Split web and player build artifacts

test/web-middleware.test.js

@@ -0,0 +1,44 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('path');
+
+const registerMiddleware = require('../src/web/middleware');
+
+test('web middleware bypasses auth for internal player sync routes', () => {
+  const calls = [];
+  const app = {
+    middlewares: [],
+    use(...args) {
+      this.middlewares.push(args);
+    }
+  };
+
+  registerMiddleware(app, {
+    pool: {},
+    loadCurrentUser: async () => null,
+    requireAuth(req, _res, next) {
+      calls.push(req.path);
+      next();
+    },
+    MEDIA_DIR: path.join(process.cwd(), 'media'),
+    UPLOADS_DIR: path.join(process.cwd(), 'media', 'uploads-test'),
+    THUMBNAILS_DIR: path.join(process.cwd(), 'media', 'thumbnails-test'),
+    ASSET_DIR: path.join(process.cwd(), 'src', 'web', 'public')
+  });
+
+  const authGate = app.middlewares[app.middlewares.length - 1][0];
+  const nextCalls = [];
+
+  authGate({ path: '/api/internal/sync/player-media' }, {}, function () {
+    nextCalls.push('media');
+  });
+  authGate({ path: '/api/internal/sync/player-font' }, {}, function () {
+    nextCalls.push('font');
+  });
+  authGate({ path: '/dashboard' }, {}, function () {
+    nextCalls.push('dashboard');
+  });
+
+  assert.deepEqual(nextCalls, ['media', 'font', 'dashboard']);
+  assert.deepEqual(calls, ['/dashboard']);
+});