Initial commit: CraftDock as of 2026-11-01

The previous GitHub history was lost with the account (the local .git was missing
its refs and most objects), so this repository starts from the existing code.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test/middleware/auth.test.js

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi } from 'vitest';
+import { requireAuth, socketAuth } from '../../src/middleware/auth.js';
+
+function mockRes() {
+  return {
+    statusCode: 200,
+    body: null,
+    status(c) { this.statusCode = c; return this; },
+    json(b) { this.body = b; return this; },
+  };
+}
+
+describe('requireAuth', () => {
+  it('calls next when session is authed', () => {
+    const next = vi.fn();
+    requireAuth({ session: { authed: true } }, mockRes(), next);
+    expect(next).toHaveBeenCalledOnce();
+  });
+
+  it('returns 401 when not authed', () => {
+    const next = vi.fn();
+    const res = mockRes();
+    requireAuth({ session: {} }, res, next);
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(401);
+    expect(res.body).toEqual({ error: 'unauthorized' });
+  });
+});
+
+describe('socketAuth', () => {
+  it('calls next with no error when session is authed', () => {
+    const next = vi.fn();
+    const socket = { request: {} };
+    const fakeSessionMiddleware = (req, res, callback) => {
+      req.session = { authed: true };
+      callback();
+    };
+
+    const middleware = socketAuth(fakeSessionMiddleware);
+    middleware(socket, next);
+
+    expect(next).toHaveBeenCalledOnce();
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  it('calls next with unauthorized error when not authed', () => {
+    const next = vi.fn();
+    const socket = { request: {} };
+    const fakeSessionMiddleware = (req, res, callback) => {
+      req.session = {};
+      callback();
+    };
+
+    const middleware = socketAuth(fakeSessionMiddleware);
+    middleware(socket, next);
+
+    expect(next).toHaveBeenCalledOnce();
+    expect(next).toHaveBeenCalledWith(expect.any(Error));
+    expect(next.mock.calls[0][0].message).toBe('unauthorized');
+  });
+});