miravo 0.6.0 → 0.6.1

package/src/lib/admin-server.test.ts

@@ -1,781 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import type { EventEmitter } from "node:events";
-import { createServer } from "node:net";
-import type { EngineCoreMetrics, EngineStateSnapshot } from "@miravo/core";
-import {
-  type CommandResult,
-  ConsoleBootstrapResponseSchema,
-  type EngineCommand,
-} from "@miravo/shared";
-import { startAdminServer } from "./admin-server.ts";
-import { createSessionStore } from "./session-store.ts";
-
-/** Default test auth config: password "admin", not default. */
-function testAuth() {
-  return {
-    verifyPassword: async (pw: string) => pw === "testpass",
-    isDefaultPassword: false,
-    sessionStore: createSessionStore(),
-    changePassword: async (_old: string, _new: string) => {},
-  };
-}
-
-/** Login to the test server and return the session cookie string for use in headers. */
-async function loginAndGetCookie(baseUrl: string, password = "testpass"): Promise<string> {
-  const res = await fetch(`${baseUrl}/auth/login`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ username: "admin", password }),
-  });
-  if (!res.ok) throw new Error(`Login failed: ${res.status}`);
-  const setCookie = res.headers.get("set-cookie") ?? "";
-  return setCookie.split(";")[0] ?? "";
-}
-
-async function canBindLocalTcp(): Promise<boolean> {
-  const probe = createServer();
-  return new Promise((resolve) => {
-    const cleanup = () => {
-      try {
-        probe.close();
-      } catch {
-        // Ignore close races in test cleanup.
-      }
-    };
-
-    (probe as unknown as EventEmitter).once("error", () => {
-      cleanup();
-      resolve(false);
-    });
-    (probe as unknown as EventEmitter).once("listening", () => {
-      cleanup();
-      resolve(true);
-    });
-    probe.listen(0, "127.0.0.1");
-  });
-}
-
-async function reservePort(): Promise<number> {
-  const probe = createServer();
-  return new Promise((resolve, reject) => {
-    const cleanup = () => {
-      try {
-        probe.close();
-      } catch {
-        // Ignore close races in test cleanup.
-      }
-    };
-
-    (probe as unknown as EventEmitter).once("error", (error: Error) => {
-      cleanup();
-      reject(error);
-    });
-    (probe as unknown as EventEmitter).once("listening", () => {
-      const address = probe.address();
-      if (!address || typeof address === "string") {
-        cleanup();
-        reject(new Error("Failed to reserve a local TCP port for the admin server test."));
-        return;
-      }
-
-      const { port } = address;
-      probe.close((error) => {
-        if (error) {
-          reject(error);
-          return;
-        }
-        resolve(port);
-      });
-    });
-    probe.listen(0, "127.0.0.1");
-  });
-}
-
-const TCP_AVAILABLE = await canBindLocalTcp();
-const describeIfTcp = TCP_AVAILABLE ? describe : describe.skip;
-
-function createMockAdminEngine(
-  initialState: EngineCoreMetrics["state"],
-  tickIntervalMs: number,
-  connectedAdapters: string[] = [],
-  enabledAdapters: string[] = [],
-) {
-  const runtime = {
-    state: initialState as EngineCoreMetrics["state"],
-    tickCount: 0,
-    lastTickProgressAt: performance.now(),
-    executedCommands: [] as EngineCommand[],
-    connectedAdapters: [...connectedAdapters],
-    enabledAdapters: [...enabledAdapters],
-  };
-
-  const snapshot: EngineStateSnapshot = {
-    simulationName: "test-sim",
-    models: [],
-    instances: [],
-    config: {
-      seed: 1,
-      tickIntervalMs,
-      timeMultiplier: 1,
-      adapters: [],
-    },
-  };
-
-  return {
-    engine: {
-      getMetrics: () => ({
-        simulationName: snapshot.simulationName,
-        core: {
-          state: runtime.state,
-          tickCount: runtime.tickCount,
-          simulationTimeSeconds: 0,
-          instanceCount: 1,
-          memberValueCount: 1,
-          quarantinedInstanceCount: 0,
-          engineErrorsCount: 0,
-          tickOverrunsCount: 0,
-          circuitBreakerTripsCount: 0,
-          uptimeMs: 0,
-          actualTicksPerSecond: 1,
-        },
-        fleet: {
-          modelBreakdown: [{ model: "test-sensor", count: 1 }],
-          lifecycleBreakdown: { running: 1 },
-          activeFaultCount: 0,
