Add SSH-managed node registry with connection testing and reauth.

Register hosts under Containers/VMs/Docker with encrypted key storage, and require re-authentication for sensitive account changes.

service/internal/api/groups_handlers_test.go

@@ -18,7 +18,7 @@ type apiErrorResponseTest struct {
 	Error string `json:"error"`
 }
 
-func TestGroupsGetEmptyWhenNoGroups(t *testing.T) {
+func TestGroupsGetIncludesAdministratorsFromSetup(t *testing.T) {
 	configDir := t.TempDir()
 	cookie := seedCompletedSetup(t, configDir)
 	router := NewRouter(configDir)
@@ -36,8 +36,8 @@ func TestGroupsGetEmptyWhenNoGroups(t *testing.T) {
 		t.Fatalf("decode response: %v", err)
 	}
 
-	if payload.Groups == nil || len(payload.Groups) != 0 {
-		t.Fatalf("expected empty groups list, got %#v", payload.Groups)
+	if len(payload.Groups) != 1 || payload.Groups[0].Name != settings.AdministratorsGroupName {
+		t.Fatalf("expected Administrators group from seed, got %#v", payload.Groups)
 	}
 }
 
@@ -118,14 +118,20 @@ func TestGroupsUpsertUpsertsByName(t *testing.T) {
 	if err := json.NewDecoder(getRec.Body).Decode(&getPayload); err != nil {
 		t.Fatalf("decode response: %v", err)
 	}
-	if len(getPayload.Groups) != 1 {
-		t.Fatalf("expected 1 group, got %d", len(getPayload.Groups))
+	if len(getPayload.Groups) != 2 {
+		t.Fatalf("expected 2 groups (Administrators + Admins), got %d", len(getPayload.Groups))
 	}
-	if getPayload.Groups[0].Name != "Admins" {
-		t.Fatalf("expected group name %q, got %q", "Admins", getPayload.Groups[0].Name)
+	var admins *settings.Group
+	for index := range getPayload.Groups {
+		if getPayload.Groups[index].Name == "Admins" {
+			admins = &getPayload.Groups[index]
+		}
 	}
-	if getPayload.Groups[0].ScopeName != "node-2" {
-		t.Fatalf("expected scope_name %q, got %q", "node-2", getPayload.Groups[0].ScopeName)
+	if admins == nil {
+		t.Fatal("expected Admins group")
+	}
+	if admins.ScopeName != "node-2" {
+		t.Fatalf("expected scope_name %q, got %q", "node-2", admins.ScopeName)
 	}
 }
 
@@ -167,8 +173,8 @@ func TestGroupsDeleteRemovesByName(t *testing.T) {
 	if err := json.NewDecoder(getRec.Body).Decode(&getPayload); err != nil {
 		t.Fatalf("decode response: %v", err)
 	}
-	if len(getPayload.Groups) != 0 {
-		t.Fatalf("expected empty groups, got %#v", getPayload.Groups)
+	if len(getPayload.Groups) != 1 || getPayload.Groups[0].Name != settings.AdministratorsGroupName {
+		t.Fatalf("expected only Administrators remaining, got %#v", getPayload.Groups)
 	}
 }