User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/lib/auth.mjs

@@ -0,0 +1,65 @@
+/**
+ * Signing the check tools in. Since #177 every API route but `auth/*` needs a session, so every
+ * seed, smoke and e2e run logs in first – as `e2e`, the account that owns the four test projects.
+ *
+ * The password is never in the repo: it comes from `GAME_MAKER_E2E_PASSWORD` or from
+ * `data/e2e-password.txt`, which is git-ignored and written once per server (CI writes its own).
+ */
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const E2E_USER = 'e2e';
+
+const PASSWORD_FILE = resolve(dirname(fileURLToPath(import.meta.url)), '../../data/e2e-password.txt');
+const COOKIE = 'game_maker_session';
+
+/** One session per server for the whole process; logging in per request would be pointless load. */
+const cookies = new Map();
+
+/** The password of the `e2e` account; the step that drives the sign-in screen types it in. */
+export async function e2ePassword() {
+  const fromEnv = process.env.GAME_MAKER_E2E_PASSWORD;
+  if (fromEnv) return fromEnv;
+  try {
+    return (await readFile(PASSWORD_FILE, 'utf8')).trim();
+  } catch {
+    throw new Error(
+      `no password for the "${E2E_USER}" account: set GAME_MAKER_E2E_PASSWORD or put it in ${PASSWORD_FILE}`,
+    );
+  }
+}
+
+/** `game_maker_session=…` for `Cookie` headers, logging in on first use. */
+export async function sessionCookie(baseUrl) {
+  const cached = cookies.get(baseUrl);
+  if (cached) return cached;
+  const res = await fetch(`${baseUrl}api/index.php?r=auth/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ username: E2E_USER, password: await e2ePassword() }),
+    signal: AbortSignal.timeout(20_000),
+  });
+  if (!res.ok) {
+    throw new Error(`could not sign in as "${E2E_USER}" at ${baseUrl}: HTTP ${res.status}`);
+  }
+  // `getSetCookie` keeps the headers apart; a joined string cannot be split on commas, because a
+  // cookie's own Expires date carries one.
+  const set = res.headers.getSetCookie().find((c) => c.startsWith(`${COOKIE}=`));
+  if (!set) throw new Error(`signing in at ${baseUrl} returned no ${COOKIE} cookie`);
+  const cookie = set.split(';')[0];
+  cookies.set(baseUrl, cookie);
+  return cookie;
+}
+
+/** The headers a tool's `fetch` needs on top of its own. */
+export async function authHeaders(baseUrl) {
+  return { Cookie: await sessionCookie(baseUrl) };
+}
+
+/** The session token alone – what the browser gets handed over CDP. */
+export async function sessionToken(baseUrl) {
+  return (await sessionCookie(baseUrl)).slice(COOKIE.length + 1);
+}
+
+export const SESSION_COOKIE = COOKIE;

tools/lib/harness.mjs

@@ -4,6 +4,7 @@
  * the summary line is missing, since chromium can die halfway under memory pressure.
  */
 import { writeFileSync } from 'node:fs';
+import { authHeaders, SESSION_COOKIE, sessionToken } from './auth.mjs';
 import { launchBrowser } from './browser.mjs';
 
 /**
@@ -391,7 +392,8 @@ function makeTools({ cdp, projectId, baseUrl, consoleLog, check, shotPrefix }) {
   const api = async (route) => {
     const url = `${baseUrl}api/index.php?r=${route}`;
     try {
-      return await (await fetch(url, { signal: AbortSignal.timeout(SERVER_TIMEOUT_MS) })).json();
+      const headers = await authHeaders(baseUrl);
+      return await (await fetch(url, { headers, signal: AbortSignal.timeout(SERVER_TIMEOUT_MS) })).json();
     } catch (error) {
       throw new Error(`request to ${route} failed: ${error.message}`, { cause: error });
     }
@@ -399,11 +401,27 @@ function makeTools({ cdp, projectId, baseUrl, consoleLog, check, shotPrefix }) {
   const sceneOf = (doc) => doc.project.assets.find((a) => a.type === 'scene');
   const exceptions = () => consoleLog.filter((l) => l.startsWith('EXCEPTION'));
   /** Opens the project and asserts the page came up cleanly with the test hook installed. */
+  /**
+   * Hands the browser the session the tools log in with (#177). Without it the editor would put
+   * up its sign-in screen instead of the project, and every step after it would find no editor.
+   * The sign-in screen itself is driven by hand in the step that tests it.
+   */
+  const signIn = async () => {
+    await cdp.send('Network.enable');
+    await cdp.send('Network.setCookie', {
+      name: SESSION_COOKIE,
+      value: await sessionToken(baseUrl),
+      url: baseUrl,
+    });
+  };
   const navigate = async () => {
+    await signIn();
     await cdp.send('Page.navigate', { url: `${baseUrl}?project=${projectId}` });
     await sleep(4000);
     check('page loaded without exceptions', exceptions().length === 0, exceptions().join(' | '));
-    check('debug hook present', Boolean(await evaluate('Boolean(window.__gm)')));
+    // `state` rather than the bare hook: the sign-in screen installs one of its own, and a run
+    // that stopped there must not look like a loaded editor.
+    check('debug hook present', Boolean(await evaluate('Boolean(window.__gm?.state)')));
   };
 
   return {
@@ -450,6 +468,7 @@ function makeTools({ cdp, projectId, baseUrl, consoleLog, check, shotPrefix }) {
     play,
     stop,
     api,
+    signIn,
     sceneOf,
     navigate,
   };

tools/lib/projects.mjs

@@ -12,6 +12,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { basename, extname } from 'node:path';
+import { authHeaders } from './auth.mjs';
 
 export const PROJECTS = {
   playground: '649188c15414',
@@ -61,7 +62,7 @@ export async function uploadTexture(baseUrl, filePath) {
   }
   const res = await fetch(`${baseUrl}api/index.php?r=textures`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -95,7 +96,7 @@ export async function uploadFont(baseUrl, filePath) {
   const name = encodeURIComponent(basename(filePath));
   const res = await fetch(`${baseUrl}api/index.php?r=fonts&name=${name}`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -116,7 +117,7 @@ export async function uploadFont(baseUrl, filePath) {
 export async function uploadSound(baseUrl, bytes, fileName, type = 'audio/wav') {
   const res = await fetch(`${baseUrl}api/index.php?r=sounds&name=${encodeURIComponent(fileName)}`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -134,7 +135,8 @@ export async function writeProject(projectId, baseUrl, project) {
   // A request without a timeout keeps its socket open, so a stalled server hangs the seed
   // instead of failing it – and the run that follows never starts.
   const timeout = () => AbortSignal.timeout(20_000);
-  const current = await fetch(url, { signal: timeout() });
+  const headers = await authHeaders(baseUrl);
+  const current = await fetch(url, { headers, signal: timeout() });
   if (!current.ok) {
     console.error(`GET failed: ${current.status} – create the project first (POST ?r=projects)`);
     process.exit(1);
@@ -146,7 +148,7 @@ export async function writeProject(projectId, baseUrl, project) {
   };
   const res = await fetch(url, {
     method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...headers },
     body: JSON.stringify(body),
     signal: timeout(),
   });