Protect Tabularium with persistent authenticator-code login

scripts/ci.py

@@ -35,22 +35,30 @@ def fingerprint() -> str:
 
 
 def smoke_image(image: str, name: str) -> None:
-    from smoke import verify
-    run("docker", "run", "-d", "--name", name, "-p", "127.0.0.1::3000", image)
+    run("docker", "run", "-d", "--name", name, "--mount", "type=volume,dst=/auth", "-p", "127.0.0.1::3000", image)
     try:
-        port = run("docker", "port", name, "3000/tcp", capture=True).rsplit(":", 1)[1]
+        run("docker", "exec", name, "node", "apps/docs/auth-cli.cjs", "init")
         for _ in range(60):
             state = json.loads(run("docker", "inspect", name, capture=True))[0]["State"]
             if state.get("Health", {}).get("Status") == "healthy":
-                verify(f"http://127.0.0.1:{port}")
-                return
+                run("docker", "exec", name, "node", "apps/docs/auth-cli.cjs", "exercise")
+                run("docker", "restart", name)
+                # Counter/replay state is on the same durable mount after restart.
+                run("docker", "exec", name, "node", "apps/docs/auth-cli.cjs", "state-check")
+                for _ in range(30):
+                    state = json.loads(run("docker", "inspect", name, capture=True))[0]["State"]
+                    if state.get("Health", {}).get("Status") == "healthy":
+                        run("docker", "exec", name, "node", "apps/docs/auth-cli.cjs", "verify")
+                        return
+                    time.sleep(1)
+                raise RuntimeError("Authenticated image failed restart verification")
             if not state["Running"]:
                 break
             time.sleep(1)
         run("docker", "logs", "--tail", "80", name)
         raise RuntimeError("Production image did not become healthy")
     finally:
-        run("docker", "rm", "-f", name)
+        run("docker", "rm", "-fv", name)
 
 
 def main() -> None: