User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/core/auth.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { WrongCredentialsError } from '../../src/core/store/AuthStore';
+import { HttpAuthStore } from '../../src/core/store/HttpAuthStore';
+import { loginError, loginProblem } from '../../src/editor/auth/loginRules';
+
+/** What the firewall in front of the live site answers instead of any non-2xx (measured for #177). */
+const FIREWALL_418 = '<html><head><title>Status Code 418</title></head><body></body></html>';
+
+function stubFetch(body: BodyInit | null, init: ResponseInit) {
+  const mock = vi.fn<typeof fetch>(() => Promise.resolve(new Response(body, init)));
+  vi.stubGlobal('fetch', mock);
+  return mock;
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('HttpAuthStore', () => {
+  it('reads who is signed in, null included', async () => {
+    stubFetch(JSON.stringify({ user: 'e2e' }), { status: 200 });
+    await expect(new HttpAuthStore('/api').session()).resolves.toBe('e2e');
+
+    stubFetch(JSON.stringify({ user: null }), { status: 200 });
+    await expect(new HttpAuthStore('/api').session()).resolves.toBeNull();
+  });
+
+  it('sends the pair as JSON and answers with the name the server confirms', async () => {
+    const mock = stubFetch(JSON.stringify({ user: 'user' }), { status: 200 });
+    await expect(new HttpAuthStore('/api').logIn('user', 'secret')).resolves.toBe('user');
+    const [url, init] = mock.mock.calls[0]!;
+    expect(url as string).toContain('r=auth%2Flogin');
+    expect(init?.method).toBe('POST');
+    expect(JSON.parse(init?.body as string)).toEqual({ username: 'user', password: 'secret' });
+  });
+
+  it('tells a wrong pair apart from a server that is not there', async () => {
+    stubFetch(JSON.stringify({ error: 'Wrong user name or password' }), { status: 401 });
+    await expect(new HttpAuthStore('/api').logIn('user', 'nope')).rejects.toBeInstanceOf(
+      WrongCredentialsError,
+    );
+
+    stubFetch(JSON.stringify({ error: 'boom' }), { status: 500 });
+    const failure = new HttpAuthStore('/api').logIn('user', 'secret');
+    await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
+    await expect(failure).rejects.toThrow(/boom \(500\)/);
+  });
+
+  it('does not mistake the firewall page for a wrong password', async () => {
+    stubFetch(FIREWALL_418, { status: 418 });
+    const failure = new HttpAuthStore('/api').logIn('user', 'secret');
+    await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
+    await expect(failure).rejects.toThrow(/418/);
+  });
+
+  it('signs out without a body', async () => {
+    const mock = stubFetch(null, { status: 204 });
+    await expect(new HttpAuthStore('/api').logOut()).resolves.toBeUndefined();
+    expect(mock.mock.calls[0]?.[1]?.method).toBe('POST');
+  });
+});
+
+describe('the rules of the sign-in form', () => {
+  it('asks for what is missing, user name first', () => {
+    expect(loginProblem('', '')).toBe('Enter your user name');
+    expect(loginProblem('   ', 'secret')).toBe('Enter your user name');
+    expect(loginProblem('user', '')).toBe('Enter your password');
+    expect(loginProblem('user', 'secret')).toBeNull();
+  });
+
+  it('says a wrong pair plainly and names the cause of anything else', () => {
+    expect(loginError(new WrongCredentialsError(), true)).toBe('Wrong user name or password');
+    expect(loginError(new Error('Server unavailable (503)'), false)).toBe(
+      'Could not sign in: Server unavailable (503)',
+    );
+  });
+});