feat: publish CodexPi contest snapshot

frontend/tests/apiAuth.test.ts

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict'
+import {readFile} from 'node:fs/promises'
+import test from 'node:test'
+
+import {csrfTokenFromBootstrap} from '../src/csrfRefresh.ts'
+
+test('a fresh CSRF token is required before submitting login', async () => {
+  assert.equal(csrfTokenFromBootstrap({csrf_token: 'fresh-token'}), 'fresh-token')
+  assert.throws(() => csrfTokenFromBootstrap({}), /indisponible/i)
+
+  const app = await readFile(new URL('../src/App.tsx', import.meta.url), 'utf8')
+  const refresh = app.indexOf('await refreshCsrf()')
+  const login = app.indexOf("const endpoint=setupRequired?'/api/auth/setup':'/api/auth/login'")
+  assert.ok(refresh >= 0 && refresh < login, 'login must refresh CSRF before selecting the POST endpoint')
+})