Fix admin authorization and harden chat requests

test/regenerationUi.test.js

@@ -35,6 +35,12 @@ test("inline renderer streams in place, follows only nearby output, commits or r
     const oldDocument = globalThis.document, oldFetch = globalThis.fetch;
     t.after(() => { globalThis.document = oldDocument; globalThis.fetch = oldFetch; });
     globalThis.document = {createElement: tag => new Element(tag)};
+    const frames = new Map();
+    let frameId = 0;
+    const oldRequestFrame = globalThis.requestAnimationFrame, oldCancelFrame = globalThis.cancelAnimationFrame;
+    globalThis.requestAnimationFrame = callback => { frames.set(++frameId, callback); return frameId; };
+    globalThis.cancelAnimationFrame = id => frames.delete(id);
+    t.after(() => { globalThis.requestAnimationFrame = oldRequestFrame; globalThis.cancelAnimationFrame = oldCancelFrame; });
     for (const outcome of ["success", "error", "disconnect"]) {
         const scroller = new Element(), card = new Element(), later = new Element();
         const header = new Element(), oldBody = new Element(), actions = new Element(), oldSources = new Element();
@@ -52,6 +58,7 @@ test("inline renderer streams in place, follows only nearby output, commits or r
         const event = async (name, data) => {
             controller.enqueue(new TextEncoder().encode(`event: ${name}\ndata: ${JSON.stringify(data)}\n\n`));
             await new Promise(resolve => setTimeout(resolve, 0));
+            for (const callback of [...frames.values()]) callback();
         };
         assert.equal(card.attributes["aria-busy"], "true");
         assert.equal(card.querySelector(".msg-sources"), null);
@@ -60,15 +67,15 @@ test("inline renderer streams in place, follows only nearby output, commits or r
         assert.equal(card.querySelector(".loading-shell").textContent, "Searching the web...");
         await event("status", {status: "generating", sources: [{title: "New source", url: "https://example.org/new"}]});
         assert.notEqual(card.querySelector(".msg-sources"), oldSources);
-        await event("thinking", {fullThinking: "New reasoning"});
+        await event("thinking", {chunk: "New reasoning"});
         assert.equal(card.querySelector(".msg-reasoning-content").textContent, "New reasoning");
-        await event("chunk", {fullReply: "Partial"});
+        await event("chunk", {chunk: "Partial"});
         assert.equal(card.querySelector(".msg-content").textContent, "Partial");
         assert.equal(scroller.scrollTop, 20);
         assert.equal(completed, undefined);
         assert.deepEqual(scroller.childNodes, [card, later]);
         card.bottom = 1000; // User has scrolled away from this response.
-        await event("chunk", {fullReply: "Partial answer"});
+        await event("chunk", {chunk: " answer"});
         assert.equal(scroller.scrollTop, 20);
         if (outcome === "success") {
             await event("done", {reply: "Partial answer", message: {id: 2, content: "Partial answer"}});