Add allowlisted diagnostic jobs and MG4 ADB plan

server/tests/app.test.ts

@@ -175,4 +175,51 @@ describe("authentication boundary", () => {
     const response = await app.inject({ method: "GET", url: "/api/system/update" });
     expect(response.statusCode).toBe(401);
   });
+
+  it("exposes only allowlisted jobs and authenticated run history", async () => {
+    const app = await createApp();
+    const token = await csrf(app);
+    await setup(app, token);
+    const login = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      headers: mutationHeaders(token),
+      payload: { username: "owner", password: "Correct-horse1" }
+    });
+    const session = login.cookies.find((item) => item.name === SESSION_COOKIE)?.value ?? "";
+    const cookie = `${CSRF_COOKIE}=${token}; ${SESSION_COOKIE}=${session}`;
+
+    expect((await app.inject({ method: "GET", url: "/api/jobs" })).statusCode).toBe(401);
+    const jobs = await app.inject({ method: "GET", url: "/api/jobs", headers: { cookie } });
+    expect(jobs.statusCode).toBe(200);
+    expect(jobs.json<{ jobs: { id: string }[] }>().jobs.map((job) => job.id)).toEqual([
+      "refresh-health",
+      "network-diagnostics",
+      "support-bundle"
+    ]);
+
+    const unknown = await app.inject({
+      method: "POST",
+      url: "/api/jobs/arbitrary-shell/runs",
+      headers: { ...mutationHeaders(token), cookie }
+    });
+    expect(unknown.statusCode).toBe(404);
+    expect(unknown.json()).toMatchObject({ error: { code: "JOB_NOT_FOUND" } });
+
+    const queued = await app.inject({
+      method: "POST",
+      url: "/api/jobs/refresh-health/runs",
+      headers: { ...mutationHeaders(token), cookie }
+    });
+    expect(queued.statusCode).toBe(202);
+    const runId = queued.json<{ id: string }>().id;
+    let run: { status: string } = { status: "queued" };
+    for (let attempt = 0; attempt < 50 && ["queued", "running"].includes(run.status); attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 2));
+      const response = await app.inject({ method: "GET", url: `/api/job-runs/${runId}`, headers: { cookie } });
+      expect(response.statusCode).toBe(200);
+      run = response.json<{ status: string }>();
+    }
+    expect(run.status).toBe("succeeded");
+  });
 });