From fadf09bf4a0183225ffd084d6708b254e24d11e3 Mon Sep 17 00:00:00 2001
From: Daniel <danitex@danvics.com>
Date: Fri, 11 Sep 2026 05:09:02 +0200
Subject: [PATCH] revert: remove the signed-out assistant preview
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed at the owner's request, entirely rather than switched off: the route's
allow-list, anonymous identity and flag lookup; the client's entry path, the
authFetch exception that let four endpoints out without an account, and the
workspace guard; the CSS, the in-page note, the admin flag and its save/load;
the test file and the assertions elsewhere that pinned it. Both settings rows
are deleted from app_settings.

Two things were checked rather than assumed on the way out. Removing the
anonymous identity collapsed every `if (!req.user.preview)` branch to its
authenticated side, so image tools, audit logging and citation storage now run
unconditionally — which is what they did before preview existed. And the route's
gate went back to a bare router.use(authMiddleware), which on a /api mount gates
every path below it in server.js; it is scoped to /clinical-assistant again, the
guard test catches it either way.

Verified after deploy: signed out, status, examples and chat all refuse with
401; signed in, chat still answers with 8 sources; extensions, encounters,
documents and admin remain shut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
---
 public/components/admin.html            |   8 --
 public/components/assistant.html        |   1 -
 public/css/styles.css                   |   9 --
 public/js/admin.js                      |  13 +--
 public/js/app.js                        |   7 --
 public/js/auth.js                       |  32 +------
 public/js/authFetch.js                  |  20 ----
 src/routes/clinicalAssistant.js         |  82 +++-------------
 test/assistant-preview.test.js          | 119 ------------------------
 test/assistant-workspace-layout.test.js |   3 -
 test/backend-hardening.test.js          |   2 +-
 test/policy-flows.test.js               |  16 ----
 12 files changed, 15 insertions(+), 297 deletions(-)
 delete mode 100644 test/assistant-preview.test.js

diff --git a/public/components/admin.html b/public/components/admin.html
index d44c8906..7f2996bb 100644
--- a/public/components/admin.html
+++ b/public/components/admin.html
@@ -119,14 +119,6 @@
                 <option value="false">Disabled</option>
               </select>
             </div>
-            <div style="display:flex;align-items:center;gap:12px;">
-              <label style="font-size:13px;font-weight:600;min-width:160px;">Signed-out preview:</label>
-              <select id="cms-flag-assistant-preview" style="font-size:13px;padding:4px 8px;border:1px solid var(--g300);border-radius:6px;">
-                <option value="true">Enabled</option>
-                <option value="false">Disabled</option>
-              </select>
-            </div>
-            <p style="margin:0;font-size:12px;color:var(--g500);">Lets a visitor who is not signed in try the Clinical Assistant. They can ask questions and read the answer; everything else asks them to sign in. Nothing is saved to any account, because a preview visitor has no account.</p>
             <div>
               <button id="btn-save-flags" class="btn-sm btn-primary"><i class="fas fa-floppy-disk"></i> Save feature flags</button>
               <span id="cms-flags-status" role="status" style="font-size:12px;color:var(--g500);margin-left:8px;"></span>
diff --git a/public/components/assistant.html b/public/components/assistant.html
index 611d3340..28c9a91c 100644
--- a/public/components/assistant.html
+++ b/public/components/assistant.html
@@ -2,7 +2,6 @@
           <div class="assistant-drawer-backdrop" id="assistant-drawer-backdrop"></div>
           <aside class="assistant-history">
             <button id="btn-assistant-drawer-close" class="assistant-drawer-close" type="button" aria-label="Close saved chats"><i class="fas fa-xmark"></i></button>
-            <p class="assistant-preview-note"><i class="fas fa-circle-info"></i> You are previewing. Sign in to save chats, export and generate images.</p>
             <!-- Brand, collapse and search share one row, as in the reference UIs.
                  Three stacked full-width rows wasted the top of the menu. -->
             <div class="menu-head">
diff --git a/public/css/styles.css b/public/css/styles.css
index 7a132bc5..4ed0a07e 100644
--- a/public/css/styles.css
+++ b/public/css/styles.css
@@ -1382,11 +1382,6 @@ button, a, .btn-sm, .btn-generate, .btn-send, .tab-btn, input, textarea, select,
 
