onbuzz 3.9.2 → 3.9.5

package/src/interfaces/__tests__/authRoutes.test.js

@@ -1,8 +1,9 @@
 /**
  * Tests for in-app OAuth auth routes from webServer.js:
  *   - GET  /auth/callback        — portal redirect lands here with token+user
- *   - GET  /api/auth/status      — current auth state
- *   - POST /api/auth/signout     — clear stored credentials
+ *   - GET  /api/auth/status      — current auth state (enhanced: returns user, supports ?since=)
+ *   - GET  /api/auth/resolve     — resolve user from API key via remote backend /auth/me
+ *   - POST /api/auth/signout     — clear stored credentials + cached auth
  *   - GET  /api/health/cloud     — Azure backend health check
  *
  * Uses a real HTTP server + fetch (same harness pattern as imageServing.test.js)
@@ -13,8 +14,11 @@ import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals
 import express from 'express';
 import { createServer } from 'http';
 
-// Replicate the exact route handlers from webServer.js, accepting deps as args
-function buildAuthApp({ apiKeyManager, broadcastToSession, config, logger, fetchImpl }) {
+/**
+ * Build a minimal Express app replicating the auth route handlers from webServer.js.
+ * `ctx` is a mutable object that holds the lastAuthResult state (simulating `this`).
+ */
+function buildAuthApp({ apiKeyManager, broadcastToSession, config, logger, fetchImpl, ctx }) {
   const app = express();
   app.use(express.json());
 
@@ -52,6 +56,12 @@ function buildAuthApp({ apiKeyManager, broadcastToSession, config, logger, fetch
         await apiKeyManager.setKeys(null, { loxiaApiKey: apiKey });
       }
 
+      ctx.lastAuthResult = {
+        user: userInfo,
+        hasApiKey: !!apiKey,
+        timestamp: new Date().toISOString()
+      };
+
       broadcastToSession(null, {
         type: 'auth_success',
         data: {
@@ -72,18 +82,64 @@ function buildAuthApp({ apiKeyManager, broadcastToSession, config, logger, fetch
   // ── /api/auth/status ───────────────────────────────────────────
   app.get('/api/auth/status', (req, res) => {
     const hasApiKey = !!(apiKeyManager?.getKeysForRequest?.(null, { platformProvided: true })?.loxiaApiKey);
+
+    let user = ctx.lastAuthResult?.user || null;
+
+    const since = req.query.since;
+    if (since && ctx.lastAuthResult?.timestamp) {
+      if (new Date(ctx.lastAuthResult.timestamp) <= new Date(since)) {
+        user = null;
+      }
+    }
+
     res.json({
       success: true,
-      authenticated: hasApiKey
+      authenticated: hasApiKey,
+      user,
+      timestamp: ctx.lastAuthResult?.timestamp || null
     });
   });
 
+  // ── /api/auth/resolve ──────────────────────────────────────────
+  app.get('/api/auth/resolve', async (req, res) => {
+    try {
+      const loxiaApiKey = apiKeyManager?.getKeysForRequest?.(null, { platformProvided: true })?.loxiaApiKey;
+      if (!loxiaApiKey) {
+        return res.json({ success: true, user: null, reason: 'no_api_key' });
+      }
+
+      const backendBaseUrl = config?.backend?.baseUrl || 'https://autopilot-api.azurewebsites.net';
+      const response = await fetchImpl(`${backendBaseUrl}/auth/me`, {
+        headers: { 'Authorization': `Bearer ${loxiaApiKey}` }
+      });
+
+      if (!response.ok) {
+        return res.json({ success: true, user: null, reason: 'backend_error', status: response.status });
+      }
+
+      const data = await response.json();
+      const user = data.user || data;
+
+      ctx.lastAuthResult = {
+        user,
+        hasApiKey: true,
+        timestamp: new Date().toISOString()
+      };
+
+      res.json({ success: true, user });
+    } catch (error) {
+      logger?.warn?.('Failed to resolve user from API key', { error: error.message });
+      res.json({ success: true, user: null, reason: 'fetch_error', error: error.message });
+    }
+  });
+
   // ── /api/auth/signout ──────────────────────────────────────────
   app.post('/api/auth/signout', async (req, res) => {
     try {
       if (apiKeyManager) {
         await apiKeyManager.removeKeys(null);
       }
+      ctx.lastAuthResult = null;
       broadcastToSession(null, {
         type: 'auth_signout',
         data: { timestamp: new Date().toISOString() }
@@ -145,27 +201,26 @@ describe('Auth Routes (webServer.js)', () => {
   let broadcastToSession;
   let logger;
   let server;
+  let ctx;
 
