Big changes

server/internal/api/admin_test.go

@@ -119,6 +119,41 @@ func TestServiceStatusReportsMaintenanceOutsideTheGate(t *testing.T) {
 	}
 }
 
+func TestServiceStatusMakesProtocolMismatchVisible(t *testing.T) {
+	server := testServer(config.Config{})
+	req := httptest.NewRequest(http.MethodGet, "/v1/status", nil)
+	req.Header.Set("X-Memby-Version", "0.9.1")
+	req.Header.Set("X-Memby-Protocol", "99")
+	rec := httptest.NewRecorder()
+
+	server.handleServiceStatus(rec, req, store.Session{})
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["compatible"] != false || body["compatibilityMessage"] == "" {
+		t.Fatalf("mismatch was not explicit: %v", body)
+	}
+	if body["clientVersion"] != "0.9.1" || body["serverProtocol"] != float64(membyProtocolVersion) {
+		t.Fatalf("version diagnostics missing: %v", body)
+	}
+}
+
+func TestServiceStatusAcceptsCurrentProtocol(t *testing.T) {
+	server := testServer(config.Config{})
+	req := httptest.NewRequest(http.MethodGet, "/v1/status", nil)
+	req.Header.Set("X-Memby-Protocol", "1")
+	rec := httptest.NewRecorder()
+	server.handleServiceStatus(rec, req, store.Session{})
+
+	var body map[string]any
+	_ = json.Unmarshal(rec.Body.Bytes(), &body)
+	if body["compatible"] != true || body["compatibilityMessage"] != "" {
+		t.Fatalf("current protocol should be compatible: %v", body)
+	}
+}
+
 func TestAdminIsDisabledWithoutAToken(t *testing.T) {
 	server := testServer(config.Config{})
 
@@ -163,6 +198,46 @@ func TestAdminAuthRejectsAWrongToken(t *testing.T) {
 	}
 }
 
+func TestAdminPageEstablishesPersistentCookie(t *testing.T) {
+	server := testServer(config.Config{AdminToken: "secret"})
+	req := httptest.NewRequest(http.MethodGet, "https://memby.local/admin/", nil)
+	rec := httptest.NewRecorder()
+
+	server.handleAdminPage(rec, req)
+
+	result := rec.Result()
+	cookies := result.Cookies()
+	if len(cookies) != 1 {
+		t.Fatalf("expected one admin cookie, got %d", len(cookies))
+	}
+	cookie := cookies[0]
+	if cookie.Name != adminCookieName || cookie.Value != "secret" {
+		t.Fatalf("unexpected admin cookie: %#v", cookie)
+	}
+	if !cookie.HttpOnly || !cookie.Secure || cookie.SameSite != http.SameSiteStrictMode {
+		t.Fatalf("admin cookie is not hardened: %#v", cookie)
+	}
+	if cookie.MaxAge <= 0 || cookie.Path != "/admin" {
+		t.Fatalf("admin cookie is not persistent or scoped: %#v", cookie)
+	}
+}
+
+func TestAdminAuthAcceptsPersistentCookie(t *testing.T) {
+	server := testServer(config.Config{AdminToken: "secret"})
+	handler := server.adminAuth(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	req := httptest.NewRequest(http.MethodGet, "/admin/api/status", nil)
+	req.AddCookie(&http.Cookie{Name: adminCookieName, Value: "secret"})
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("the admin cookie should be accepted, got %d", rec.Code)
+	}
+}
+
 func TestToRowEventValidatesAndClamps(t *testing.T) {
 	now := time.Date(2026, 7, 27, 12, 0, 0, 0, time.UTC)