remove demo code

tests/integration/website/websiteAuth.ts

@@ -6,16 +6,7 @@ export type WebsiteAuthContext = 'public' | 'auth' | 'admin' | 'sponsor';
 export type WebsiteSessionDriftMode = 'invalid-cookie' | 'expired' | 'missing-sponsor-id';
 export type WebsiteFaultMode = 'null-array' | 'missing-field' | 'invalid-date';
 
-type DemoLoginRole =
-  | 'driver'
-  | 'sponsor'
-  | 'league-owner'
-  | 'league-steward'
-  | 'league-admin'
-  | 'system-owner'
-  | 'super-admin';
-
-const demoSessionCookieCache = new Map<DemoLoginRole, string>();
+const demoSessionCookieCache = new Map<string, string>();
 
 export function authContextForAccess(access: RouteAccess): WebsiteAuthContext {
   if (access === 'public') return 'public';
@@ -33,23 +24,8 @@ function getWebsiteBaseUrl(): string {
   return 'http://localhost:3100';
 }
 
-function demoLoginRoleForAuthContext(auth: WebsiteAuthContext): DemoLoginRole | null {
-  switch (auth) {
-    case 'public':
-      return null;
-    case 'auth':
-      return 'driver';
-    case 'sponsor':
-      return 'sponsor';
-    case 'admin':
-      // Website "admin" pages need an elevated role; use the strongest demo role.
-      return 'super-admin';
-    default: {
-      const exhaustive: never = auth;
-      return exhaustive;
-    }
-  }
-}
+// Note: All authenticated contexts use the same seeded demo driver user
+// Role-based access control is tested separately in integration tests
 
 function extractCookieValue(setCookieHeader: string, cookieName: string): string | null {
   // set-cookie header value: "name=value; Path=/; HttpOnly; ..."
@@ -58,24 +34,27 @@ function extractCookieValue(setCookieHeader: string, cookieName: string): string
   return match?.[1] ?? null;
 }
 
-async function ensureDemoSessionCookie(role: DemoLoginRole): Promise<string> {
-  const cached = demoSessionCookieCache.get(role);
+async function ensureNormalSessionCookie(): Promise<string> {
+  const cached = demoSessionCookieCache.get('driver');
   if (cached) return cached;
 
   const baseUrl = getWebsiteBaseUrl();
-  const url = `${baseUrl}/api/auth/demo-login`;
+  const url = `${baseUrl}/api/auth/login`;
 
   const response = await fetch(url, {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
     },
-    body: JSON.stringify({ role }),
+    body: JSON.stringify({
+      email: 'demo.driver@example.com',
+      password: 'Demo1234!',
+    }),
   });
 
   if (!response.ok) {
     const body = await response.text().catch(() => '');
-    throw new Error(`Smoke demo-login failed for role=${role}. ${response.status} ${response.statusText}. ${body}`);
+    throw new Error(`Normal login failed. ${response.status} ${response.statusText}. ${body}`);
   }
 
   // In Node (playwright runner) `headers.get('set-cookie')` returns a single comma-separated string.
@@ -91,18 +70,18 @@ async function ensureDemoSessionCookie(role: DemoLoginRole): Promise<string> {
   const gpSessionPair = cookieHeaderPairs.find((pair) => pair.startsWith('gp_session='));
   if (!gpSessionPair) {
     throw new Error(
-      `Smoke demo-login did not return gp_session cookie for role=${role}. set-cookie header: ${rawSetCookie}`,
+      `Normal login did not return gp_session cookie. set-cookie header: ${rawSetCookie}`,
     );
   }
 
   const gpSessionValue = extractCookieValue(gpSessionPair, 'gp_session');
   if (!gpSessionValue) {
     throw new Error(
-      `Smoke demo-login returned a gp_session cookie, but it could not be parsed for role=${role}. Pair: ${gpSessionPair}`,
+      `Normal login returned a gp_session cookie, but it could not be parsed. Pair: ${gpSessionPair}`,
     );
   }
 
-  demoSessionCookieCache.set(role, gpSessionValue);
+  demoSessionCookieCache.set('driver', gpSessionValue);
   return gpSessionValue;
 }
 
@@ -128,12 +107,10 @@ export async function setWebsiteAuthContext(
     return;
   }
 
-  const demoRole = demoLoginRoleForAuthContext(auth);
-  if (!demoRole) {
-    throw new Error(`Expected a demo role for auth context ${auth}`);
-  }
-
-  const gpSessionValue = await ensureDemoSessionCookie(demoRole);
+  // For authenticated contexts, use normal login with seeded demo user
+  // Note: All auth contexts use the same seeded demo driver user for simplicity
+  // Role-based access control is tested separately in integration tests
+  const gpSessionValue = await ensureNormalSessionCookie();
 
   // Only set gp_session cookie (no demo mode or sponsor cookies)
   // For Docker/local testing, ensure cookies work with localhost