads.cleanupExpired(
+          100,
+          referencedRefs,
+        );
+        const reportStaging = await input.reportStaging?.cleanupExpired(50);
+        return reportStaging ? { ...storage, reportStaging } : { ...storage };
       },
       // @windy-module system.storage end
       // @windy-module system.workflow begin
@@ -231,6 +236,7 @@ export async function createApplicationServices(
       features: input.foundation.features,
       // @windy-module system.storage begin
       storage: input.storage,
+      reportStaging: input.reportStaging,
       // @windy-module system.storage end
       // @windy-module system.agent begin
       backgroundAi: input.backgroundAi,

package/template/apps/server/src/audit/redaction.ts

@@ -9,6 +9,7 @@ const DEFAULT_SENSITIVE_FIELDS = [
   "secret",
   "signature",
   "token",
+  "output-artifact-grant",
 ];
 
 export function redactAuditEvent(

package/template/apps/server/src/audit/reliable-writer.test.ts

@@ -93,6 +93,10 @@ describe("ReliableAuditWriter", () => {
         accessToken: "never-store-token",
         signature: "never-store-signature",
       },
+      headers: {
+        "x-ai-output-artifact-grant": "never-store-output-grant",
+      },
+      outputArtifactGrant: "never-store-camel-grant",
       licenseId: "license_1",
       harmless: "保留字段",
     });
@@ -106,6 +110,10 @@ describe("ReliableAuditWriter", () => {
         accessToken: "[REDACTED]",
         signature: "[REDACTED]",
       },
+      headers: {
+        "x-ai-output-artifact-grant": "[REDACTED]",
+      },
+      outputArtifactGrant: "[REDACTED]",
       licenseId: "license_1",
       harmless: "保留字段",
     });

package/template/apps/server/src/auth/password-change-license-restriction.test.ts

@@ -0,0 +1,156 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { systemModuleManifests } from "@southwind-ai/modules";
+import { Elysia } from "elysia";
+import {
+  createManifestAuthorizedRouteApp,
+  createStaticRouteAuthorizer,
+} from "../module-host/static-route-authorization.js";
+import { platformStaticRouteAuthorizationOptions } from "../platform-http-runtime.js";
+import { restrictedRequestResponse } from "../request-restriction.js";
+import { createServerRuntime } from "../runtime.js";
+import { RepositoryActorResolver } from "./actor-resolver.js";
+import { argon2PasswordHasher } from "./password.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
+import { AuthService } from "./service.js";
+
+const initialPassword = "test-only-password";
+let passwordHash = "";
+
+beforeAll(async () => {
+  passwordHash = await argon2PasswordHasher.hash(initialPassword);
+});
+
+describe("License 受限模式下的认证恢复", () => {
+  test("首次登录用户可自助改密，但匿名请求和其它个人接口仍受保护", async () => {
+    const fixture = createFixture();
+
+    const anonymous = await fixture.app.handle(
+      changeRequest(undefined, initialPassword, "Windy-Changed-2026"),
+    );
+    expect(anonymous.status).toBe(401);
+
+    const active = await login(fixture.app, "active");
+    const restricted = await fixture.app.handle(
+      bearerRequest("/api/auth/sessions", active.token),
+    );
+    expect(restricted.status).toBe(403);
+    await expect(restricted.json()).resolves.toMatchObject({
+      reason: "license-restricted",
+    });
+
+    const firstLogin = await login(fixture.app, "first-login");
+    expect(firstLogin.user.credentialState).toBe("must-change-password");
+    const wrongCurrent = await fixture.app.handle(
+      changeRequest(
+        firstLogin.token,
+        "Wrong-Current-Password",
+        "Windy-Changed-2026",
+      ),
+    );
+    expect(wrongCurrent.status).toBe(400);
+    await expect(wrongCurrent.json()).resolves.toMatchObject({
+      error: "INVALID_CURRENT_PASSWORD",
+    });
+
+    const changed = await fixture.app.handle(
+      changeRequest(firstLogin.token, initialPassword, "Windy-Changed-2026"),
+    );
+    expect(changed.status).toBe(200);
+    await expect(
+      fixture.repository.findUserByReference("user_first-login"),
+    ).resolves.toMatchObject({ credentialState: "active" });
+  });
+});
+
+function createFixture() {
+  const modules = systemModuleManifests();
+  const repository = new InMemoryAuthRepository([
+    user("first-login", "must-change-password"),
+    user("active", "active"),
+  ]);
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: new RepositoryActorResolver(repository),
+      featureCatalog: modules.flatMap(({ features }) => features),
+      licenseEnforced: true,
+      licenseResolver: {
+        resolve: () => ({ status: "missing", restricted: true }),
+      },
+    },
+  );
+  const service = new AuthService(repository, {
+    auditWriter: { write: () => undefined },
+  });
+  const app = new Elysia({ prefix: "/api" })
+    .derive(async ({ request }) => ({
+      guardContext: await runtime.createGuardContext(request),
+    }))
+    .onBeforeHandle(({ request, guardContext }) =>
+      restrictedRequestResponse(runtime, guardContext, request),
+    );
+  const guarded = createManifestAuthorizedRouteApp(
+    app,
+    createStaticRouteAuthorizer(runtime, modules),
+    platformStaticRouteAuthorizationOptions,
+  );
+  registerAuthSessionRoute(guarded);
+  registerAuthRoutes(guarded, service, { secureCookie: false });
+  return { app, repository };
+}
+
+function user(
+  username: string,
+  credentialState: AuthUserRecord["credentialState"],
+): AuthUserRecord {
+  return {
+    id: `user_${username}`,
+    username,
+    displayName: username,
+    passwordHash,
+    credentialState,
+    status: "active",
+    roleCodes: [],
+    permissionKeys: [],
+  };
+}
+
+async function login(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+) {
+  const response = await app.handle(
+    new Request("http://localhost/api/auth/api/login", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username, password: initialPassword }),
+    }),
+  );
+  expect(response.status).toBe(200);
+  return (await response.json()) as {
+    token: string;
+    user: { credentialState: AuthUserRecord["credentialState"] };
+  };
+}
+
+function changeRequest(
+  token: string | undefined,
+  currentPassword: string,
+  newPassword: string,
+) {
+  return new Request("http://localhost/api/auth/password/change", {
+    method: "POST",
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({ currentPassword, newPassword }),
+  });
+}
+
+function bearerRequest(path: string, token: string) {
+  return new Request(`http://localhost${path}`, {
+    headers: { authorization: `Bearer ${token}` },
+  });
+}