Initial commit: CraftDock as of 2026-11-01

The previous GitHub history was lost with the account (the local .git was missing
its refs and most objects), so this repository starts from the existing code.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test/server.integration.test.js

@@ -0,0 +1,40 @@
+import { describe, it, expect, vi } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcryptjs';
+import { createApp } from '../src/server.js';
+
+function fakeDeps() {
+  const config = {
+    adminPasswordHash: bcrypt.hashSync('pw', 10),
+    sessionSecret: 'test-secret',
+    nodeEnv: 'test',
+    mcDataPath: '/data',
+  };
+  const dockerService = {
+    inspect: vi.fn().mockResolvedValue({ state: 'exited', type: 'PAPER' }),
+    stats: vi.fn(), start: vi.fn(), stop: vi.fn(), restart: vi.fn(), kill: vi.fn(),
+  };
+  const appState = { getEdition: vi.fn().mockResolvedValue('java'), getAdapter: vi.fn() };
+  const propertiesService = { read: vi.fn().mockResolvedValue({}), update: vi.fn() };
+  const worldService = {};
+  const authService = { verifyPassword: async (p) => p === 'pw' };
+  const upload = { single: () => (req, _res, next) => next() };
+  return { config, dockerService, appState, propertiesService, worldService, authService, upload };
+}
+
+describe('server auth guard', () => {
+  it('blocks /api/status when unauthenticated', async () => {
+    const { app } = createApp(fakeDeps());
+    const res = await request(app).get('/api/status');
+    expect(res.status).toBe(401);
+  });
+
+  it('allows /api/status after login', async () => {
+    const { app } = createApp(fakeDeps());
+    const agent = request.agent(app);
+    await agent.post('/api/auth/login').send({ password: 'pw' });
+    const res = await agent.get('/api/status');
+    expect(res.status).toBe(200);
+    expect(res.body.state).toBe('exited');
+  });
+});