test(19.7-05): framework unit tests for every validation row and the gate's admin stage

- pier: TestCatalog, TestDispatch, TestGuardRules, TestSessions (Redis
  across two instances and the memory store), TestFanOut; the store clock
  and stateless-server seams in export_test.go
- surf: TestStreamingRoute (throttle, CORS profile and access-log pattern on
  a stream route) and TestPierMount in both builds; the streaming smoke
  restores the mount hook it replaces
- wristband TestMCPScopes; cabana TestAccountContributions (Postgres part:
  transaction and unchanged My account payloads), TestRecordActionPrompt,
  TestScopeLimitForMethods; TestRecordActionPromptRun pins the empty Value
  of an action without a prompt
- vitest: 403 and failed-load cases for My account contributions, the
  cancelled prompt
- gate: every name required (tagged runs included), account.go unchanged
  since 51d088a, admin stage live

modules/surf/streaming_test.go

@@ -0,0 +1,164 @@
+package surf
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/party"
+)
+
+// TestStreamingRoute (SC-1, RESEARCH Pitfall 1): a MountStream route flushes
+// to the client while its handler runs and a buffered route does not (its
+// Flush stays a no-op until the handler returns); a panic before the first
+// byte is the opaque 500; and a stream route keeps everything else a route
+// gets: its inline throttle, its CORS profile's headers and the route
+// pattern in the access log.
+func TestStreamingRoute(t *testing.T) {
+	plugin := streamPlugin{release: make(chan struct{})}
+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, "event: ok\n\n")
+	})
+	prev := mountPier
+	mountPier = func(r *Router, _ *backpack.App, _ []party.Plugin) error {
+		r.BindPlugin("summercms.pier")
+		for _, m := range []struct {
+			path string
+			h    http.Handler
+			mw   []string
+		}{
+			{"/mcp/events", http.HandlerFunc(plugin.events), nil},
+			{"/mcp/panic-early", http.HandlerFunc(func(http.ResponseWriter, *http.Request) { panic("before write") }), nil},
+			{"/mcp/limited", ok, []string{"throttle:2,1"}},
+			{"/mcp/cors", ok, []string{"cors:spa"}},
+		} {
+			if err := r.MountStream(http.MethodGet, m.path, m.h, m.mw...); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	defer func() { mountPier = prev }()
+
+	app := transportApp(t, "development", map[string]string{
+		"http.yaml": transportBodyLimits + `cors_profiles:
+  spa:
+    allowed_origins: ["https://www.example.com"]
+    allowed_methods: ["GET"]
+    allowed_headers: ["Content-Type"]
+`,
+		"mcp.yaml": "enabled: true\n",
+	})
+	var logs bytes.Buffer
+	if err := app.Publish(slog.New(slog.NewTextHandler(&logs, nil))); err != nil {
+		t.Fatal(err)
+	}
+	h, err := Assemble(app, []party.Plugin{plugin})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := httptest.NewServer(h)
+	defer srv.Close()
+	client := srv.Client()
+	get := func(path string, header map[string]string) *http.Response {
+		t.Helper()
+		req, err := http.NewRequest(http.MethodGet, srv.URL+path, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for k, v := range header {
+			req.Header.Set(k, v)
+		}
+		res, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return res
+	}
+
+	t.Run("stream flushes, buffered Flush is a no-op", func(t *testing.T) {
+		stream := get("/mcp/events", nil)
+		defer stream.Body.Close()
+		select {
+		case line := <-firstLine(t, stream):
+			if line != "event: a" {
+				t.Fatalf("first line = %q", line)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatal("the stream route did not flush while its handler ran")
+		}
+		buffered := make(chan string, 1)
+		go func() {
+			res, err := client.Get(srv.URL + "/acme/buffered")
+			if err != nil {
+				buffered <- "error: " + err.Error()
+				return
+			}
+			defer res.Body.Close()
+			body, _ := io.ReadAll(res.Body)
+			buffered <- string(body)
+		}()
+		select {
+		case got := <-buffered:
+			t.Fatalf("the buffered route answered before its handler returned: %q", got)
+		case <-time.After(300 * time.Millisecond):
+		}
+		close(plugin.release)
+		select {
+		case got := <-buffered:
+			if got != "event: a\n\nevent: b\n\n" {
+				t.Fatalf("buffered body = %q", got)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatal("the buffered route never answered")
+		}
+	})
+
+	t.Run("panic before the first byte", func(t *testing.T) {
+		res := get("/mcp/panic-early", nil)
+		defer res.Body.Close()
+		body, _ := io.ReadAll(res.Body)
+		if res.StatusCode != http.StatusInternalServerError || strings.Contains(string(body), "before write") {
+			t.Fatalf("panic = %d %q", res.StatusCode, body)
+		}
+	})
+
+	t.Run("inline throttle", func(t *testing.T) {
+		var codes []int
+		for i := 0; i < 3; i++ {
+			res := get("/mcp/limited", nil)
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
+			codes = append(codes, res.StatusCode)
+		}
+		if codes[0] != http.StatusOK || codes[1] != http.StatusOK || codes[2] != http.StatusTooManyRequests {
+			t.Fatalf("statuses = %v, want 200 200 429", codes)
+		}
+	})
+
+	t.Run("CORS profile headers", func(t *testing.T) {
+		res := get("/mcp/cors", map[string]string{"Origin": "https://www.example.com"})
+		defer res.Body.Close()
+		if res.StatusCode != http.StatusOK || res.Header.Get("Access-Control-Allow-Origin") != "https://www.example.com" {
+			t.Fatalf("cors = %d, allow-origin %q", res.StatusCode, res.Header.Get("Access-Control-Allow-Origin"))
+		}
+		other := get("/mcp/cors", map[string]string{"Origin": "https://evil.example"})
+		defer other.Body.Close()
+		if other.Header.Get("Access-Control-Allow-Origin") != "" {
+			t.Fatalf("a foreign origin got allow-origin %q", other.Header.Get("Access-Control-Allow-Origin"))
+		}
+	})
+
+	t.Run("access log pattern", func(t *testing.T) {
+		if !strings.Contains(logs.String(), `pattern="GET /mcp/limited"`) || !strings.Contains(logs.String(), `pattern="GET /mcp/events"`) {
+			t.Fatalf("access log lacks the stream route patterns:\n%s", logs.String())
+		}
+	})
+}