Login feature flag added.

tests/auth-client.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "bun:test";
 import {
-  fetchCurrentUser,
+  fetchAuthStatus,
   login,
   logout,
   register,
@@ -64,32 +64,38 @@ describe("validatePassword", () => {
   });
 });
 
-describe("fetchCurrentUser (fail-silent /me)", () => {
+describe("fetchAuthStatus (fail-silent /me)", () => {
   test("returns the user on 200", async () => {
     const { fetch, calls } = mockFetch(jsonResponse(200, { user: USER }));
-    expect(await fetchCurrentUser(fetch)).toEqual(USER);
+    expect(await fetchAuthStatus(fetch)).toEqual({ enabled: true, user: USER });
     // The cookie is HttpOnly — it must ride along via same-origin credentials.
     expect(calls[0]?.input).toBe("/api/auth/me");
     expect(calls[0]?.init?.credentials).toBe("same-origin");
   });
 
-  test("resolves to anonymous (null) on 401", async () => {
+  test("resolves to anonymous (null user) on 401", async () => {
     const { fetch } = mockFetch(jsonResponse(401, { error: "unauthorized" }));
-    expect(await fetchCurrentUser(fetch)).toBeNull();
+    expect(await fetchAuthStatus(fetch)).toEqual({ enabled: true, user: null });
   });
 
-  test("resolves to anonymous on network failure (offline-first)", async () => {
+  test("resolves to disabled on 404 (AUTH_ENABLED=false, D-015)", async () => {
+    const { fetch } = mockFetch(jsonResponse(404, { error: "Not Found" }));
+    expect(await fetchAuthStatus(fetch)).toEqual({ enabled: false, user: null });
+  });
+
+  test("resolves to disabled on network failure (offline-first)", async () => {
     // /api/* is network-only in the service worker, so offline /me rejects.
-    // That must NOT throw or surface an error — just stay anonymous.
+    // That must NOT throw or surface an error — the auth UI just stays
+    // hidden (signing in is impossible without the server anyway).
     const { fetch } = mockFetch(new TypeError("Failed to fetch"));
-    expect(await fetchCurrentUser(fetch)).toBeNull();
+    expect(await fetchAuthStatus(fetch)).toEqual({ enabled: false, user: null });
   });
 
   test("resolves to anonymous on a malformed body", async () => {
     const { fetch } = mockFetch(
       new Response("<html>proxy error</html>", { status: 200 }),
     );
-    expect(await fetchCurrentUser(fetch)).toBeNull();
+    expect(await fetchAuthStatus(fetch)).toEqual({ enabled: true, user: null });
   });
 });