DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests

dashcaddy-api/__tests__/network-provider-tailscale.test.js

@@ -242,9 +242,13 @@ describe('tailscale provider: blockPerson()', () => {
 });
 
 describe('tailscale provider: unblockPerson()', () => {
-  test('is a no-op at the Tailscale level and returns { restored: true }', async () => {
-    const p = createTailscaleProvider({ coordClient: makeCoord() });
-    await expect(p.unblockPerson('1001')).resolves.toEqual({ restored: true });
+  test('is honest (corrected spec): re-allow at ACL level only, devices need re-auth', async () => {
+    const coord = makeCoord();
+    const p = createTailscaleProvider({ coordClient: coord });
+    await expect(p.unblockPerson('1001')).resolves.toEqual({ restored: true, reauthRequired: true });
+    // No device-key restore call exists — nothing may touch the coord API here.
+    expect(coord.request).not.toHaveBeenCalled();
+    expect(coord.listDevices).not.toHaveBeenCalled();
   });
 });