Gate bot logic on full account authentication

tests/control-auth.test.ts

@@ -0,0 +1,35 @@
+import express from 'express';
+import type { AddressInfo } from 'node:net';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createControlRouter } from '../src/web/routes/control.js';
+
+const servers: Array<ReturnType<express.Express['listen']>> = [];
+
+afterEach(async () => {
+  await Promise.all(servers.splice(0).map(
+    (server) => new Promise<void>((resolve) => server.close(() => resolve())),
+  ));
+});
+
+describe('bot control account authentication gate', () => {
+  it('refuses to start the bot until full account authentication', async () => {
+    const setBotRunning = vi.fn();
+    const app = express();
+    app.use(createControlRouter({
+      services: { accountAuth: { isFullyAuthenticated: () => false } },
+      setBotRunning,
+      activity: { push: vi.fn() },
+      logger: { warn: vi.fn(), info: vi.fn() },
+    } as never));
+    const server = app.listen(0);
+    servers.push(server);
+    await new Promise<void>((resolve) => server.once('listening', resolve));
+    const { port } = server.address() as AddressInfo;
+
+    const response = await fetch(`http://127.0.0.1:${port}/start`, { method: 'POST' });
+
+    expect(response.status).toBe(409);
+    expect(await response.json()).toMatchObject({ success: false, authenticated: false });
+    expect(setBotRunning).not.toHaveBeenCalled();
+  });
+});