Verify cross-roster admin analysis and log actor role

app.py

@@ -250,8 +250,8 @@ app = FastAPI(title="Sporalize AI", lifespan=lifespan)
 @app.exception_handler(httpx.HTTPStatusError)
 async def backend_error(request: Request, error: httpx.HTTPStatusError):
     status = error.response.status_code
-    logger.error("Analysis backend request failed: path=%s status=%s response=%s",
-        request.url.path, status, error.response.text[:500])
+    logger.error("Analysis backend request failed: path=%s status=%s actor_is_admin=%s response=%s",
+        request.url.path, status, getattr(request.state, "is_admin", False), error.response.text[:500])
     try:
         backend_body = error.response.json()
     except ValueError:

tests/analysis-admin.test.ts

@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+import express from "express";
+import type { SupabaseClient } from "@supabase/supabase-js";
+
+test("an administrator can start analysis for another user's player", async () => {
+  Object.assign(process.env, {
+    NODE_ENV: "test",
+    FRONTEND_URL: "http://127.0.0.1:3000",
+    BACKEND_URL: "http://127.0.0.1:4000",
+    ANALYSIS_PROXY_SECRET: "test-analysis-proxy-secret-32-chars",
+    SUPABASE_URL: "http://127.0.0.1:54321",
+    SUPABASE_ANON_KEY: "test-anon-key",
+    SUPABASE_SERVICE_ROLE_KEY: "test-service-role-key",
+  });
+  const { analysisRouter } = await import("../src/analysis.js");
+  const adminId = "11111111-1111-4111-8111-111111111111";
+  const ownerId = "22222222-2222-4222-8222-222222222222";
+  const playerId = "33333333-3333-4333-8333-333333333333";
+  const clientId = "44444444-4444-4444-8444-444444444444";
+  const filters: [string, string][] = [];
+  const rpcCalls: { name: string; args: Record<string, unknown> }[] = [];
+  const db = {
+    from(table: string) {
+      assert.equal(table, "players");
+      const query = {
+        select() { return query; },
+        eq(column: string, value: string) { filters.push([column, value]); return query; },
+        async maybeSingle() { return { data: { player_id: playerId, user_id: ownerId }, error: null }; },
+      };
+      return query;
+    },
+    async rpc(name: string, args: Record<string, unknown>) {
+      rpcCalls.push({ name, args });
+      return { error: null };
+    },
+  } as unknown as SupabaseClient;
+  const secret = "test-analysis-proxy-secret-32-chars";
+  const app = express();
+  app.use("/internal/analysis", analysisRouter(db, secret));
+  const server = createServer(app);
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  try {
+    const port = (server.address() as AddressInfo).port;
+    const response = await fetch(`http://127.0.0.1:${port}/internal/analysis`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-sporalize-proxy-secret": secret,
+        "x-sporalize-user-id": adminId,
+        "x-sporalize-admin": "true",
+      },
+      body: JSON.stringify({ clientId, playerId, name: "Admin analysis" }),
+    });
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), {
+      session_id: clientId, player_id: playerId, user_id: ownerId,
+      by_admin: true, actor_is_admin: true,
+    });
+    assert.deepEqual(filters, [["player_id", playerId]]);
+    assert.deepEqual(rpcCalls, [{ name: "admin_create_analysis_session", args: {
+      p_session_id: clientId, p_user_id: ownerId, p_player_id: playerId,
+      p_name: "Admin analysis", p_path: `sessions/${clientId}`, p_by_admin: true,
+    } }]);
+  } finally {
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+  }
+});