fix(auth): honor HTTPS sessions in Pi management

backend/test/auth-test-fixtures.ts

@@ -13,14 +13,21 @@ export const localPublicUrl = "http://127.0.0.1:8787";
 
 export interface LocalAuthFixture {
   app: FastifyInstance;
+  publicUrl: string;
   cookie: string;
   csrfToken: string;
+  loginStatus: number;
+  meStatus: number;
   downstreamHits(): number;
   resetDownstreamHits(): void;
   sessionHeaders(overrides?: Record<string, string | undefined>): Record<string, string>;
   close(): Promise<void>;
 }
 
+export interface LocalAuthFixtureOptions {
+  publicUrl?: string;
+}
+
 function firstSetCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
   const header = response.headers["set-cookie"];
   return Array.isArray(header) ? header[0] ?? "" : header ?? "";
@@ -31,7 +38,12 @@ function cookiePair(setCookie: string): string {
 }
 
 /** Creates a production-local app and authenticates through the real login/session boundary. */
-export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<LocalAuthFixture> {
+export async function createLocalAuthFixture(
+  deps?: BuildAppDeps,
+  options: LocalAuthFixtureOptions = {},
+): Promise<LocalAuthFixture> {
+  const publicUrl = options.publicUrl ?? localPublicUrl;
+  const publicOrigin = new URL(publicUrl).origin;
   const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-fixture-"));
   chmodSync(directory, 0o700);
   const authConfigFile = join(directory, "auth.yaml");
@@ -39,7 +51,7 @@ export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<Local
   writeFileSync(authConfigFile, stringify({
     version: 1,
     mode: "local",
-    publicUrl: localPublicUrl,
+    publicUrl,
     local: { usersFile: "users.yaml" },
   }), { encoding: "utf8", mode: 0o600 });
   writeFileSync(usersFile, [
@@ -70,7 +82,7 @@ export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<Local
     const signedIn = await app.inject({
       method: "POST",
       url: "/auth/local/login",
-      headers: { origin: localPublicUrl, "sec-fetch-site": "same-origin" },
+      headers: { origin: publicOrigin, "sec-fetch-site": "same-origin" },
       payload: { username: "Admin", password: localPassword },
     });
     if (signedIn.statusCode !== 200) throw new Error("local_auth_fixture_login_failed");
@@ -82,14 +94,17 @@ export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<Local
 
     return {
       app,
+      publicUrl,
       cookie,
       csrfToken,
+      loginStatus: signedIn.statusCode,
+      meStatus: me.statusCode,
       downstreamHits: () => downstream,
       resetDownstreamHits: () => { downstream = 0; },
       sessionHeaders(overrides = {}) {
         const headers: Record<string, string> = {
           cookie,
-          origin: localPublicUrl,
+          origin: publicOrigin,
           "sec-fetch-site": "same-origin",
           "x-thothii-csrf": csrfToken,
         };