v0.24.5

docs/MOCK_AUTH.md

@@ -0,0 +1,37 @@
+# Fake Tinyauth protocol peer - local development only
+
+This is NOT authentication. Any client can mint the allow cookie. The fixture binds
+only to 127.0.0.1 and must never protect a production application.
+
+```bash
+bash dev.sh mock --port 9001 --name origin-a --ttl 30
+# Separate terminal:
+bash dev.sh mock-auth --port 9300
+```
+
+In a disposable vhost's Authentication tab, set:
+- verifier: http://127.0.0.1:9300 (adds /api/auth/nginx)
+- login: http://127.0.0.1:9300/login
+- explicitly allow private verifier IPs
+- forwarded identities: remote-user and remote-email
+
+Use your actual frontend address/hostname. Example for a local plain-HTTP vhost:
+
+```bash
+# Denied -> 302 to configured login, no application request:
+curl -i -H 'Host: app.localhost' http://127.0.0.2:8181/inspect
+# Allowed -> app receives mock-user / mock@example.test; cache remains BYPASS:
+curl -i -H 'Host: app.localhost' -H 'Cookie: mock_auth=allow' http://127.0.0.2:8181/inspect
+# Force authentication failure even with an allow cookie:
+curl -X POST -H 'Content-Type: application/json' -d '{"status":503}' http://127.0.0.1:9300/control
+# Simulate slow verifier; choose less than or greater than the vhost total timeout:
+curl -X POST -H 'Content-Type: application/json' -d '{"delay_ms":12000}' http://127.0.0.1:9300/control
+# Restore default deny/allow behavior:
+curl -X POST -H 'Content-Type: application/json' -d '{"reset":true}' http://127.0.0.1:9300/control
+curl http://127.0.0.1:9300/state
+```
+
+/control replaces status/delay/redirect behavior (omitted values reset to defaults).
+Optional location sets X-Tinyauth-Location for redirect-policy tests. /state exposes
+only the last 16 metadata records, not Authorization, cookies or query strings.
+Real Rust-router auth tests are in tests/integrations.rs.