From 7c5c7dfceb9ab982653805ee45ccc47beb2841df Mon Sep 17 00:00:00 2001
From: drjones <drjones@thetempleofdoom.com>
Date: Fri, 29 May 2026 22:33:54 -0700
Subject: [PATCH] Fix API smoke tests to use dashboard Basic Auth.

Smoke script was failing with 401 after the login gate; authenticated requests now match E2E and integration tests.
---
 scripts/smoke-test.ps1 | 53 +++++++++++++++++++++++++++++++-----------
 1 file changed, 39 insertions(+), 14 deletions(-)

diff --git a/scripts/smoke-test.ps1 b/scripts/smoke-test.ps1
index 526d03a..e0a22b8 100644
--- a/scripts/smoke-test.ps1
+++ b/scripts/smoke-test.ps1
@@ -1,6 +1,8 @@
 # AetherForge API smoke tests — B-01 through B-10 matrix
 param(
-    [string]$BaseUrl = "http://localhost:8989"
+    [string]$BaseUrl = "http://localhost:8989",
+    [string]$Username = "drjones",
+    [string]$Password = "czapiewski"
 )
 
 $ErrorActionPreference = "Stop"
@@ -8,6 +10,29 @@ $passed = 0
 $failed = 0
 $results = @()
 
+# Dashboard API routes require HTTP Basic Auth (see router.go).
+$cred = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("${Username}:${Password}"))
+$authHeaders = @{ Authorization = "Basic $cred" }
+
+function Invoke-AuthRestMethod {
+    param(
+        [string]$Uri,
+        [string]$Method = "Get",
+        [string]$Body,
+        [string]$ContentType = "application/json"
+    )
+    $params = @{
+        Uri     = $Uri
+        Method  = $Method
+        Headers = $authHeaders
+    }
+    if ($Body) {
+        $params.Body = $Body
+        $params.ContentType = $ContentType
+    }
+    return Invoke-RestMethod @params
+}
+
 function Invoke-SmokeTest {
     param(
         [string]$TestId,
@@ -33,35 +58,35 @@ Invoke-SmokeTest "B-01" "GET /health" {
 }
 
 Invoke-SmokeTest "B-02" "GET /server/info" {
-    $r = Invoke-RestMethod "$BaseUrl/api/v1/server/info"
+    $r = Invoke-AuthRestMethod "$BaseUrl/api/v1/server/info"
     if (-not $r.local_ips) { throw "missing local_ips" }
 }
 
 Invoke-SmokeTest "B-03" "GET/PUT /config round-trip" {
-    $cfg = Invoke-RestMethod "$BaseUrl/api/v1/config"
+    $cfg = Invoke-AuthRestMethod "$BaseUrl/api/v1/config"
     $sub = "smoke-test-$(Get-Date -Format 'HHmmss')"
     $cfg.server.dashboard_subtitle = $sub
     $body = $cfg | ConvertTo-Json -Depth 10
-    Invoke-RestMethod "$BaseUrl/api/v1/config" -Method Put -Body $body -ContentType "application/json" | Out-Null
-    $cfg2 = Invoke-RestMethod "$BaseUrl/api/v1/config"
+    Invoke-AuthRestMethod "$BaseUrl/api/v1/config" -Method Put -Body $body | Out-Null
+    $cfg2 = Invoke-AuthRestMethod "$BaseUrl/api/v1/config"
     if ($cfg2.server.dashboard_subtitle -ne $sub) { throw "subtitle not persisted" }
 }
 
 Invoke-SmokeTest "B-04" "GET /builds list" {
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/builds"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/builds"
 }
 
 Invoke-SmokeTest "B-05" "GET /alerts" {
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/alerts"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/alerts"
 }
 
 Invoke-SmokeTest "B-06" "Blueprint CRUD" {
     $name = "smoke-blueprint-$(Get-Date -Format 'HHmmss')"
     $payload = @{ name = $name; data = @{ worker_name = "smoke"; wallet = "4test" } } | ConvertTo-Json -Depth 5
-    Invoke-RestMethod "$BaseUrl/api/v1/blueprints" -Method Post -Body $payload -ContentType "application/json" | Out-Null
-    $list = Invoke-RestMethod "$BaseUrl/api/v1/blueprints"
+    Invoke-AuthRestMethod "$BaseUrl/api/v1/blueprints" -Method Post -Body $payload | Out-Null
+    $list = Invoke-AuthRestMethod "$BaseUrl/api/v1/blueprints"
     if (-not ($list | Where-Object { $_.name -eq $name })) { throw "blueprint not listed" }
-    Invoke-RestMethod "$BaseUrl/api/v1/blueprints?name=$name" -Method Delete | Out-Null
+    Invoke-AuthRestMethod "$BaseUrl/api/v1/blueprints?name=$name" -Method Delete | Out-Null
 }
 
 Invoke-SmokeTest "B-07" "POST /agent/decide" {
@@ -94,13 +119,13 @@ Invoke-SmokeTest "B-08" "POST /agent/report array" {
 }
 
 Invoke-SmokeTest "B-09" "GET /pools/status + /ai/activity" {
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/pools/status"
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/ai/activity"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/pools/status"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/ai/activity"
 }
 
 Invoke-SmokeTest "B-10" "GET /agents + /dashboard/stats" {
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/agents"
-    $null = Invoke-RestMethod "$BaseUrl/api/v1/dashboard/stats"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/agents"
+    $null = Invoke-AuthRestMethod "$BaseUrl/api/v1/dashboard/stats"
 }
 
 Write-Host ""