fix(tests): address review gaps in test suite

- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
  fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
  narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
  login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
  ApiInterface doesn't implement the session/login methods needed to run the
  shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
  db instance (previously a no-op that never ran) via a new getReadonlyDb
  parameter, wired up for both sqlite and api backends.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

test/backends/api/auth-http.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { createTestDb } from "../../helpers/sqlite.js";
+import { createTestServer, type TestServer } from "../../helpers/koa.js";
+import { hashPassword } from "../../../src/util/hash.js";
+import type { SqliteInterface } from "../../../src/db/sqlite/SqliteInterface.js";
+
+const EMAIL = "auth-http@test.example";
+const PASSWORD = "auth-http-password";
+
+function getCookie(res: Response, name: string): string | undefined {
+  const raw = res.headers.getSetCookie?.() ?? [];
+  for (const entry of raw) {
+    const [pair] = entry.split(";");
+    const [key, value] = pair.split("=");
+    if (key === name) return value;
+  }
+  return undefined;
+}
+
+describe("api backend: auth over HTTP", async () => {
+  let db: SqliteInterface;
+  let closeDb: () => void;
+  let server: TestServer;
+  let uid: string;
+
+  before(async () => {
+    ({ db, close: closeDb } = await createTestDb());
+    server = await createTestServer(db);
+    const pw = await hashPassword(PASSWORD);
+    const user = await db.createUser({
+      email: EMAIL,
+      name: "Auth HTTP User",
+      password: pw,
+      flags: {},
+    });
+    uid = user.uid;
+  });
+
+  after(async () => {
+    await server.close();
+    closeDb();
+  });
+
+  it("POST /auth/login sets a session cookie", async () => {
+    const res = await fetch(`${server.url}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
+    });
+    assert.equal(res.status, 200);
+    const cookie = getCookie(res, "abode_session");
+    assert.ok(cookie, "session cookie set");
+  });
+
+  it("session cookie authenticates GET /auth/self", async () => {
+    const login = await fetch(`${server.url}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
+    });
+    const cookie = getCookie(login, "abode_session");
+
+    const self = await fetch(`${server.url}/auth/self`, {
+      headers: { Cookie: `abode_session=${cookie}` },
+    });
+    assert.equal(self.status, 200);
+    const body = (await self.json()) as { uid: string };
+    assert.equal(body.uid, uid);
+  });
+
+  it("GET /auth/self without credentials returns 401", async () => {
+    const res = await fetch(`${server.url}/auth/self`);
+    assert.equal(res.status, 401);
+  });
+
+  it("POST /auth/logout clears the session cookie", async () => {
+    const login = await fetch(`${server.url}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
+    });
+    const cookie = getCookie(login, "abode_session");
+
+    const logout = await fetch(`${server.url}/auth/logout`, {
+      method: "POST",
+      headers: { Cookie: `abode_session=${cookie}` },
+    });
+    assert.equal(logout.status, 204);
+    assert.equal(getCookie(logout, "abode_session"), "");
+  });
+
+  it("POST /auth/clear-sessions invalidates outstanding session cookies", async () => {
+    const login = await fetch(`${server.url}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
+    });
+    const cookie = getCookie(login, "abode_session");
+
+    const clear = await fetch(`${server.url}/auth/clear-sessions`, {
+      method: "POST",
+      headers: { Cookie: `abode_session=${cookie}` },
+    });
+    assert.equal(clear.status, 204);
+
+    const self = await fetch(`${server.url}/auth/self`, {
+      headers: { Cookie: `abode_session=${cookie}` },
+    });
+    assert.equal(self.status, 401);
+  });
+
+  it("Bearer apikey token authenticates protected routes", async () => {
+    const [, token] = await db.createApikey({
+      uid,
+      name: "HTTP Test Key",
+      permissions: { all: true },
+    });
+
+    const res = await fetch(`${server.url}/users`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.status, 200);
+  });
+
+  it("invalid Bearer apikey token returns 401 invalid_apikey", async () => {
+    const res = await fetch(`${server.url}/users`, {
+      headers: { Authorization: `Bearer at_${"0".repeat(32)}` },
+    });
+    assert.equal(res.status, 401);
+    const body = (await res.json()) as { error: string };
+    assert.equal(body.error, "invalid_apikey");
+  });
+});

