fix: add bounded JD code-channel auth inspection

server-tools/lake-lamp-authz/action-broker.test.js

@@ -0,0 +1,23 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { ACTIONS, REMOTE_COMMANDS } = require("./action-broker");
+
+test("the JD action broker implements every read-only server-login action", () => {
+  assert.equal(typeof ACTIONS["JD-FD-PRIMARY:inspect-services"], "function");
+  assert.equal(typeof ACTIONS["JD-FD-PRIMARY:health-check"], "function");
+  assert.equal(typeof ACTIONS["JD-FD-PRIMARY:inspect-code-channel-owner-auth"], "function");
+});
+
+test("owner authentication inspection exposes state but never password material", () => {
+  const command = REMOTE_COMMANDS["JD-FD-PRIMARY:inspect-code-channel-owner-auth"];
+  assert.match(command, /is_active/);
+  assert.match(command, /prohibit_login/);
+  assert.match(command, /passwd_hash_algo/);
+  assert.match(command, /length\(passwd\)/);
+  assert.match(command, /length\(salt\)/);
+  assert.doesNotMatch(command, /select\s+passwd(?:\s|,)/i);
+  assert.doesNotMatch(command, /select\s+salt(?:\s|,)/i);
+  assert.doesNotMatch(command, /access_token|authorization|secret_key/i);
+});