Add ADB management and live car telemetry

server/tests/app.test.ts

@@ -250,6 +250,56 @@ describe("authentication boundary", () => {
     expect(invalidConfiguration.json()).toMatchObject({ error: { code: "INVALID_HOTSPOT_CONFIGURATION" } });
   });
 
+  it("protects ADB operations and persists only validated shortcuts", async () => {
+    const app = await createApp();
+    expect((await app.inject({ method: "GET", url: "/api/adb/packages" })).statusCode).toBe(401);
+    expect((await app.inject({ method: "GET", url: "/api/adb/shortcuts" })).statusCode).toBe(401);
+    expect((await app.inject({ method: "GET", url: "/api/car/telemetry" })).statusCode).toBe(401);
+
+    const token = await csrf(app);
+    await setup(app, token);
+    const login = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      headers: mutationHeaders(token),
+      payload: { username: "owner", password: "Correct-horse1" }
+    });
+    const session = login.cookies.find((item) => item.name === SESSION_COOKIE)?.value ?? "";
+    const cookie = `${CSRF_COOKIE}=${token}; ${SESSION_COOKIE}=${session}`;
+    const headers = { ...mutationHeaders(token), cookie };
+
+    const invalid = await app.inject({
+      method: "POST",
+      url: "/api/adb/shortcuts",
+      headers,
+      payload: { name: "Unsafe", type: "component", value: "com.example/.Main;reboot" }
+    });
+    expect(invalid.statusCode).toBe(400);
+
+    const created = await app.inject({
+      method: "POST",
+      url: "/api/adb/shortcuts",
+      headers,
+      payload: { name: "Settings", type: "component", value: "com.android.settings/.Settings" }
+    });
+    expect(created.statusCode).toBe(201);
+    const shortcutId = created.json<{ id: number }>().id;
+    const shortcuts = await app.inject({ method: "GET", url: "/api/adb/shortcuts", headers: { cookie } });
+    expect(shortcuts.json()).toMatchObject({ shortcuts: [{ id: shortcutId, name: "Settings" }] });
+
+    const badApk = await app.inject({
+      method: "POST",
+      url: "/api/adb/install",
+      headers: { ...headers, "content-type": "application/vnd.android.package-archive" },
+      payload: Buffer.from("plain text")
+    });
+    expect(badApk.statusCode).toBe(400);
+    expect(badApk.json()).toMatchObject({ error: { code: "INVALID_APK" } });
+
+    const removed = await app.inject({ method: "DELETE", url: `/api/adb/shortcuts/${shortcutId}`, headers });
+    expect(removed.statusCode).toBe(204);
+  });
+
   it("exposes only allowlisted jobs and authenticated run history", async () => {
     const app = await createApp();
     const token = await csrf(app);