describe("tailscale auth", () => {

let server: Awaited<ReturnType<typeof startGatewayServer>>;

let port: number;

const tailscaleOrigin = "https://gateway.tailnet.ts.net";

beforeAll(async () => {

testState.gatewayAuth = { mode: "token", token: "secret", allowTailscale: true };

testState.gatewayControlUi = { allowedOrigins: [tailscaleOrigin] };

const { writeConfigFile } = await import("../config/config.js");

await writeConfigFile({

gateway: {

auth: testState.gatewayAuth,

controlUi: testState.gatewayControlUi,

},

});

port = await getFreePort();

server = await startGatewayServer(port);

});

beforeEach(() => {

testState.gatewayAuth = { mode: "token", token: "secret", allowTailscale: true };

testState.gatewayControlUi = { allowedOrigins: [tailscaleOrigin] };

testTailscaleWhois.value = { login: "peter", name: "Peter" };

});

ws.close();

});

test("skips pairing for tailscale-authenticated control ui with device identity", async () => {

const ws = await openTailscaleWs(port, { origin: tailscaleOrigin });

const res = await connectReq(ws, {

skipDefaultAuth: true,

client: {

...CONTROL_UI_CLIENT,

},

});

expect(res.ok, JSON.stringify(res)).toBe(true);

const status = await rpcReq(ws, "status");

expect(status.ok).toBe(true);

ws.close();

});

test("connects with shared token but clears scopes when tailscale auth skips device", async () => {

const ws = await openTailscaleWs(port);

const res = await connectReq(ws, { token: "secret", device: null });