   beforeEach(() => {
     mockFetch = jest.fn();
     broadcasts = [];
     broadcastToSession = jest.fn((sessionId, msg) => broadcasts.push({ sessionId, msg }));
-    logger = {
-      warn: jest.fn(),
-      error: jest.fn(),
-      info: jest.fn()
-    };
+    logger = { warn: jest.fn(), error: jest.fn(), info: jest.fn() };
     server = null;
+    ctx = { lastAuthResult: null };
   });
 
   afterEach(() => {
     if (server) server.close();
   });
 
+  // ── /auth/callback ───────────────────────────────────────────────
   describe('GET /auth/callback', () => {
     it('returns 400 HTML when token is missing', async () => {
       const apiKeyManager = makeApiKeyManager();
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
@@ -177,7 +232,7 @@ describe('Auth Routes (webServer.js)', () => {
       expect(broadcastToSession).not.toHaveBeenCalled();
     });
 
-    it('decodes user info, generates API key, stores it, and broadcasts auth_success', async () => {
+    it('decodes user info, generates API key, caches auth result, and broadcasts', async () => {
       const apiKeyManager = makeApiKeyManager();
       mockFetch.mockResolvedValueOnce({
         ok: true,
@@ -185,11 +240,9 @@ describe('Auth Routes (webServer.js)', () => {
       });
 
       const app = buildAuthApp({
-        apiKeyManager,
-        broadcastToSession,
+        apiKeyManager, broadcastToSession,
         config: { backend: { baseUrl: 'https://test-backend.example.com' } },
-        logger,
-        fetchImpl: mockFetch
+        logger, fetchImpl: mockFetch, ctx
       });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
@@ -198,236 +251,255 @@ describe('Auth Routes (webServer.js)', () => {
       const res = await fetch(`${baseUrl}/auth/callback?token=jwt-abc&user=${encodeUser(userInfo)}`);
 
       expect(res.status).toBe(200);
-      const text = await res.text();
-      expect(text).toContain('Authenticated!');
-
-      // Verify backend was called with the JWT
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-      const fetchCall = mockFetch.mock.calls[0];
-      expect(fetchCall[0]).toBe('https://test-backend.example.com/auth/apikey');
-      expect(fetchCall[1].method).toBe('POST');
-      expect(fetchCall[1].headers.Authorization).toBe('Bearer jwt-abc');
+      expect(await res.text()).toContain('Authenticated!');
 
       // Verify API key was stored
       expect(apiKeyManager.setKeys).toHaveBeenCalledWith(null, { loxiaApiKey: 'lx_generated_key_123' });
 
       // Verify broadcast
-      expect(broadcastToSession).toHaveBeenCalledTimes(1);
       const broadcast = broadcasts[0];
-      expect(broadcast.sessionId).toBeNull();
       expect(broadcast.msg.type).toBe('auth_success');
       expect(broadcast.msg.data.user).toEqual(userInfo);
       expect(broadcast.msg.data.jwt).toBe('jwt-abc');
       expect(broadcast.msg.data.hasApiKey).toBe(true);
-      expect(broadcast.msg.data.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+
+      // Verify lastAuthResult was cached
+      expect(ctx.lastAuthResult).toBeDefined();
+      expect(ctx.lastAuthResult.user).toEqual(userInfo);
+      expect(ctx.lastAuthResult.hasApiKey).toBe(true);
+      expect(ctx.lastAuthResult.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
     });
 
