From ec8b217b9ee81febf046e6d689e44a15602ff82a Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@tailscale.com>
Date: Wed, 18 Feb 2026 14:59:23 +0100
Subject: [PATCH] integration: use headscale auth register in tests

Update integration test helpers and CLI test commands to use the
new 'headscale auth register --auth-id' instead of the deprecated
'headscale nodes register --key'.

Update test comments to reference the new command syntax.

Updates #1850
---
 hscontrol/auth_test.go            |  6 +++---
 integration/auth_web_flow_test.go |  2 +-
 integration/cli_test.go           | 24 ++++++++++++------------
 integration/scenario.go           |  4 ++--
 integration/tags_test.go          |  2 +-
 5 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/hscontrol/auth_test.go b/hscontrol/auth_test.go
index 321b55fa..4c70cda4 100644
--- a/hscontrol/auth_test.go
+++ b/hscontrol/auth_test.go
@@ -2948,7 +2948,7 @@ func TestPreAuthKeyLogoutAndReloginDifferentUser(t *testing.T) {
 // Scenario:
 // 1. Node registers with user1 via pre-auth key
 // 2. Node logs out (expires)
-// 3. Admin runs: headscale nodes register --user user2 --key <key>
+// 3. Admin runs: headscale auth register --auth-id <id> --user user2
 //
 // Expected behavior:
 // - User1's original node should STILL EXIST (expired)
@@ -3027,7 +3027,7 @@ func TestWebFlowReauthDifferentUser(t *testing.T) {
 	require.NotEmpty(t, regID, "Should have valid registration ID")
 
 	// Step 4: Admin completes authentication via CLI
-	// This simulates: headscale nodes register --user user2 --key <key>
+	// This simulates: headscale auth register --auth-id <id> --user user2
 	node, _, err := app.state.HandleNodeFromAuthPath(
 		regID,
 		types.UserID(user2.ID), // Register to user2, not user1!
@@ -3942,7 +3942,7 @@ func TestTaggedNodeWithoutUserToDifferentUser(t *testing.T) {
 	require.NotNil(t, alice, "Alice user should be created")
 
 	// Step 4: Re-register the node to alice via HandleNodeFromAuthPath
-	// This is what happens when running: headscale nodes register --user alice --key ...
+	// This is what happens when running: headscale auth register --auth-id <id> --user alice
 	nodeKey2 := key.NewNode()
 	registrationID := types.MustAuthID()
 	regEntry := types.NewRegisterAuthRequest(types.Node{
diff --git a/integration/auth_web_flow_test.go b/integration/auth_web_flow_test.go
index eba2ebbf..d00c5fdd 100644
--- a/integration/auth_web_flow_test.go
+++ b/integration/auth_web_flow_test.go
@@ -312,7 +312,7 @@ func TestAuthWebFlowLogoutAndReloginNewUser(t *testing.T) {
 		}
 
 		// Register all clients as user1 (this is where cross-user registration happens)
-		// This simulates: headscale nodes register --user user1 --key <key>
+		// This simulates: headscale auth register --auth-id <id> --user user1
 		_ = scenario.runHeadscaleRegister("user1", body)
 	}
 
diff --git a/integration/cli_test.go b/integration/cli_test.go
index c46361d4..a7696bb4 100644
--- a/integration/cli_test.go
+++ b/integration/cli_test.go
@@ -1100,11 +1100,11 @@ func TestNodeCommand(t *testing.T) {
 				headscale,
 				[]string{
 					"headscale",
-					"nodes",
+					"auth",
+					"register",
 					"--user",
 					"node-user",
-					"register",
-					"--key",
+					"--auth-id",
 					regID,
 					"--output",
 					"json",
@@ -1185,11 +1185,11 @@ func TestNodeCommand(t *testing.T) {
 				headscale,
 				[]string{
 					"headscale",
-					"nodes",
+					"auth",
+					"register",
 					"--user",
 					"other-user",
-					"register",
-					"--key",
+					"--auth-id",
 					regID,
 					"--output",
 					"json",
@@ -1359,11 +1359,11 @@ func TestNodeExpireCommand(t *testing.T) {
 				headscale,
 				[]string{
 					"headscale",
-					"nodes",
+					"auth",
+					"register",
 					"--user",
 					"node-expire-user",
-					"register",
-					"--key",
+					"--auth-id",
 					regID,
 					"--output",
 					"json",
@@ -1496,11 +1496,11 @@ func TestNodeRenameCommand(t *testing.T) {
 				headscale,
 				[]string{
 					"headscale",
-					"nodes",
+					"auth",
+					"register",
 					"--user",
 					"node-rename-command",
-					"register",
-					"--key",
+					"--auth-id",
 					regID,
 					"--output",
 					"json",
diff --git a/integration/scenario.go b/integration/scenario.go
index e769bd73..ba99a392 100644
--- a/integration/scenario.go
+++ b/integration/scenario.go
@@ -1184,7 +1184,7 @@ func (s *Scenario) runHeadscaleRegister(userStr string, body string) error {
 		return errParseAuthPage
 	}
 
-	keySep := strings.Split(codeSep[0], "key ")
+	keySep := strings.Split(codeSep[0], "--auth-id ")
 	if len(keySep) != 2 {
 		return errParseAuthPage
 	}
@@ -1195,7 +1195,7 @@ func (s *Scenario) runHeadscaleRegister(userStr string, body string) error {
 
 	if headscale, err := s.Headscale(); err == nil { //nolint:noinlineerr
 		_, err = headscale.Execute(
-			[]string{"headscale", "nodes", "register", "--user", userStr, "--key", key},
+			[]string{"headscale", "auth", "register", "--user", userStr, "--auth-id", key},
 		)
 		if err != nil {
 			log.Printf("registering node: %s", err)
diff --git a/integration/tags_test.go b/integration/tags_test.go
index b4fe678b..617f688d 100644
--- a/integration/tags_test.go
+++ b/integration/tags_test.go
@@ -3122,7 +3122,7 @@ func TestTagsAuthKeyWithoutUserRejectsAdvertisedTags(t *testing.T) {
 
 // TestTagsAuthKeyConvertToUserViaCLIRegister reproduces the panic from
 // issue #3038: register a node with a tags-only preauthkey (no user), then
-// convert it to a user-owned node via "headscale nodes register --user <user> --key ...".
+// convert it to a user-owned node via "headscale auth register --auth-id <id> --user <user>".
 // The crash happens in the mapper's generateUserProfiles when node.User is nil
 // after the tag→user conversion in processReauthTags.
 //