Answer the client's T5 badge lookups

POST http://t5de-proxy.local/badges {imvuIds} -> {badges}: which IMVU accounts show the T5 badge,
asked of the hub (POST /api/v1/badges, in batches of 200) and remembered for 10 minutes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/control/control_test.go

@@ -18,6 +18,8 @@ import (
 	"git.t5de.dev/t5de/t5de-proxy/internal/proxy"
 )
 
+var badgeAsks atomic.Int32
+
 // fakeHub does device sign-in (approved on the second poll), /me and sign-out.
 func fakeHub(t *testing.T, signedOut *atomic.Bool) *httptest.Server {
 	var polls atomic.Int32
@@ -38,6 +40,17 @@ func fakeHub(t *testing.T, signedOut *atomic.Bool) *httptest.Server {
 				return
 			}
 			io.WriteString(w, `{"person": {"username": "erin"}}`)
+		case "/api/v1/badges":
+			var req struct{ ImvuIds []int64 }
+			json.NewDecoder(r.Body).Decode(&req)
+			badgeAsks.Add(1)
+			var even []int64
+			for _, id := range req.ImvuIds {
+				if id%2 == 0 {
+					even = append(even, id)
+				}
+			}
+			json.NewEncoder(w).Encode(map[string]any{"badges": even})
 		case "/api/auth/sign-out":
 			signedOut.Store(r.Header.Get("Authorization") == "Bearer session-token")
 			io.WriteString(w, `{"success": true}`)
@@ -137,3 +150,35 @@ func TestSignInAndOut(t *testing.T) {
 		t.Fatal("answered another host")
 	}
 }
+
+func TestBadges(t *testing.T) {
+	var signedOut atomic.Bool
+	srv := fakeHub(t, &signedOut)
+	m := &Manager{Path: filepath.Join(t.TempDir(), "hub.json"), DefaultHub: srv.URL, Log: log.New(io.Discard, "", 0)}
+	badges := func(body string) string {
+		t.Helper()
+		u, _ := url.Parse("http://" + Host + "/badges")
+		req, _ := http.NewRequest("POST", u.String(), strings.NewReader(body))
+		x := &proxy.Exchange{URL: u, Request: req, Body: []byte(body)}
+		m.Intercept(x)
+		b, _ := io.ReadAll(x.Response.Body)
+		return strings.TrimSpace(string(b))
+	}
+	// Signed out: nobody.
+	if got := badges(`{"imvuIds": [2, 3]}`); got != `{"badges":[]}` {
+		t.Fatalf("signed out: %s", got)
+	}
+	saved := &hub.Saved{URL: srv.URL, Token: "session-token"}
+	m.run(saved)
+	badgeAsks.Store(0)
+	if got := badges(`{"imvuIds": [2, 3, 4, 3]}`); got != `{"badges":[2,4]}` {
+		t.Fatalf("badges %s", got)
+	}
+	// Answers are remembered: only new IDs are asked about.
+	if got := badges(`{"imvuIds": [4, 3, 6]}`); got != `{"badges":[4,6]}` || badgeAsks.Load() != 2 {
+		t.Fatalf("badges %s after %d asks", got, badgeAsks.Load())
+	}
+	if got := badges(`{"imvuIds": "x"}`); !strings.Contains(got, "error") {
+		t.Fatalf("bad request: %s", got)
+	}
+}