-          faultBreakdown: [],
-        },
-        adapters: runtime.connectedAdapters.map((name) => ({
-          name,
-          metrics: { connected: true },
-        })),
-      }),
-      getState: () => ({
-        ...snapshot,
-        availableAdapters: runtime.enabledAdapters.map((name) => ({
-          name,
-          enabled: true,
-          pending: false,
-          config: {},
-        })),
-      }),
-      getAvailableAdapters: () =>
-        runtime.enabledAdapters.map((name) => ({
-          name,
-          enabled: true,
-        })),
-      getInstanceDetail: (_id: string) => undefined,
-      getModelSchema: (_name: string) => undefined,
-      getEventLog: () => ({ events: [], nextCursor: null, hasMore: false }),
-      getRunningTemplates: () => [],
-      getManifest: () => ({
-        generatedAt: new Date().toISOString(),
-        protocols: {},
-        tags: [],
-        summary: { totalTags: 0, totalInstances: 0, enabledProtocols: [] },
-      }),
-      execute: async (command: EngineCommand): Promise<CommandResult> => {
-        runtime.executedCommands.push(command);
-        return {
-          success: true,
-          command: command.type,
-          correlationId: command.correlationId,
-          message: `Executed ${command.type}`,
-        };
-      },
-    },
-    setState(state: EngineCoreMetrics["state"]) {
-      runtime.state = state;
-    },
-    setTickCount(tickCount: number) {
-      runtime.tickCount = tickCount;
-    },
-    setLastTickProgressAt(timestamp: number) {
-      runtime.lastTickProgressAt = timestamp;
-    },
-    getLastTickProgressAt() {
-      return runtime.lastTickProgressAt;
-    },
-    getExecutedCommands() {
-      return [...runtime.executedCommands];
-    },
-    setConnectedAdapters(adapterNames: string[]) {
-      runtime.connectedAdapters = [...adapterNames];
-    },
-    setEnabledAdapters(adapterNames: string[]) {
-      runtime.enabledAdapters = [...adapterNames];
-    },
-  };
-}
-
-function serverBaseUrl(endpoint: string): string {
-  const url = new URL(endpoint);
-  return `http://127.0.0.1:${url.port}`;
-}
-
-interface StartServerOptions {
-  readonly state: EngineCoreMetrics["state"];
-  readonly tickIntervalMs?: number;
-  readonly host?: string;
-  /** Adapter names that should report as connected in mock metrics. */
-  readonly connectedAdapters?: string[];
-  /** Adapter names that should report as enabled in the runtime state. */
-  readonly enabledAdapters?: string[];
-  readonly getLeExport?:
-    | ((
-        id: string,
-        opts: { host: string; protocol: import("@miravo/shared").ProtocolName | undefined },
-      ) => Promise<{ templateJson: string; tagsCSV: string } | null>)
-    | undefined;
-}
-
-async function startTestServer(options: StartServerOptions, handles: Array<{ stop: () => void }>) {
-  const port = await reservePort();
-  const mock = createMockAdminEngine(
-    options.state,
-    options.tickIntervalMs ?? 1000,
-    options.connectedAdapters,
-    options.enabledAdapters,
-  );
-  const handle = startAdminServer({
-    engine: mock.engine,
-    network: {
-      host: options.host ?? "127.0.0.1",
-      port,
-      tickIntervalMs: options.tickIntervalMs ?? 1000,
-    },
-    protocols: {
-      getLastTickProgressAt: () => mock.getLastTickProgressAt(),
-    },
-    auth: testAuth(),
-    ...(options.getLeExport ? { getLeExport: options.getLeExport } : {}),
-  });
-  handles.push(handle);
-  const baseUrl = serverBaseUrl(handle.endpoint);
-  return { mock, baseUrl };
-}
-
-async function startShutdownTestServer(handles: Array<{ stop: () => void }>): Promise<{
-  baseUrl: string;
-  getShutdownReason: () => string;
-}> {
-  const port = await reservePort();
-  const mock = createMockAdminEngine("running", 1000);
-  let shutdownReason = "";
-  const handle = startAdminServer({
-    engine: mock.engine,
-    network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
-    protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-    auth: testAuth(),
-    requestShutdown: (reason) => {
-      shutdownReason = reason;
-    },
-  });
-  handles.push(handle);
-  return { baseUrl: serverBaseUrl(handle.endpoint), getShutdownReason: () => shutdownReason };
-}
-
-describeIfTcp("admin server", () => {
