# Cookie authentication and HTTPD adapter host checks

Run from the project root:

```sh
python3 tests/web_cookie_auth/run.py
```

Requires Python 3, a C11 compiler (`cc`), OpenSSL headers/libcrypto, and the pinned ESP-IDF source installation. The runner uses `IDF_PATH` when set, otherwise `~/.platformio/packages/framework-espidf`. It writes only an automatically removed temporary directory. No network, device, pip/npm packages or server is needed. Do not disable C assertions.

The runner compiles production `web_cookie_auth`, `web_session_store`, `web_auth_parse` and `web_httpd_adapter` with bounded HTTPD/database/time/RNG doubles. It also executes the session-store public API suite. The installed IDF header getters, append-only response-header setter and right-aligned pending-data reader are extracted verbatim and compiled into the harness.

Coverage includes challenge reuse/consumption/expiry, capacities without eviction, global throttle, fragmented login bodies, secure cookie attributes and two simultaneous Set-Cookie fields, session-specific logout, duplicate fields/cookies, Origin/CSRF/method/Fetch Metadata rejection, Basic denial, currentness, stop/login and failure paths, six-header login budget, upgrade-state installation, and request cleanup preserving all 0–128 pending lengths through partial reads.

This is **not** the full IDF parser/dispatcher, real handshake/TLS/socket, browser, multicore task or hardware test. The private struct doubles do not prove binary layout; firmware compilation uses the actual pinned headers, and the version guard requires a new audit on SDK changes. Handshake sending and transport revocation are doubled. Actual on-wire pre-101 rejection, frame routing, pipelining/early bytes, cookie/CSP/browser recovery and loaded expiry latency remain M1 target gates. No sanitizer or runtime memory-reserve result is implied.

See `docs/phase8d3_implementation.md` for source verification, other suite commands, build accounting and the target checklist.

## Accounts (8D.10)

```sh
python3 tests/web_cookie_auth/run.py --accounts
python3 tests/admin_console_boundary/accounts.py
```

The first command adds nine account HTTP/operation groups using production
cookie/store/handler/parser and the canonical generated-value helper. Queue,
database mutations, timer scheduling and revocation are doubles; authorization
is real. Covers max-width eight-account projection, strict 768-byte/four-receive
credential schemas, decoded printable-ASCII passwords, bodyless generated-value
authorization/currentness/no-mutation/cleanup, timer creation/start failure,
queued expiry/replacement/executing fences, self success revocation and protected
failure, pending/result isolation, stale IDs, submission/execution failure,
target-only notifications, session invalidation and missed revocation/DB failure.
Parent reports PASS for these nine groups plus shared regressions. Direct-handler
tests do not prove route registration; the missing registration is now fixed as
an independent optional endpoint (23 handlers), and the route agent reports 15
lifecycle groups passing for registration, failure isolation and restart.
Implementation is host-tested/build-verified (parent `pio run` PASS, 25.61 s,
95,908 B RAM / 1,694,237 B flash), not target accepted. New timer runtime costs
remain unmeasured. No sanitizer validation or device/asset/commit/8D.11 action.
The second command separately exercises production conditional database mutation
and zero-wait list bodies with NVS/RTOS doubles, including last-admin protection,
target generation/recreation checks and commit-failure cleanup. It retains the
canonical CLI account tests. These are not end-to-end RTOS/flash/TLS tests.
See `docs/phase8d10_implementation.md` for current contracts, historical slice 1
evidence and pending target checks. Timer doubles do not prove hard cleanup latency.

## Read-only Serial Settings

```sh
python3 tests/web_cookie_auth/run.py --settings
```

Runs the existing auth/store suite plus five 8D.8 groups. Compiles exact extracted
production server handler/helpers, serial snapshot getter and enum formatters,
with the real cookie/store/parser/private adapter. Serial locking/state and HTTP
IO are doubled; authorization is not. Exercises normal-role/stale/expired/revoked
denial, DB failure, body/query/method/header/framing/Origin rejection before any
serial read, working values, zero-wait busy/uninitialized failure, no-store and
header/send errors. Adapter-only allocator substitution injects both staged
registration failures; the installed IDF unregister function frees successful
registration. No SDK files are modified. Lifecycle registration/optional failure
orchestration is separately tested by `tests/web_admin_transport/server_lifecycle.py`.

This does not run the full serial task/UART driver, TLS/network dispatcher or a real
browser. Target comparison with UART0 and runtime memory/stack validation remain
pending in `docs/phase8d8_implementation.md`; prior M2 signoff remains accepted.