sync: update from private repo (a360d15)

src/bridge/console-ws-api.test.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import Database from 'better-sqlite3';
 import express from 'express';
 import request from 'supertest';
-import { decideAccess, handleConsoleSocket, createConsoleStatusRouter } from './console-ws-api.js';
+import { decideAccess, handleConsoleSocket, createConsoleStatusRouter, createConsoleSessionRouter } from './console-ws-api.js';
 import { runMigrations } from '../db/migrate.js';
 import { createAccessResolver } from '../ssh/access.js';
 import { createGrantsRepo } from '../ssh/grants-repo.js';
@@ -353,4 +353,57 @@ describe('createConsoleStatusRouter', () => {
     const res = await request(app).get('/api/local/tasks/t1/console/status');
     expect(res.status).toBe(401);
   });
+
+  it('no-auth (authActive=false): synthesizes a local admin user instead of 401', async () => {
+    let seenUser: any;
+    const app = express();
+    app.use('/api', createConsoleStatusRouter({
+      registry: { get: () => null } as any,
+      requireAuth: (_req: any, _res: any, next: any) => next(),
+      resolveTask: async (_id: string, user: any) => { seenUser = user; return null; },
+      authActive: false,
+    }));
+    const res = await request(app).get('/api/local/tasks/t1/console/status');
+    // 200 active=false (task not visible shape), NOT 401 — the synthetic user
+    // cleared the auth guard. admin role makes null-owner no-auth tasks visible.
+    expect(res.status).toBe(200);
+    expect(seenUser).toEqual({ id: 'local', role: 'admin', orgIds: [] });
+  });
+});
+
+describe('createConsoleSessionRouter', () => {
+  it('no-auth (authActive=false): synthesizes a local admin user instead of 401', async () => {
+    let seenUser: any;
+    const app = express();
+    app.use(express.json());
+    app.use('/api', createConsoleSessionRouter({
+      sub: {} as any,
+      preflight: {} as any,
+      requireAuth: (_req: any, _res: any, next: any) => next(),
+      resolveTask: async (_id: string, user: any) => { seenUser = user; return null; },
+      authActive: false,
+    }));
+    const res = await request(app)
+      .post('/api/local/tasks/t1/console/session')
+      .send({ connection_id: 'c1' });
+    // 404 task_not_found (resolveTask returned null), NOT 401 — proves the
+    // synthetic user passed the auth guard before task resolution.
+    expect(res.status).toBe(404);
+    expect(seenUser).toEqual({ id: 'local', role: 'admin', orgIds: [] });
+  });
+
+  it('still returns 401 when auth is active and there is no user', async () => {
+    const app = express();
+    app.use(express.json());
+    app.use('/api', createConsoleSessionRouter({
+      sub: {} as any,
+      preflight: {} as any,
+      requireAuth: (_req: any, _res: any, next: any) => next(),
+      resolveTask: async () => null,
+    }));
+    const res = await request(app)
+      .post('/api/local/tasks/t1/console/session')
+      .send({ connection_id: 'c1' });
+    expect(res.status).toBe(401);
+  });
 });