feat(cloud): remove static credentials and add host console

apps/cloud-api/tests/test_app.py

@@ -9,7 +9,7 @@ from fastapi.testclient import TestClient
 
 import cloud_api.app as app_module
 from cloud_api.app import create_app
-from cloud.auth import BearerCredential, EnrollmentCredential, digest_token
+from cloud.auth import digest_token
 from cloud.control_config import CloudConfigurationError, CloudControlConfig
 from cloud.database import CloudDatabase
 from cloud.pool import PooledDevice
@@ -33,24 +33,8 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
     tmp_path,
 ) -> None:
     database_url = f"sqlite:///{(tmp_path / 'enrollment.sqlite3').as_posix()}"
-    enrollment_token = "one-time-enrollment-token"
     host_token = "host-token-" + ("x" * 40)
-    config = CloudControlConfig(
-        database_url=database_url,
-        credentials=(
-            BearerCredential(
-                principal_id="operator",
-                token="operator-token",
-                scopes=frozenset({"pool:read"}),
-            ),
-        ),
-        enrollment_credentials=(
-            EnrollmentCredential(
-                principal_id="installer-a",
-                token=enrollment_token,
-            ),
-        ),
-    )
+    config = CloudControlConfig(database_url=database_url)
     enrollment_payload = {
         "agent_instance_id": "agent-instance-a",
         "host_token": host_token,
@@ -61,7 +45,6 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
     with TestClient(app) as client:
         enrolled = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json=enrollment_payload,
         )
         assert enrolled.status_code == 201
@@ -70,21 +53,21 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
 
         retried = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json=enrollment_payload,
         )
         assert retried.status_code == 201
         assert retried.json()["host_id"] == host_id
 
-        reused = client.post(
+        another_host = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json={
                 **enrollment_payload,
                 "agent_instance_id": "agent-instance-b",
+                "host_token": "host-token-" + ("y" * 40),
             },
         )
-        assert reused.status_code == 409
+        assert another_host.status_code == 201
+        assert another_host.json()["host_id"] != host_id
 
         device = client.post(
             f"/internal/v1/hosts/{host_id}/devices/enroll",
@@ -601,14 +584,16 @@ def _wait_until(predicate, timeout_seconds: float = 1.0) -> bool:
     return False
 
 
-def test_production_app_rejects_missing_credentials() -> None:
-    with pytest.raises(CloudConfigurationError, match="credential"):
-        create_app(
-            config=CloudControlConfig(
-                environment="production",
-                database_url="postgresql://db/cloud",
-            )
+def test_production_app_allows_no_static_credentials() -> None:
+    app = create_app(
+        config=CloudControlConfig(
+            environment="production",
+            database_url="postgresql://db/cloud",
+            session_cookie_secure=True,
         )
+    )
+
+    assert app.title == "Device Cloud API"
 
 
 def test_cors_headers_are_absent_when_allow_list_is_empty() -> None: