feat(auth): load immutable runtime projection snapshots

backend/test/local-registry.test.ts

@@ -56,7 +56,7 @@ vi.mock("node:fs", async (importOriginal) => {
   };
 });
 
-import { createLocalUserRegistry } from "../src/auth/local-registry.js";
+import { createCurrentLocalUserRegistryResolver, createLocalUserRegistry } from "../src/auth/local-registry.js";
 
 const password = "correct horse battery staple";
 const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
@@ -136,6 +136,44 @@ async function expectInvalid(operation: Promise<unknown>, secrets: string[] = []
 }
 
 describe("local user registry", () => {
+  test("resolves a projected local registry from its frozen in-memory users", async () => {
+    const resolver = createCurrentLocalUserRegistryResolver();
+    const users = Object.freeze([Object.freeze({
+      id: adminId,
+      username: "ProjectedAdmin",
+      normalizedUsername: "projectedadmin",
+      passwordHash,
+      roles: Object.freeze(["admin"] as const),
+      enabled: true,
+      authRevision: 1,
+    })]);
+    const loaded = {
+      value: {
+        version: 1 as const,
+        mode: "local" as const,
+        publicUrl: "http://127.0.0.1:8080",
+        session: {
+          regularTtlSeconds: 1,
+          regularIdleSeconds: 1,
+          rememberTtlSeconds: 1,
+          rememberIdleSeconds: 1,
+          oidcTtlSeconds: 1,
+        },
+        local: { usersFile: "users.yaml" },
+      },
+      revision: "sha256:synthetic",
+      sourcePath: "/definitely/not/opened/auth.yaml",
+      runtimeProjection: Object.freeze({
+        generation: "a".repeat(64),
+        canonicalRevision: `sha256:${"a".repeat(64)}`,
+        localUsers: users,
+      }),
+    };
+    const registry = resolver.resolve(loaded);
+    await expect(registry?.findByUsername("PROJECTEDADMIN")).resolves.toMatchObject({ id: adminId });
+    await expect(registry?.verify(await registry?.findByUsername("projectedadmin"), password)).resolves.toBe(true);
+  });
+
   test("reads known fields, performs case-insensitive lookup, and verifies passwords", async () => {
     const fixture = writeRegistry(registryYaml(userYaml({ displayName: "Local administrator" })));
     const registry = createLocalUserRegistry(fixture.path);