Session validation harness
Isolated proof-of-concept for @entourage/session-validation-client. Consumes the published npm package only — no repo-internal imports.
Validator mode: remote
Real validator — calls the configured endpoint.
Fully configured
Cookie EntourageAdmin, fields SID / ADMIN_USERID. Endpoint and token present (values never rendered).
What to open
| /diagnostics | Cookie → parse → validate, step by step. Reachable while unauthenticated. |
| /protected | The real gate: middleware presence check, then authoritative server validation. |
| /api/session | Route handler via the /next adapter. |
| /api/session-core | Same verdict via the framework-agnostic core API (no adapter). |
| /api/fail-closed | Every failure mode against the live endpoint. All must return null. |
| /api/latency?n=10 | Round-trip distribution vs. the 1800ms timeout. |
Secrets present: endpoint yes, token yes. Neither value is ever displayed or logged.