# Fake Tinyauth protocol peer - local development only

This is NOT authentication. Any client can mint the allow cookie. The fixture binds
only to 127.0.0.1 and must never protect a production application.

```bash
bash dev.sh mock --port 9001 --name origin-a --ttl 30
# Separate terminal:
bash dev.sh mock-auth --port 9300
```

In a disposable vhost's Authentication tab, set:
- verifier: http://127.0.0.1:9300 (adds /api/auth/nginx)
- login: http://127.0.0.1:9300/login
- explicitly allow private verifier IPs
- forwarded identities: remote-user and remote-email

Use your actual frontend address/hostname. Example for a local plain-HTTP vhost:

```bash
# Denied -> 302 to configured login, no application request:
curl -i -H 'Host: app.localhost' http://127.0.0.2:8181/inspect
# Allowed -> app receives mock-user / mock@example.test; cache remains BYPASS:
curl -i -H 'Host: app.localhost' -H 'Cookie: mock_auth=allow' http://127.0.0.2:8181/inspect
# Force authentication failure even with an allow cookie:
curl -X POST -H 'Content-Type: application/json' -d '{"status":503}' http://127.0.0.1:9300/control
# Simulate slow verifier; choose less than or greater than the vhost total timeout:
curl -X POST -H 'Content-Type: application/json' -d '{"delay_ms":12000}' http://127.0.0.1:9300/control
# Restore default deny/allow behavior:
curl -X POST -H 'Content-Type: application/json' -d '{"reset":true}' http://127.0.0.1:9300/control
curl http://127.0.0.1:9300/state
```

/control replaces status/delay/redirect behavior (omitted values reset to defaults).
Optional location sets X-Tinyauth-Location for redirect-policy tests. /state exposes
only the last 16 metadata records, not Authorization, cookies or query strings.
Real Rust-router auth tests are in tests/integrations.rs.