-  const handles: Array<{ stop: () => void }> = [];
-
-  afterEach(() => {
-    for (const handle of handles) {
-      handle.stop();
-    }
-    handles.length = 0;
-  });
-
-  // --- Health endpoints (unauthenticated) ---
-
-  test.each([
-    {
-      label: "200 when running and mqtt connected",
-      state: "running" as const,
-      healthStatus: 200,
-      readyStatus: 200,
-      connectedAdapters: ["mqtt"] as string[],
-    },
-    { label: "503 when paused", state: "paused" as const, healthStatus: 200, readyStatus: 503 },
-  ])("/readyz returns $label", async ({ state, healthStatus, readyStatus, connectedAdapters }) => {
-    const { baseUrl } = await startTestServer(
-      {
-        state,
-        enabledAdapters: ["mqtt"],
-        connectedAdapters: connectedAdapters ?? [],
-      },
-      handles,
-    );
-
-    const health = await fetch(`${baseUrl}/healthz`);
-    const ready = await fetch(`${baseUrl}/readyz`);
-
-    expect(health.status).toBe(healthStatus);
-    expect(ready.status).toBe(readyStatus);
-  });
-
-  test("/readyz returns 503 when mqtt is enabled but disconnected", async () => {
-    const { baseUrl } = await startTestServer(
-      { state: "running", enabledAdapters: ["mqtt"] },
-      handles,
-    );
-
-    const ready = await fetch(`${baseUrl}/readyz`);
-    expect(ready.status).toBe(503);
-  });
-
-  test("/readyz returns 503 when opcua is enabled but disconnected", async () => {
-    const { baseUrl } = await startTestServer(
-      {
-        state: "running",
-        enabledAdapters: ["opcua"],
-      },
-      handles,
-    );
-
-    const ready = await fetch(`${baseUrl}/readyz`);
-    expect(ready.status).toBe(503);
-    const body = (await ready.json()) as { reason?: string };
-    expect(body.reason).toBe("opcua disconnected");
-  });
-
-  test("/readyz follows live adapter enablement instead of boot-time flags", async () => {
-    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
-
-    const initiallyReady = await fetch(`${baseUrl}/readyz`);
-    expect(initiallyReady.status).toBe(200);
-
-    mock.setEnabledAdapters(["mqtt"]);
-    const disconnected = await fetch(`${baseUrl}/readyz`);
-    expect(disconnected.status).toBe(503);
-
-    mock.setConnectedAdapters(["mqtt"]);
-    const connected = await fetch(`${baseUrl}/readyz`);
-    expect(connected.status).toBe(200);
-
-    mock.setEnabledAdapters([]);
-    mock.setConnectedAdapters([]);
-    const disabledAgain = await fetch(`${baseUrl}/readyz`);
-    expect(disabledAgain.status).toBe(200);
-  });
-
-  test("/healthz returns 503 on the first probe after running tick loop stalls", async () => {
-    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
-    mock.setLastTickProgressAt(performance.now() - 3_500);
-
-    const stalled = await fetch(`${baseUrl}/healthz`);
-    expect(stalled.status).toBe(503);
-
-    mock.setLastTickProgressAt(performance.now());
-    mock.setTickCount(1);
-    const recovered = await fetch(`${baseUrl}/healthz`);
-    expect(recovered.status).toBe(200);
-  });
-
-  // --- Protected endpoints (require session cookie) ---
-
-  test("GET /metrics returns the engine metrics snapshot", async () => {
-    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
-    mock.setTickCount(12);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/metrics`, {
-      headers: { cookie },
-    });
-    const body = (await response.json()) as {
-      core: { tickCount: number; state: EngineCoreMetrics["state"] };
-      simulationName: string;
-    };
-
-    expect(response.status).toBe(200);
-    expect(body.simulationName).toBe("test-sim");
-    expect(body.core.tickCount).toBe(12);
-    expect(body.core.state).toBe("running");
-  });
-
-  test("GET /state returns the engine state snapshot", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/state`, {
-      headers: { cookie },
-    });
-    const body = (await response.json()) as EngineStateSnapshot;
-
-    expect(response.status).toBe(200);
-    expect(body.simulationName).toBe("test-sim");
-    expect(body.config.tickIntervalMs).toBe(1000);
-  });
-
-  test("POST /commands validates and dispatches engine commands", async () => {
-    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/commands`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-      body: JSON.stringify({
