=== RUN   TestToken_SessionOnlyRoutesRefuseEveryToken
    tokens_test.go:292: POST / with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Felhom Hub — Customer Overview</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n    <meta http-equiv=\"refresh\" content=\"60\">\n</head>\n<body>\n    <s
    tokens_test.go:292: POST /style.css with an all-scope token: 200 "/* Felhom Hub — Dark theme */\n/* Felhom Hub — design system v2 (TASK-D4). Canonical tokens:\n   documentation/design/design-system.md */\n\n@font-face {\n    font-family: 'Plus Jakarta Sans';\n    font-style: normal;\n    font-weight: 400 800;\n    font-display: swap;\n    src: url('/static/fonts/pjs-latin.woff2') format('w
    tokens_test.go:292: POST /static/chart.min.js with an all-scope token: 200 "/**\n * Skipped minification because the original files appears to be already minified.\n * Original file: /npm/chart.js@4.4.7/dist/chart.umd.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n/*!\n * Chart.js v4.4.7\n * https://www.
    tokens_test.go:292: POST /static/fonts/x1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /configuration with an all-scope token: 303 "", want 403 session only
    tokens_test.go:292: POST /apps with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Apps — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"display:non
    tokens_test.go:292: POST /apps/ with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Apps — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"display:no
    tokens_test.go:292: GET /apps/x1/reset-telemetry with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /apps/x1/reset-telemetry with an all-scope token: 303 "", want 403 session only
    tokens_test.go:292: GET /apps/x1/dismiss-issues with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /apps/x1/dismiss-issues with an all-scope token: 400 "Invalid action\n", want 403 session only
    tokens_test.go:292: POST /apps/x1 with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>x1 — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n    <script src=\"/static/chart.min.js\"></script>\n    \n<script>\n\n\nfunction 
    tokens_test.go:292: POST /offsite with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Offsite — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"displ
    tokens_test.go:292: GET /offsite/endpoints with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /offsite/endpoints with an all-scope token: 400 "Invalid endpoint id (use lowercase letters, digits, hyphens) — nothing stored.\n", want 403 session only
    tokens_test.go:292: GET /offsite/endpoints/x1/delete with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /offsite/endpoints/x1/delete with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /hosts with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Hosts — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"display:n
    tokens_test.go:292: POST /hosts/ with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Hosts — Felhom Hub</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"display:
    tokens_test.go:292: POST /system with an all-scope token: 503 "os updates not configured\n", want 403 session only
    tokens_test.go:292: GET /appliances/x1/bind with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /appliances/x1/bind with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /appliances/x1/discard with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /appliances/x1/discard with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /hosts/x1/delete-impact with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /hosts/x1/delete-impact with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /hosts/x1/delete with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /hosts/x1/delete with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /hosts/x1/reveal-recovery-credential with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /hosts/x1/reveal-recovery-credential with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /hosts/x1/operator-action with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /hosts/x1/request-logs with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /hosts/x1/log-bundles/y1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /hosts/x1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/block with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/selfbind-link with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /customers/x1/selfbind-link with an all-scope token: 502 "Self-bind mailer is not configured on this hub\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/unblock with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/geo/disable with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/floor with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/create-config with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /customers/x1/dr-recipe.json with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /customers/x1/request-log-tail with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /customers/x1/log-tail/y1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /customers/x1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /customers/x1 with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /configs with an all-scope token: 200 "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Felhom Hub — Customers</title>\n    <link rel=\"stylesheet\" href=\"/style.css?v=test\">\n</head>\n<body>\n    <svg xmlns=\"http://www.w3.org/2000/svg\" style=\"dis
    tokens_test.go:292: POST /configuration/global-floor/impact with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configuration/global-floor with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configuration/artifacts with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configuration/mail-hold/release with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configuration/password with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /configuration/password with an all-scope token: 303 "", want 403 session only
    tokens_test.go:292: GET /configuration/tokens with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configuration/tokens/x1/revoke with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/delete with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /configs/x1/delete with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /offsite/remove-unpinned/x1 with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: POST /offsite/remove-unpinned/x1 with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: GET /offsite/abandon-cancel/x1 with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: POST /offsite/abandon-cancel/x1 with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: GET /offsite/window-grant/x1 with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: GET /offsite/windows-enabled with an all-scope token: 503 "unavailable\n", want 403 session only
    tokens_test.go:292: GET /offsite/key-audit with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/offsite-reissue with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/claim-resend with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/pbsdr-reissue with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/offsite-freeze with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/preview with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /configs/x1/preview with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: GET /configs/x1/regen-password with an all-scope token: 405 "Method not allowed\n", want 403 session only
    tokens_test.go:292: POST /configs/x1/regen-password with an all-scope token: 303 "", want 403 session only
    tokens_test.go:292: GET /configs/x1/reset with an all-scope token: 404 "404 page not found\n", want 403 session only
    tokens_test.go:292: POST /configs/x1/reset with an all-scope token: 404 "404 page not found\n", want 403 session only
--- FAIL: TestToken_SessionOnlyRoutesRefuseEveryToken (0.09s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-hub/internal/web	0.107s
FAIL