-    it('still broadcasts auth_success when API key generation fails (degraded mode)', async () => {
+    it('still caches and broadcasts when API key generation fails', async () => {
       const apiKeyManager = makeApiKeyManager();
       mockFetch.mockRejectedValueOnce(new Error('Backend down'));
 
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/auth/callback?token=jwt-x&user=${encodeUser({ id: 'u1' })}`);
-      expect(res.status).toBe(200);
-      expect(apiKeyManager.setKeys).not.toHaveBeenCalled();
-      expect(broadcastToSession).toHaveBeenCalled();
-      const data = broadcasts[0].msg.data;
-      expect(data.hasApiKey).toBe(false);
-      expect(data.jwt).toBe('jwt-x');
-      expect(logger.warn).toHaveBeenCalled();
+      await fetch(`${baseUrl}/auth/callback?token=jwt-x&user=${encodeUser({ id: 'u1' })}`);
+      expect(ctx.lastAuthResult.hasApiKey).toBe(false);
+      expect(ctx.lastAuthResult.user).toEqual({ id: 'u1' });
     });
+  });
 
-    it('handles malformed user base64 gracefully (empty userInfo)', async () => {
-      const apiKeyManager = makeApiKeyManager();
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ apiKey: { key: 'lx_k' } })
-      });
+  // ── /api/auth/status (enhanced) ──────────────────────────────────
+  describe('GET /api/auth/status', () => {
+    it('returns authenticated=false and user=null when no key and no cached auth', async () => {
+      const apiKeyManager = makeApiKeyManager(null);
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+
+      const body = await (await fetch(`${baseUrl}/api/auth/status`)).json();
+      expect(body.success).toBe(true);
+      expect(body.authenticated).toBe(false);
+      expect(body.user).toBeNull();
+      expect(body.timestamp).toBeNull();
+    });
+
+    it('returns cached user after a successful auth callback', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_k');
+      ctx.lastAuthResult = { user: { email: 'cached@test.com' }, hasApiKey: true, timestamp: '2026-01-01T00:00:00.000Z' };
 
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/auth/callback?token=jwt&user=not-valid-base64@@@`);
-      expect(res.status).toBe(200);
-      expect(broadcasts[0].msg.data.user).toEqual({});
-      expect(broadcasts[0].msg.data.jwt).toBe('jwt');
+      const body = await (await fetch(`${baseUrl}/api/auth/status`)).json();
+      expect(body.authenticated).toBe(true);
+      expect(body.user.email).toBe('cached@test.com');
+      expect(body.timestamp).toBe('2026-01-01T00:00:00.000Z');
     });
 
-    it('uses default backend URL when config.backend.baseUrl missing', async () => {
-      const apiKeyManager = makeApiKeyManager();
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ apiKey: { key: 'lx_k' } })
-      });
+    it('?since= returns user when auth happened AFTER the given timestamp', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_k');
+      ctx.lastAuthResult = { user: { email: 'new@test.com' }, hasApiKey: true, timestamp: '2026-04-12T12:00:00.000Z' };
 
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      await fetch(`${baseUrl}/auth/callback?token=jwt&user=${encodeUser({})}`);
-      expect(mockFetch.mock.calls[0][0]).toBe('https://autopilot-api.azurewebsites.net/auth/apikey');
+      // Auth happened AFTER since → user should be returned
+      const body = await (await fetch(`${baseUrl}/api/auth/status?since=2026-04-12T11:59:00.000Z`)).json();
+      expect(body.user.email).toBe('new@test.com');
     });
 
-    it('does not store key when backend returns no apiKey field', async () => {
-      const apiKeyManager = makeApiKeyManager();
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ message: 'no key' })
-      });
+    it('?since= returns user=null when auth happened BEFORE the given timestamp', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_k');
+      ctx.lastAuthResult = { user: { email: 'old@test.com' }, hasApiKey: true, timestamp: '2026-04-12T10:00:00.000Z' };
 
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      await fetch(`${baseUrl}/auth/callback?token=jwt&user=${encodeUser({})}`);
-      expect(apiKeyManager.setKeys).not.toHaveBeenCalled();
-      expect(broadcasts[0].msg.data.hasApiKey).toBe(false);
+      // Auth happened BEFORE since → user should NOT be returned
+      const body = await (await fetch(`${baseUrl}/api/auth/status?since=2026-04-12T11:00:00.000Z`)).json();
+      expect(body.user).toBeNull();
+      expect(body.authenticated).toBe(true); // Still has key
     });
   });
 