-        type: "pause",
-        correlationId: "req-1",
-      }),
-    });
-    const body = (await response.json()) as CommandResult;
-
-    expect(response.status).toBe(200);
-    expect(body.success).toBe(true);
-    expect(body.command).toBe("pause");
-    expect(mock.getExecutedCommands()).toEqual([{ type: "pause", correlationId: "req-1" }]);
-  });
-
-  test("POST /commands requires session auth", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    // Without session cookie
-    const response = await fetch(`${baseUrl}/commands`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ type: "pause", correlationId: "req-1" }),
-    });
-    expect(response.status).toBe(401);
-  });
-
-  test("POST /commands returns 400 for invalid JSON", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/commands`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-      body: "{bad json",
-    });
-    const body = (await response.json()) as { message: string };
-
-    expect(response.status).toBe(400);
-    expect(body.message).toBe("Invalid JSON in command request body.");
-  });
-
-  test("POST /commands returns 400 for invalid command shape", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/commands`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-      body: JSON.stringify({ type: "setSpeed" }),
-    });
-    const body = (await response.json()) as CommandResult;
-
-    expect(response.status).toBe(400);
-    expect(body.success).toBe(false);
-    expect(body.command).toBe("setSpeed");
-  });
-
-  test.each([
-    { label: "missing host", suffix: "" },
-    { label: "blank host", suffix: "?host=%20%20%20" },
-  ])("GET /catalog/templates/:id/le-template.json returns 400 for $label", async ({ suffix }) => {
-    const { baseUrl } = await startTestServer(
-      {
-        state: "running",
-        getLeExport: async () => ({
-          templateJson: JSON.stringify({ ok: true }),
-          tagsCSV: "name,value\n",
-        }),
-      },
-      handles,
-    );
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(
-      `${baseUrl}/catalog/templates/smart-factory/le-template.json${suffix}`,
-      {
-        headers: { cookie },
-      },
-    );
-    const body = (await response.json()) as { message: string; error: string };
-
-    expect(response.status).toBe(400);
-    expect(body.message).toBe("Missing host query parameter.");
-    expect(body.error).toContain("?host=<hostname-or-ip>");
-  });
-
-  test("GET /catalog/templates/:id/le-template.json accepts a non-empty host", async () => {
-    const { baseUrl } = await startTestServer(
-      {
-        state: "running",
-        getLeExport: async (_id, { host }) => ({
-          templateJson: JSON.stringify({ host }),
-          tagsCSV: "name,value\n",
-        }),
-      },
-      handles,
-    );
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(
-      `${baseUrl}/catalog/templates/smart-factory/le-template.json?host=172.17.0.1`,
-      {
-        headers: { cookie },
-      },
-    );
-    const body = (await response.json()) as { host: string };
-
-    expect(response.status).toBe(200);
-    expect(body.host).toBe("172.17.0.1");
-  });
-
-  // --- Daemon mode endpoints ---
-
-  test("/readyz includes simulationName and runId when provided", async () => {
-    const port = await reservePort();
-    const mock = createMockAdminEngine("running", 1000);
-    const handle = startAdminServer({
-      engine: mock.engine,
-      network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
-      protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-      auth: testAuth(),
-      simulationName: "test-daemon",
-      runId: "run-abc-123",
-    });
-    handles.push(handle);
-    const baseUrl = serverBaseUrl(handle.endpoint);
-
-    const response = await fetch(`${baseUrl}/readyz`);
-    const body = (await response.json()) as Record<string, unknown>;
-
-    expect(response.status).toBe(200);
-    expect(body["simulationName"]).toBe("test-daemon");
-    expect(body["runId"]).toBe("run-abc-123");
-  });
-
-  test("/readyz omits simulationName and runId when not provided", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-
-    const response = await fetch(`${baseUrl}/readyz`);
