Gate admin menu and authoring with shared JWT

server/e2eHarness.ts

@@ -2,6 +2,7 @@ import { once } from 'node:events'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import pg from 'pg'
+import jwt from 'jsonwebtoken'
 import type { CaseState } from '../src/types.js'
 import { importMysteryTemplate } from '../scripts/importMysteryTemplate.js'
 import { runMigrations } from './migrations.js'
@@ -26,17 +27,20 @@ await runMigrations(databaseUrl, migrationsDir, () => undefined)
 const port = Number(process.env.E2E_PORT || 18788)
 process.env.DATABASE_URL = databaseUrl
 process.env.LEVEL_EDITING_ENABLED = 'true'
+process.env.JWT_SECRET = 'osint-e2e-jwt-secret'
 process.env.PORT = String(port)
 process.env.OSINT_MANAGED_SERVER = 'true'
 const { server, pool } = await import('./index.js')
 if (!server.listening) await once(server, 'listening')
 const baseUrl = `http://127.0.0.1:${port}`
+const adminToken = jwt.sign({ sub: 'e2e-admin', role: 'admin' }, process.env.JWT_SECRET)
+const adminHeaders = { 'content-type': 'application/json', authorization: `Bearer ${adminToken}` }
 const documentId = '22222222-2222-4222-8222-222222222222'
 const folderId = '11111111-1111-4111-8111-111111111111'
 
 const created = await fetch(`${baseUrl}/api/levels`, {
   method: 'POST',
-  headers: { 'content-type': 'application/json' },
+  headers: adminHeaders,
   body: JSON.stringify({ id: 'e2e-level', title: 'Browser Safety Test', subtitle: 'Disposable test level' }),
 })
 if (!created.ok) throw new Error(`Could not create browser test level: ${created.status}`)
@@ -61,12 +65,12 @@ state.connections = []
 state.viewport = { x: 0, y: 28, zoom: 0.7 }
 const saved = await fetch(`${baseUrl}/api/levels/${state.id}?edit=1`, {
   method: 'PUT',
-  headers: { 'content-type': 'application/json' },
+  headers: adminHeaders,
   body: JSON.stringify(state),
 })
 if (!saved.ok) throw new Error(`Could not seed browser test level: ${saved.status}`)
 
-await importMysteryTemplate(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'mysteries', 'glass-harbor', 'mystery.json'), baseUrl)
+await importMysteryTemplate(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'mysteries', 'glass-harbor', 'mystery.json'), baseUrl, adminToken)
 
 let shuttingDown = false
 async function shutdown(exitCode: number) {