Keep neoirc-cli sessions on localhost and test the relay goroutine stop

The auth cookie is always Secure, and Go 1.24's cookie jar sends a
Secure cookie only over HTTPS, so neoirc-cli lost its session against a
plain-HTTP server on localhost. Its jar now treats a server on localhost
as HTTPS, as curl does. The README's Transport Security section and
Python example say what a client needs.

A test checks that closing a registered IRC client's connection stops
its relay goroutine. The README Entrypoints section names a make target
only for the scripts that have one, and the Dockerfile says why the
test phase runs with -p 4.

Model: opus-5-5

internal/cli/api/client.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
@@ -41,11 +42,34 @@ func NewClient(baseURL string) *Client {
 		BaseURL: baseURL,
 		HTTPClient: &http.Client{ //nolint:exhaustruct // defaults fine
 			Timeout: httpTimeout,
-			Jar:     jar,
+			Jar:     loopbackJar{CookieJar: jar},
 		},
 	}
 }
 
+// loopbackJar also sends the server's auth cookie, which is
+// always Secure, over plain HTTP to a server on localhost, as
+// curl does. Go 1.24's cookie jar sends a Secure cookie only
+// over HTTPS.
+type loopbackJar struct {
+	http.CookieJar
+}
+
+// Cookies returns the cookies to send to target, treating a
+// plain-HTTP target on localhost as HTTPS.
+func (jar loopbackJar) Cookies(target *url.URL) []*http.Cookie {
+	host := target.Hostname()
+	loopback := host == "localhost" || net.ParseIP(host).IsLoopback()
+
+	if target.Scheme == "http" && loopback {
+		secure := *target
+		secure.Scheme = "https"
+		target = &secure
+	}
+
+	return jar.CookieJar.Cookies(target)
+}
+
 // CreateSession creates a new session on the server.
 // If the server requires hashcash proof-of-work, it
 // automatically fetches the difficulty and computes a

internal/cli/api/client_test.go

@@ -0,0 +1,97 @@
+package neoircapi_test
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	api "sneak.berlin/go/neoirc/internal/cli/api"
+)
+
+const cookieValue = "opaque-value"
+
+// newSessionServer starts a plain-HTTP server that, like
+// neoircd, sets a Secure auth cookie when a session is
+// created and answers GET /api/v1/state only when that
+// cookie comes back.
+func newSessionServer(t *testing.T) *httptest.Server {
+	t.Helper()
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET /api/v1/server", func(
+		writer http.ResponseWriter, _ *http.Request,
+	) {
+		_, _ = io.WriteString(writer, `{}`)
+	})
+
+	mux.HandleFunc("POST /api/v1/session", func(
+		writer http.ResponseWriter, _ *http.Request,
+	) {
+		http.SetCookie(writer, &http.Cookie{
+			Name:     "neoirc_auth",
+			Value:    cookieValue,
+			Path:     "/",
+			HttpOnly: true,
+			Secure:   true,
+			SameSite: http.SameSiteStrictMode,
+		})
+		writer.WriteHeader(http.StatusCreated)
+
+		_, _ = io.WriteString(writer, `{"id":1,"nick":"alice"}`)
+	})
+
+	mux.HandleFunc("GET /api/v1/state", func(
+		writer http.ResponseWriter, request *http.Request,
+	) {
+		cookie, err := request.Cookie("neoirc_auth")
+		if err != nil || cookie.Value != cookieValue {
+			writer.WriteHeader(http.StatusUnauthorized)
+
+			return
+		}
+
+		_, _ = io.WriteString(
+			writer, `{"id":1,"nick":"alice","channels":[]}`,
+		)
+	})
+
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	return server
+}
+
+func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
+	t.Parallel()
+
+	server := newSessionServer(t)
+
+	serverURL, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatalf("parse server URL: %v", err)
+	}
+
+	for _, host := range []string{"127.0.0.1", "localhost"} {
+		t.Run(host, func(t *testing.T) {
+			t.Parallel()
+
+			client := api.NewClient(
+				"http://" + net.JoinHostPort(host, serverURL.Port()),
+			)
+
+			_, err := client.CreateSession("alice")
+			if err != nil {
+				t.Fatalf("create session: %v", err)
+			}
+
+			_, err = client.GetState()
+			if err != nil {
+				t.Fatalf("state after creating the session: %v", err)
+			}
+		})
+	}
+}