-    const body = (await response.json()) as Record<string, unknown>;
-
-    expect(response.status).toBe(200);
-    expect(body["simulationName"]).toBeUndefined();
-    expect(body["runId"]).toBeUndefined();
-  });
-
-  test("POST /shutdown calls requestShutdown callback and returns 200", async () => {
-    const { baseUrl, getShutdownReason } = await startShutdownTestServer(handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/shutdown`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-      body: JSON.stringify({ reason: "miravo stop" }),
-    });
-    const body = (await response.json()) as Record<string, unknown>;
-
-    expect(response.status).toBe(200);
-    expect(body["status"]).toBe("shutting_down");
-    expect(getShutdownReason()).toBe("miravo stop");
-  });
-
-  test("POST /shutdown uses default reason when body is empty", async () => {
-    const { baseUrl, getShutdownReason } = await startShutdownTestServer(handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/shutdown`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-    });
-    expect(response.status).toBe(200);
-    expect(getShutdownReason()).toBe("remote shutdown request");
-  });
-
-  test("GET /shutdown returns 405", async () => {
-    const port = await reservePort();
-    const mock = createMockAdminEngine("running", 1000);
-    const handle = startAdminServer({
-      engine: mock.engine,
-      network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
-      protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-      auth: testAuth(),
-      requestShutdown: () => {},
-    });
-    handles.push(handle);
-    const baseUrl = serverBaseUrl(handle.endpoint);
-
-    const response = await fetch(`${baseUrl}/shutdown`);
-    expect(response.status).toBe(405);
-  });
-
-  test("POST /shutdown returns 501 when requestShutdown not provided", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-
-    const response = await fetch(`${baseUrl}/shutdown`, {
-      method: "POST",
-      headers: { cookie },
-    });
-    expect(response.status).toBe(501);
-  });
-
-  test("POST /shutdown requires session auth", async () => {
-    const { baseUrl } = await startShutdownTestServer(handles);
-    // Without session cookie
-    const noAuth = await fetch(`${baseUrl}/shutdown`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-    });
-    expect(noAuth.status).toBe(401);
-    // With session cookie
-    const cookie = await loginAndGetCookie(baseUrl);
-    const withAuth = await fetch(`${baseUrl}/shutdown`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-    });
-    expect(withAuth.status).toBe(200);
-  });
-
-  test("POST /commands accepts session auth", async () => {
-    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-    const response = await fetch(`${baseUrl}/commands`, {
-      method: "POST",
-      headers: { "content-type": "application/json", cookie },
-      body: JSON.stringify({ type: "pause", correlationId: "req-2" }),
-    });
-    const body = (await response.json()) as CommandResult;
-    expect(response.status).toBe(200);
-    expect(body.success).toBe(true);
-    expect(mock.getExecutedCommands()).toEqual([{ type: "pause", correlationId: "req-2" }]);
-  });
-
-  // --- Auth endpoint tests ---
-
-  test("POST /auth/login returns 200 with valid credentials", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const res = await fetch(`${baseUrl}/auth/login`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ username: "admin", password: "testpass" }),
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { ok: boolean; changePassword: boolean };
-    expect(body.ok).toBe(true);
-    expect(body.changePassword).toBe(false);
-    expect(res.headers.get("set-cookie")).toContain("miravo_session=");
-  });
-
-  test("POST /auth/login returns 401 with invalid credentials", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const res = await fetch(`${baseUrl}/auth/login`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ username: "admin", password: "wrong" }),
-    });
-    expect(res.status).toBe(401);
-  });
-
-  test("GET /auth/status returns authenticated with valid session", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-    const res = await fetch(`${baseUrl}/auth/status`, { headers: { cookie } });