-  describe('GET /api/auth/status', () => {
-    it('returns authenticated=false when no API key stored', async () => {
+  // ── /api/auth/resolve ────────────────────────────────────────────
+  describe('GET /api/auth/resolve', () => {
+    it('returns user=null with reason when no API key stored', async () => {
       const apiKeyManager = makeApiKeyManager(null);
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/auth/status`);
-      expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = await (await fetch(`${baseUrl}/api/auth/resolve`)).json();
       expect(body.success).toBe(true);
-      expect(body.authenticated).toBe(false);
+      expect(body.user).toBeNull();
+      expect(body.reason).toBe('no_api_key');
+      expect(mockFetch).not.toHaveBeenCalled();
     });
 
-    it('returns authenticated=true when an API key is present', async () => {
-      const apiKeyManager = makeApiKeyManager('lx_existing_key');
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+    it('calls backend /auth/me and returns + caches user when successful', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_my_key');
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ user: { id: 'u1', email: 'resolved@test.com', firstName: 'Resolved' } })
+      });
+
+      const app = buildAuthApp({
+        apiKeyManager, broadcastToSession,
+        config: { backend: { baseUrl: 'https://api.example.com' } },
+        logger, fetchImpl: mockFetch, ctx
+      });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/auth/status`);
-      const body = await res.json();
-      expect(body.authenticated).toBe(true);
+      const body = await (await fetch(`${baseUrl}/api/auth/resolve`)).json();
+      expect(body.success).toBe(true);
+      expect(body.user.email).toBe('resolved@test.com');
+
+      // Verify backend was called with the API key
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      expect(mockFetch.mock.calls[0][0]).toBe('https://api.example.com/auth/me');
+      expect(mockFetch.mock.calls[0][1].headers.Authorization).toBe('Bearer lx_my_key');
+
+      // Verify cached
+      expect(ctx.lastAuthResult.user.email).toBe('resolved@test.com');
+      expect(ctx.lastAuthResult.hasApiKey).toBe(true);
+    });
+
+    it('returns user=null when backend returns non-OK (e.g. 401 invalid key)', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_bad_key');
+      mockFetch.mockResolvedValueOnce({ ok: false, status: 401 });
+
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+
+      const body = await (await fetch(`${baseUrl}/api/auth/resolve`)).json();
+      expect(body.user).toBeNull();
+      expect(body.reason).toBe('backend_error');
+      expect(body.status).toBe(401);
+    });
+
+    it('returns user=null when fetch throws (network error)', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_key');
+      mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED'));
+
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+
+      const body = await (await fetch(`${baseUrl}/api/auth/resolve`)).json();
+      expect(body.user).toBeNull();
+      expect(body.reason).toBe('fetch_error');
+      expect(body.error).toBe('ECONNREFUSED');
+    });
+
+    it('uses default backend URL when config missing', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_key');
+      mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({ user: { id: '1' } }) });
+
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+
+      await fetch(`${baseUrl}/api/auth/resolve`);
+      expect(mockFetch.mock.calls[0][0]).toBe('https://autopilot-api.azurewebsites.net/auth/me');
     });
   });
 
+  // ── /api/auth/signout ────────────────────────────────────────────
   describe('POST /api/auth/signout', () => {
-    it('clears API key and broadcasts auth_signout', async () => {
+    it('clears API key, cached auth, and broadcasts auth_signout', async () => {
       const apiKeyManager = makeApiKeyManager('lx_signed_in');
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      ctx.lastAuthResult = { user: { email: 'a@b.com' }, hasApiKey: true, timestamp: '2026-01-01T00:00:00Z' };
+
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/auth/signout`, { method: 'POST' });
-      expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = await (await fetch(`${baseUrl}/api/auth/signout`, { method: 'POST' })).json();
       expect(body.success).toBe(true);
       expect(apiKeyManager.removeKeys).toHaveBeenCalledWith(null);
       expect(apiKeyManager._peek()).toBeNull();
-      expect(broadcasts).toHaveLength(1);
+      expect(ctx.lastAuthResult).toBeNull();
       expect(broadcasts[0].msg.type).toBe('auth_signout');
     });
 
