fix(api): отличать отказ терминала от пустого вывода

backend/src/plugins/auth.exec.test.ts

@@ -0,0 +1,16 @@
+import assert from "node:assert/strict"
+import Fastify from "fastify"
+import {SignJWT} from "jose"
+import {validatorCompiler,serializerCompiler} from "@fastify/type-provider-zod"
+process.env.AUTH_REQUIRED="true";process.env.AUTH_JWT_SECRET="terminal-test-secret";process.env.AUTH_ISSUER="https://auth.test.local";process.env.NODE_ENV="test"
+const {default:authPlugin,requireAuth}=await import("./auth.js"),{createExecRoutes}=await import("../routes/exec.js")
+const app=Fastify();app.setValidatorCompiler(validatorCompiler);app.setSerializerCompiler(serializerCompiler);await app.register(authPlugin);app.addHook("preHandler",requireAuth)
+let lookups=0
+await app.register(createExecRoutes({getServer:async()=>{lookups++;return undefined},createClient:()=>{throw new Error("unused")}}),{prefix:"/api"})
+const send=(token?:string)=>app.inject({method:"POST",url:"/api/servers/1/exec",payload:{command:"interface print"},headers:token?{authorization:"Bearer "+token}:{}})
+assert.equal((await send()).statusCode,401);assert.equal(lookups,0)
+for(const permission of ["mm:servers:read","mm:network:write","mm:servers:write","mm:servers:admin"]){
+ const token=await new SignJWT({sub:"test",apps:["mm"],permissions:[permission]}).setProtectedHeader({alg:"HS256"}).setIssuer("https://auth.test.local").setExpirationTime("1h").sign(new TextEncoder().encode("terminal-test-secret"))
+ const before=lookups,response=await send(token);const allowed=permission==="mm:servers:write"||permission==="mm:servers:admin";assert.equal(response.statusCode,allowed?404:403);assert.equal(lookups,before+(allowed?1:0))
+}
+await app.close();console.log("Exec RBAC: signed JWT requires existing servers:write/admin before device lookup; no DB/RouterOS")