-    const body = (await res.json()) as { authenticated: boolean; username?: string };
-    expect(body.authenticated).toBe(true);
-    expect(body.username).toBe("admin");
-  });
-
-  test("GET /auth/status returns unauthenticated without session", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const res = await fetch(`${baseUrl}/auth/status`);
-    const body = (await res.json()) as { authenticated: boolean };
-    expect(body.authenticated).toBe(false);
-  });
-
-  test("GET /bootstrap returns unauthenticated without session", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const res = await fetch(`${baseUrl}/bootstrap`);
-    expect(res.status).toBe(200);
-    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
-    expect(parsed.success).toBe(true);
-    expect(parsed.data).toEqual({ authenticated: false });
-  });
-
-  test("GET /bootstrap returns auth plus canonical runtime snapshot with valid session", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const cookie = await loginAndGetCookie(baseUrl);
-    const res = await fetch(`${baseUrl}/bootstrap`, { headers: { cookie } });
-    expect(res.status).toBe(200);
-    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
-    expect(parsed.success).toBe(true);
-    if (!parsed.success || !parsed.data.authenticated) {
-      throw new Error("Expected authenticated bootstrap payload.");
-    }
-    expect(parsed.data.username).toBe("admin");
-    expect(parsed.data.runtime.state.instances.length).toBeGreaterThanOrEqual(0);
-    expect(parsed.data.runtime.metrics.core.state).toBe("running");
-    expect(Array.isArray(parsed.data.runtime.runningTemplates)).toBe(true);
-    expect(typeof parsed.data.runtime.revision).toBe("number");
-  });
-
-  test("GET /state requires session auth", async () => {
-    const { baseUrl } = await startTestServer({ state: "running" }, handles);
-    const res = await fetch(`${baseUrl}/state`);
-    expect(res.status).toBe(401);
-  });
-});
-
-describeIfTcp("anonymous mode (--no-auth)", () => {
-  const handles: Array<{ stop: () => void }> = [];
-  afterEach(() => {
-    for (const h of handles) h.stop();
-    handles.length = 0;
-  });
-
-  async function startAnonServer() {
-    const port = await reservePort();
-    const mock = createMockAdminEngine("running", 1000);
-    const handle = startAdminServer({
-      engine: mock.engine,
-      network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
-      protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-      auth: { ...testAuth(), anonymousMode: true },
-    });
-    handles.push(handle);
-    return { baseUrl: serverBaseUrl(handle.endpoint) };
-  }
-
-  test("GET /bootstrap returns authenticated:true without a session cookie", async () => {
-    const { baseUrl } = await startAnonServer();
-    const res = await fetch(`${baseUrl}/bootstrap`);
-    expect(res.status).toBe(200);
-    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
-    expect(parsed.success).toBe(true);
-    if (!parsed.success || !parsed.data.authenticated) {
-      throw new Error("Expected authenticated bootstrap payload.");
-    }
-    expect(parsed.data.username).toBe("anonymous");
-    expect(parsed.data.runtime.metrics.core.state).toBe("running");
-  });
-
-  test("GET /state succeeds without a session cookie", async () => {
-    const { baseUrl } = await startAnonServer();
-    const res = await fetch(`${baseUrl}/state`);
-    expect(res.status).toBe(200);
-  });
-
-  test("POST /auth/login succeeds with any credentials", async () => {
-    const { baseUrl } = await startAnonServer();
-    const res = await fetch(`${baseUrl}/auth/login`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ username: "whoever", password: "anything" }),
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { ok: boolean; changePassword: boolean };
-    expect(body.ok).toBe(true);
-    expect(body.changePassword).toBe(false);
-  });
-
-  test("GET /auth/status returns authenticated:true without a session cookie", async () => {
-    const { baseUrl } = await startAnonServer();
-    const res = await fetch(`${baseUrl}/auth/status`);
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { authenticated: boolean; username?: string };
-    expect(body.authenticated).toBe(true);
-    expect(body.username).toBe("anonymous");
-  });
-});