     it('returns 500 when removeKeys throws', async () => {
-      const apiKeyManager = {
-        removeKeys: jest.fn().mockRejectedValue(new Error('vault locked'))
-      };
-      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const apiKeyManager = { removeKeys: jest.fn().mockRejectedValue(new Error('vault locked')) };
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
       const res = await fetch(`${baseUrl}/api/auth/signout`, { method: 'POST' });
       expect(res.status).toBe(500);
       const body = await res.json();
-      expect(body.success).toBe(false);
       expect(body.error).toBe('vault locked');
     });
   });
 
+  // ── /api/health/cloud ────────────────────────────────────────────
   describe('GET /api/health/cloud', () => {
     it('returns online=true with backend payload when health 200', async () => {
       mockFetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ status: 'OK', uptime: 123 })
+        ok: true, json: () => Promise.resolve({ status: 'OK', uptime: 123 })
       });
 
       const app = buildAuthApp({
-        apiKeyManager: makeApiKeyManager(),
-        broadcastToSession,
+        apiKeyManager: makeApiKeyManager(), broadcastToSession,
         config: { backend: { healthUrl: 'https://api.example.com/health' } },
-        logger,
-        fetchImpl: mockFetch
+        logger, fetchImpl: mockFetch, ctx
       });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/health/cloud`);
-      expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = await (await fetch(`${baseUrl}/api/health/cloud`)).json();
       expect(body.success).toBe(true);
       expect(body.online).toBe(true);
       expect(body.backend.status).toBe('OK');
-      expect(mockFetch.mock.calls[0][0]).toBe('https://api.example.com/health');
     });
 
     it('returns online=false when backend returns non-OK', async () => {
       mockFetch.mockResolvedValueOnce({ ok: false, status: 503 });
 
-      const app = buildAuthApp({
-        apiKeyManager: makeApiKeyManager(),
-        broadcastToSession,
-        config: {},
-        logger,
-        fetchImpl: mockFetch
-      });
+      const app = buildAuthApp({ apiKeyManager: makeApiKeyManager(), broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/health/cloud`);
-      const body = await res.json();
-      expect(body.success).toBe(false);
+      const body = await (await fetch(`${baseUrl}/api/health/cloud`)).json();
       expect(body.online).toBe(false);
       expect(body.error).toContain('503');
     });
 
-    it('returns online=false when fetch throws (network error)', async () => {
+    it('returns online=false when fetch throws', async () => {
       mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED'));
 
-      const app = buildAuthApp({
-        apiKeyManager: makeApiKeyManager(),
-        broadcastToSession,
-        config: {},
-        logger,
-        fetchImpl: mockFetch
-      });
+      const app = buildAuthApp({ apiKeyManager: makeApiKeyManager(), broadcastToSession, config: {}, logger, fetchImpl: mockFetch, ctx });
       const { server: s, baseUrl } = await startServer(app);
       server = s;
 
-      const res = await fetch(`${baseUrl}/api/health/cloud`);
-      const body = await res.json();
+      const body = await (await fetch(`${baseUrl}/api/health/cloud`)).json();
       expect(body.online).toBe(false);
       expect(body.error).toBe('ECONNREFUSED');
     });
-
-    it('uses default health URL when config missing', async () => {
-      mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({}) });
-
-      const app = buildAuthApp({
-        apiKeyManager: makeApiKeyManager(),
-        broadcastToSession,
-        config: {},
-        logger,
-        fetchImpl: mockFetch
-      });
-      const { server: s, baseUrl } = await startServer(app);
-      server = s;
-
-      await fetch(`${baseUrl}/api/health/cloud`);
-      expect(mockFetch.mock.calls[0][0]).toBe('https://autopilot-api.azurewebsites.net/health');
-    });
   });
 });