fix: render registry workspaces for harness

backend/test/auth.test.ts

@@ -1,10 +1,37 @@
 import { test, expect } from "vitest";
 import Fastify from "fastify";
 import { authPreHandler, getPrincipal } from "../src/auth/auth.js";
-import { chmodSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { chmodSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { expandLocalHome, localPrincipal } from "../src/auth/principal.js";
+import { expandLocalHome, localPrincipal, upstreamPrincipal } from "../src/auth/principal.js";
+
+test("server smoke trusted claims transform through nginx to a non-admin principal", () => {
+  const smoke = readFileSync("../scripts/unified-deployment-smoke.sh", "utf8");
+  const nginx = readFileSync("../docker/nginx.conf.template", "utf8");
+  const helper = smoke.match(/task13_server_auth_headers\(\) \{([\s\S]*?)\n\}/)?.[1] ?? "";
+  const trusted = Object.fromEntries(
+    [...helper.matchAll(/-H '([^:']+): ([^']+)'/g)].map((match) => [match[1].toLowerCase(), match[2]]),
+  );
+  const normalized: Record<string, string> = {};
+  for (const [header, suffix] of [
+    ["x-thoth-principal-issuer", "principal_issuer"],
+    ["x-thoth-principal-subject", "principal_subject"],
+    ["x-thoth-principal-display-name", "principal_display_name"],
+    ["x-thoth-is-admin", "is_admin"],
+  ]) {
+    expect(nginx).toContain(`$http_x_thoth_trusted_${suffix}`);
+    const value = trusted[`x-thoth-trusted-${header.slice("x-thoth-".length)}`];
+    if (value !== undefined) normalized[header] = value;
+  }
+
+  expect(upstreamPrincipal(normalized)).toEqual({
+    issuer: "task13-proxy",
+    subject: "task13-user",
+    displayName: "Task 13 User",
+    isAdmin: false,
+  });
+});
 
 test("local mode resolves a stable local principal", async () => {
   const app = Fastify();