n.siegfried
357712e93e
Every /api/ route but /api/health requires a session and the script sent none, so it could not seed anything. It predates the commit that taught the smoke test to sign in. It now signs in the same way, reusing smoketest.py's build_opener rather than growing a second cookie-jar implementation - one login flow, one place to fix. Credentials come from WP_SEED_USER / WP_SEED_PASSWORD, falling back to WP_SMOKE_USER / WP_SMOKE_PASSWORD so one set serves both scripts, and it signs out in a finally. No bypass, no debug flag, no unauthenticated seeding route: the diff touches server/seed_demo.py and nothing else, adds no route decorator anywhere, and the 33 get_current_user dependencies in app.py are untouched. The script authenticates like a client; the server is not weaker than it was. Two things found while fixing it: The failure mode was worse than a refusal. call() swallowed the HTTPError and returned the error body, so a 401 surfaced as a KeyError on proj["id"] three lines later - which reads like a broken stack rather than a missing session. Writes now go through expect(), which stops on the first refusal and prints the status and detail. Running it twice used to print a note that scrolled past and then create a second identical DEMO project, leaving two of everything with no way to tell them apart. It now refuses, names what exists, and prints the --clean command. Also corrected the header's own instructions, which said the seeded SOP and Work Packages would NOT render in the UI because the front end still read them from localStorage "pending Phase 2 wiring". That stopped being true when the sync layer landed. Selecting the seeded project now shows 7 Work Package cards in the Field View, so anyone using the UI to check whether seeding worked is no longer told to expect nothing. Verified against a freshly started instance: no credentials aborts cleanly with exit 2 and no traceback; a first run exits 0 and seeds a project, a complete SOP and 9 packages; a second run exits 1 without duplicating; the data is visible in the picker, the hero, the app bar and the Field View; --clean removes it and exits 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>