test/backends/api/index.test.ts

@@ -33,7 +33,20 @@ async function getApiDb() {
   };
 }
 
-runUserTests("api", getApiDb);
+async function getReadonlyApiDb() {
+  const { db: sqliteDb, close: closeSqlite } = await createTestDb();
+  const server = await createTestServer(sqliteDb);
+  const api = new ApiInterface(server.url, { readonly: true });
+  return {
+    db: api,
+    close: async () => {
+      await server.close();
+      closeSqlite();
+    },
+  };
+}
+
+runUserTests("api", getApiDb, getReadonlyApiDb);
 runAbodeTests("api", getApiDb);
 runResidentTests("api", getApiDb);
 runApikeyTests("api", getApiDb);

test/backends/sqlite/index.test.ts

@@ -1,6 +1,6 @@
 import type { BackendDbInterface } from "../../../src/db/types/DbInterface.js";
 import { SqliteInterface } from "../../../src/db/sqlite/SqliteInterface.js";
-import { createTestDb } from "../../helpers/sqlite.js";
+import { createTestDb, createReadonlyTestDb } from "../../helpers/sqlite.js";
 import { runUserTests } from "../../shared/users.js";
 import { runAbodeTests } from "../../shared/abodes.js";
 import { runResidentTests } from "../../shared/residents.js";
@@ -30,7 +30,7 @@ async function createExpiredApikey(
   return token;
 }
 
-runUserTests("sqlite", createTestDb);
+runUserTests("sqlite", createTestDb, createReadonlyTestDb);
 runAbodeTests("sqlite", createTestDb);
 runResidentTests("sqlite", createTestDb);
 runApikeyTests("sqlite", createTestDb);

test/helpers/sqlite.ts

@@ -16,3 +16,9 @@ export async function createTestDb(): Promise<TestDb> {
   const db = new SqliteInterface(wrapped);
   return { db, wrapped, close: () => wrapped.destroy() };
 }
+
+export async function createReadonlyTestDb(): Promise<TestDb> {
+  const wrapped = getWrappedDb("node", ":memory:", { readonly: true });
+  const db = new SqliteInterface(wrapped);
+  return { db, wrapped, close: () => wrapped.destroy() };
+}

test/shared/users.ts

@@ -10,12 +10,13 @@ import { hashPassword } from "../../src/util/hash.js";
 
 export function runUserTests(
   name: string,
-  getDb: () => Promise<{ db: DbInterface; close(): void }>
+  getDb: () => Promise<{ db: DbInterface; close(): void }>,
+  getReadonlyDb?: () => Promise<{ db: DbInterface; close(): void }>
 ): void {
   describe(`${name}: users`, async () => {
     let db: DbInterface;
     let close: () => void;
-    let hashedPw: string;
+    let hashedPw: Awaited<ReturnType<typeof hashPassword>>;
 
     before(async () => {
       ({ db, close } = await getDb());
@@ -64,6 +65,7 @@ export function runUserTests(
       const email = `user-byemail-${Date.now()}@test.example`;
       await db.createUser({ email, name: "ByEmail User", password: hashedPw, flags: {} });
       const found = await db.getUserByEmail(email);
+      assert.ok("email" in found, "result includes email");
       assert.equal(found.email, email);
     });
 
@@ -150,17 +152,21 @@ export function runUserTests(
   describe(`${name}: users readonly`, async () => {
     let db: DbInterface;
     let close: () => void;
-    let hashedPw: string;
+    let hashedPw: Awaited<ReturnType<typeof hashPassword>>;
 
     before(async () => {
-      ({ db, close } = await getDb());
+      if (getReadonlyDb) ({ db, close } = await getReadonlyDb());
       hashedPw = await hashPassword("test-password");
     });
 
-    after(() => close());
+    after(() => close?.());
 
-    it("createUser on readonly db throws ReadonlyAbodeError", async () => {
-      if (!db.readonly) return;
+    it("createUser on readonly db throws ReadonlyAbodeError", async (t) => {
+      if (!getReadonlyDb) {
+        t.skip("getReadonlyDb helper not provided for this backend");
+        return;
+      }
+      assert.ok(db.readonly, "test db is readonly");
       await assert.rejects(
         () =>
           db.createUser({