Compat tests: dry-run the harness, and say so when the admin can't log in

None of the eight had ever executed, so all eight ran against an empty store
with synthetic inputs. The plumbing works: the documented JSON shapes parse,
and NO_INSERT stops each one before the harness touches the store, which a
sentinel file in each store directory confirmed — it survived every run,
including the one launched without NO_INSERT.

Two things the runbook got wrong, both of which would have cost a day on the
day the copy exists:

- TMPDIR is the copy's parent, not the copy. The harness opens
  $TMPDIR/<test name>, so a TMPDIR pointing at the copy gets an empty store
  created beside it and the test calls INBUXA's data missing.
- masked_email_compat and undelete_compat need INBUXA_COMPAT_MASKS and
  INBUXA_COMPAT_ARCHIVED, which only the tests' doc comments mentioned.

Every run ended on a 401 raised as "Missing list in response", which reads
as INBUXA's data being wrong when the login is what's wrong. Each test now
authenticates once first and names the variable that failed.

tests/src/directory/per_domain.rs

@@ -494,6 +494,8 @@ pub async fn per_domain_directory_compat() {
         "Compat admin",
         Id::from(u32::MAX),
     );
+
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
     let domains = admin
         .jmap_method_call("x:Domain/get", json!({"ids": null}))
         .await;

tests/src/scim/mod.rs

@@ -476,6 +476,8 @@ pub async fn scim_compat() {
         "Compat admin",
         Id::from(u32::MAX),
     );
+
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
     let domains = admin
         .jmap_method_call("x:Domain/get", json!({"ids": null}))
         .await;

tests/src/system/ai.rs

@@ -644,6 +644,8 @@ pub async fn ai_compat() {
         "Compat admin",
         Id::from(u32::MAX),
     );
+
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
     let tags = admin
         .jmap_method_call("x:SpamTag/get", json!({"ids": null}))
         .await;

tests/src/system/branding.rs

@@ -520,6 +520,8 @@ pub async fn branding_compat() {
         Id::from(u32::MAX),
     );
 
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
+
     // Every domain's logo reads back and is served or skipped, never an error
     let domains = admin
         .jmap_method_call(

tests/src/system/masked_email.rs

@@ -449,6 +449,8 @@ pub async fn masked_email_compat() {
         Id::from(u32::MAX),
     );
 
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
+
     for mask in masks {
         let id = Id::from_str(mask["id"].as_str().unwrap()).unwrap();
         let account = mask["accountId"].as_str().unwrap();

tests/src/system/monitoring.rs

@@ -410,6 +410,8 @@ pub async fn monitoring_compat() {
         Id::from(u32::MAX),
     );
 
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
+
     // Observed 1: 30 and 90 days, hourly, both stores Default, no alerts
     let retention = admin
         .jmap_method_call("x:DataRetention/get", json!({"ids": ["singleton"]}))

tests/src/system/tenant.rs

@@ -926,6 +926,8 @@ pub async fn tenant_compat() {
         Id::from(u32::MAX),
     );
 
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
+
     // Tenants, their quotas and their members read back unchanged
     for (id, tenant) in expected["tenants"].as_object().expect("tenants") {
         let id = Id::from_str(id).expect("tenant id");

tests/src/system/undelete.rs

@@ -636,6 +636,8 @@ pub async fn undelete_compat() {
         Id::from(u32::MAX),
     );
 
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
+
     for recorded in &items {
         let id = recorded["id"].as_str().unwrap();
         let account = recorded["accountId"].as_str().unwrap();

tests/src/utils/account.rs

@@ -91,6 +91,23 @@ impl Account {
         self.secret = new_secret;
     }
 
+    /// inbuxa: the compat tests all act as `INBUXA_COMPAT_ADMIN` against a
+    /// copy of INBUXA's data (docs/spec/compat-tests.md). If those
+    /// credentials don't authenticate, every later call comes back 401 and
+    /// fails as "Missing list in response", which reads like the data is
+    /// wrong rather than the login. Check once, and say which it is.
+    pub async fn assert_authenticates(&self, env_var: &str) {
+        let session = self.jmap_session_object().await;
+        if session.0.pointer("/accounts").is_none() {
+            panic!(
+                "{env_var} did not authenticate as {}: {}\n\
+                 The copy has to hold that administrator, with that password.",
+                self.name(),
+                session.0
+            );
+        }
+    }
+
     pub fn id(&self) -> Id {
         self.id
     }