Clarify Gitea verification failure diagnostics

tests/admin-verification-diagnostics.test.ts

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  describeFailure,
+  failureLocation,
+  requestFailure,
+  requestIdentity,
+} from '../tools/admin-verification-diagnostics.mjs';
+
+void test('a request failure remains distinct from an earlier expected denial', () => {
+  const completed = { ...requestIdentity('POST', '/api/admin/rooms/ABCDEFGH/seat-ai'), status: 403 };
+  const error = Object.assign(new TypeError('private message'), {
+    cause: { code: 'ECONNRESET', message: 'private cause' },
+  });
+  const failed = requestFailure(requestIdentity('POST', '/api/admin/rooms/ABCDEFGH/seat-ai?secret=private'), error);
+  assert.equal(describeFailure(completed, undefined), 'POST /api/admin/rooms/ABCDEFGH/seat-ai last completed with HTTP 403');
+  assert.equal(describeFailure(failed, 'tools/admin-seat-ai-verification.mjs:35:7'),
+    'POST /api/admin/rooms/ABCDEFGH/seat-ai failed before completing a response (TypeError, ECONNRESET); tools/admin-seat-ai-verification.mjs:35:7');
+  assert.doesNotMatch(JSON.stringify(failed), /private|secret/);
+});
+
+void test('diagnostics allow only known error names, codes and verification locations', () => {
+  const error = { name: 'credential', code: 'private', stack: [
+    'Error: private assertion payload',
+    '    at request (file:///workspace/tools/verify-admin.mjs:42:5)',
+    '    at verifyParticipantAi (file:///workspace/tools/admin-seat-ai-verification.mjs:35:7)',
+  ].join('\n') };
+  assert.deepEqual(requestFailure(requestIdentity('GET', '/api/admin/rooms'), error), {
+    method: 'GET', path: '/api/admin/rooms', kind: 'request-error', name: 'Error',
+  });
+  assert.equal(failureLocation(error), 'tools/admin-seat-ai-verification.mjs:35:7');
+  assert.equal(failureLocation({ stack: 'Error: private\n    at other (file:///elsewhere/private.js:2:3)' }), undefined);
+  assert.equal(requestIdentity('GET', '/api/admin/rooms/!secret').path, '[invalid path]');
+});