fix(evolution): подтверждать сохранение ключа и ответ проверки API

backend/src/plugins/auth.evolution-settings.test.ts

@@ -0,0 +1,15 @@
+import assert from "node:assert/strict"
+import Fastify from "fastify"
+import {SignJWT} from "jose"
+import {createEvoBgpSettingsRoutes} from "../routes/evobgp-settings.js"
+process.env.AUTH_REQUIRED="true";process.env.AUTH_JWT_SECRET="evolution-fixture-secret";process.env.AUTH_ISSUER="https://auth.test.local";process.env.NODE_ENV="test"
+const {default:authPlugin,requireAuth}=await import("./auth.js")
+const app=Fastify();await app.register(authPlugin);app.addHook("preHandler",requireAuth)
+let writes=0,probes=0
+await app.register(createEvoBgpSettingsRoutes({read:async()=>({baseUrl:"https://evo.example.test",enabled:false,apiKey:"fixture-only"}),write:async()=>{writes++;return {baseUrl:"https://evo.example.test",enabled:false,apiKey:"fixture-only"}},probe:async()=>{probes++;return {items:[]}}}),{prefix:"/api"})
+for(const permission of ["mm:settings:admin","mm:settings:write","mm:traffic:admin","mm:dashboard:read"]){
+ const token=await new SignJWT({sub:"fixture",apps:["mm"],permissions:[permission]}).setProtectedHeader({alg:"HS256"}).setIssuer("https://auth.test.local").setExpirationTime("1h").sign(new TextEncoder().encode("evolution-fixture-secret"))
+ for(const [method,url] of [["GET","/api/evobgp/settings"],["PUT","/api/evobgp/settings"],["POST","/api/evobgp/test"]] as const){const response=await app.inject({method,url,headers:{authorization:"Bearer "+token},...(method==="PUT"?{payload:{enabled:false}}:{})});assert.equal(response.statusCode,permission==="mm:settings:admin"?200:403);assert.equal(response.body.includes("fixture-only"),false)}
+}
+assert.equal(writes,1);assert.equal(probes,1);assert.equal((await app.inject({method:"GET",url:"/api/evobgp/settings"})).statusCode,401)
+await app.close();console.log("Evolution JWT gate: actual settings/test handlers require settings admin, no key echo")