From f487a001a225b57355c7b2c764cb7aec508bbc43 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <adambrettmalin@protonmail.com>
Date: Wed, 19 Aug 2026 23:11:23 -0400
Subject: [PATCH] Test job-profile revocation, completing the routes.ts sweep

The job-profile surface had no API test at all. The DELETE is the one that
matters: without its existence check it answers 200 "revoked" for a job that
never existed, so an operator revoking an agent's access is TOLD it worked
while nothing happened. For a revocation that is the worst available answer.
Revoking twice is asserted too, since a second success is how the false
positive shows itself.

routes.ts now sweeps to zero survivors across all 85 mutants under the
refusal-based selection, up from 30 mutants under the old vocabulary rule.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
---
 js/packages/cli/test/api.test.ts | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/js/packages/cli/test/api.test.ts b/js/packages/cli/test/api.test.ts
index be94704c..825067ff 100644
--- a/js/packages/cli/test/api.test.ts
+++ b/js/packages/cli/test/api.test.ts
@@ -1020,6 +1020,31 @@ describe("totp, config, relays, stats", () => {
     await call("POST", "/api/v1/relays/reset");
   });
 
+  it("revokes a job profile only if there was one to revoke", async () => {
+    // The whole job-profile surface had no API test. The one that matters is
+    // the DELETE: without its check it answers 200 "revoked" for a job that
+    // never existed, so an operator revoking access is TOLD it worked while
+    // nothing happened — the worst possible answer for a revocation.
+    expect((await call("DELETE", "/api/v1/agent/job-profiles/never-existed")).status)
+      .toBe(404);
+
+    const created = await call("POST", "/api/v1/agent/job-profiles", {
+      body: { id: "nightly-backup", query: "label:bank" },
+    });
+    expect(created.status).toBe(201);
+    expect(
+      (await call("GET", "/api/v1/agent/job-profiles")).text,
+    ).toContain("nightly-backup");
+
+    const revoked = await call("DELETE", "/api/v1/agent/job-profiles/nightly-backup");
+    expect(revoked.status).toBe(200);
+    expect(revoked.json.revoked).toBe("nightly-backup");
+
+    // Revoking it a second time must NOT report success again.
+    expect((await call("DELETE", "/api/v1/agent/job-profiles/nightly-backup")).status)
+      .toBe(404);
+  });
+
   it("reports profile statistics", async () => {
     const res = await call("GET", "/api/v1/stats");
     expect(res.json.fingerprint).toBe(FINGERPRINT);