2 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	4748d578e7	test(12-02): isSetupLocked() real impl + RED-first setup route tests ... - Implement real isSetupLocked() in setupGuard.ts: reads app_config.setup_complete (returns true if value==='true'); else checks member_credentials row + VAPID env for effective-config branch (D-10) - Re-queries DB fresh every call — no module-level cache (D-10/Pitfall 8) - Convert Wave-0 it.todo() scaffolds into real integration tests (17 tests RED) - RED-first 423 guard test: POST /complete twice → first 200, second 423 (Pitfall 8) - D-10 effective-config tests: 423 when credRow AND VAPID env; NOT 423 otherwise - 2 'does NOT return 423' tests pass (404 ≠ 423); all others RED pending Task 2 router	2026-06-15 13:53:53 -04:00
Lucas Berger	e098be3929	test(12-01): Wave-0 test scaffolds — setup.test.ts + user.test.ts (RED) ... - Add apps/api/tests/routes/setup.test.ts with it.todo() scaffolds for: SETUP-01 (GET /api/setup/status), SETUP-02 (validate/vapid + validate/oidc), SETUP-01 (POST /api/setup/credential), SETUP-04 (POST /api/setup/complete × 2 → first 200, second 423), D-10 effective-config 423 guard. All 15 cases RED (it.todo) so Plan 02 implements against real failing tests. - Extend apps/api/tests/auth/user.test.ts with D-08 first-login-claims describe block (5 it.todo() cases): unclaimed user bind, is_admin preservation, setup_complete=false fallthrough, no unclaimed fallthrough, no email lookup (D-10) - Suite collects clean: 375 passed | 20 todo — no import errors	2026-06-15 13:43:47 -04:00