feat: connect settings live flow to auth api

apps/admin-api/src/app.rs

@@ -14,7 +14,7 @@ use crate::{
             create_agent, delete_agent, get_agent, get_agent_version, list_agents, publish_agent,
             save_agent_bindings, update_agent,
         },
-        auth::{get_session, login, logout},
+        auth::{change_password, get_profile, get_session, login, logout, update_profile},
         auth_profiles::{create_auth_profile, get_auth_profile, list_auth_profiles},
         observability::{get_agent_usage, get_log, get_operation_usage, get_usage, list_logs},
         operations::{
@@ -137,14 +137,23 @@ pub fn build_app(state: AppState) -> Router {
 
     let admin_router = workspace_root_router.merge(workspace_scoped_router);
 
+    let protected_auth_router = Router::new()
+        .route("/logout", post(logout))
+        .route("/session", get(get_session))
+        .route("/profile", get(get_profile).patch(update_profile))
+        .route("/password", post(change_password))
+        .layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_session,
+        ));
+
     Router::new()
         .route("/health", get(crate::routes::health))
         .nest(
             "/api/auth",
             Router::new()
                 .route("/login", post(login))
-                .route("/logout", post(logout))
-                .route("/session", get(get_session)),
+                .merge(protected_auth_router),
         )
         .nest("/api/admin", admin_router)
         .with_state(state)
@@ -756,6 +765,77 @@ mod tests {
         assert_eq!(delete_key_status, reqwest::StatusCode::NO_CONTENT);
     }
 
+    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
+    async fn updates_profile_and_changes_password() {
+        let registry = test_registry().await;
+        let storage_root = test_storage_root("settings_profile");
+        let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
+        let root_url = base_url
+            .as_ref()
+            .split("/api/admin/workspaces/")
+            .next()
+            .unwrap()
+            .to_owned();
+        let client = authorized_client(&base_url).await;
+
+        let profile = assert_success_json(
+            client
+                .get(format!("{root_url}/api/auth/profile"))
+                .send()
+                .await
+                .unwrap(),
+        )
+        .await;
+        assert_eq!(profile["user"]["email"], TEST_AUTH_EMAIL);
+
+        let updated_profile = assert_success_json(
+            client
+                .patch(format!("{root_url}/api/auth/profile"))
+                .json(&json!({
+                    "display_name": "Updated Owner",
+                    "email": "updated-owner@crank.local"
+                }))
+                .send()
+                .await
+                .unwrap(),
+        )
+        .await;
+        assert_eq!(updated_profile["user"]["display_name"], "Updated Owner");
+        assert_eq!(
+            updated_profile["user"]["email"],
+            "updated-owner@crank.local"
+        );
+
+        let password_status = client
+            .post(format!("{root_url}/api/auth/password"))
+            .json(&json!({
+                "current_password": TEST_AUTH_PASSWORD,
+                "new_password": "updated-password-123"
+            }))
+            .send()
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(password_status, reqwest::StatusCode::NO_CONTENT);
+
+        let relogin_client = reqwest::Client::builder()
+            .cookie_store(true)
+            .build()
+            .unwrap();
+        let relogin_status = relogin_client
+            .post(format!("{root_url}/api/auth/login"))
+            .json(&json!({
+                "email": "updated-owner@crank.local",
+                "password": "updated-password-123"
+            }))
+            .send()
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(relogin_status, reqwest::StatusCode::OK);
+    }
+
     #[tokio::test(flavor = "multi_thread")]
     #[serial]
     async fn exposes_logs_and_usage_from_real_test_runs() {