 /* Signed-out preview: the assistant is usable, everything that needs an account
    is not shown rather than shown and refused. */
-body.assistant-preview .assistant-plus,
-body.assistant-preview .assistant-history .card,
-body.assistant-preview .assistant-rail-actions { display:none !important; }
-body.assistant-preview .assistant-preview-note { display:flex; }
-.assistant-preview-note { display:none; align-items:center; gap:8px; margin:0 0 10px; padding:8px 12px; border:1px solid var(--blue-light); background:var(--blue-light); color:var(--blue); border-radius:10px; font-size:12px; }
 
 /* ── Account card ────────────────────────────────────────────────────────────
    Ends both menus identically. Settings, FAQ, Admin and Log out were unlabelled
@@ -1413,10 +1408,6 @@ body.assistant-preview .assistant-preview-note { display:flex; }
 .assistant-history .account-card { margin-top:auto; padding:8px 0; }
 /* Collapsed menus hide their contents; the card goes with them. */
 /* A preview visitor has no account to show. */
-body.assistant-preview .account-card { display:none; }
-/* The sign-in prompt a preview visitor meets is an invitation, not the
-   compliance notice a clinician sees on first login. */
-body.assistant-preview .hipaa-notice { display:none; }
 
 /* ── Search palette ──────────────────────────────────────────────────────────
    One component in both views; the view decides what it searches. */
diff --git a/public/js/admin.js b/public/js/admin.js
index c410bf66..9b2db57c 100644
--- a/public/js/admin.js
+++ b/public/js/admin.js
@@ -378,12 +378,6 @@ function adminTabActive() {
         var flagNextcloud = document.getElementById('cms-flag-nextcloud');
         if (flagReadAloud) flagReadAloud.value = cfg['feature.read_aloud'] !== undefined ? cfg['feature.read_aloud'] : 'true';
         if (flagNextcloud) flagNextcloud.value = cfg['feature.nextcloud']  !== undefined ? cfg['feature.nextcloud']  : 'true';
-        var flagPreview = document.getElementById('cms-flag-assistant-preview');
-        // Falls back to the key this setting used to live under, so the switch
-        // shows the real state on an installation that set it before the move.
-        if (flagPreview) flagPreview.value =
-          cfg['feature.assistant_preview'] !== undefined ? cfg['feature.assistant_preview'] :
-          (cfg['clinical_assistant.preview_enabled'] !== undefined ? cfg['clinical_assistant.preview_enabled'] : 'false');
 
         // Auto-delete setting
         var autoDeleteDays = cfg['site.auto_delete_days'] || '7';
@@ -425,17 +419,12 @@ function adminTabActive() {
     var readAloud = document.getElementById('cms-flag-read-aloud').value;
     var nextcloud = document.getElementById('cms-flag-nextcloud').value;
 
-    var preview = (document.getElementById('cms-flag-assistant-preview') || {}).value;
     var status = document.getElementById('cms-flags-status');
     if (status) status.textContent = 'Saving...';
 
     Promise.all([
       putConfig('feature.read_aloud', readAloud),
-      putConfig('feature.nextcloud',  nextcloud),
-      // A feature flag, stored under feature.* like the others. The assistant
-      // still reads the old clinical_assistant.preview_enabled key when this one
-      // has never been set, so existing installations keep their setting.
-      putConfig('feature.assistant_preview', preview === 'true' ? 'true' : 'false')
+      putConfig('feature.nextcloud',  nextcloud)
     ]).then(function() {
       if (status) status.textContent = 'Saved.';
       showToast('Feature flags saved', 'success');
diff --git a/public/js/app.js b/public/js/app.js
index d961320b..07666966 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -176,13 +176,6 @@ document.addEventListener('DOMContentLoaded', function() {
     if (!pill) return;
     var wantsAssistant = pill.getAttribute('data-assistant-mode') === 'assistant';
     var onAssistant = window.location.pathname === '/assistant';
-    // A preview visitor may try the assistant; the workspace is the product, so
-    // reaching for it is where we ask them to sign in.
-    if (document.body.classList.contains('assistant-preview') && !wantsAssistant) {
-      var screen = document.getElementById('auth-screen');
-      if (screen) screen.style.display = 'flex';
-      return;
-    }
     if (!onAssistant) {
       // In the app you ARE the workspace, so only the Assistant pill moves.
       // This used to set window.location, which reloads the document and kills
diff --git a/public/js/auth.js b/public/js/auth.js
index 975d748d..2467cb1c 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -176,37 +176,7 @@ document.addEventListener('DOMContentLoaded', function() {
   // Auth screen is hidden by CSS default — only show it when there is no valid session
   function showAuthScreen() {
     if (boundary.blocked() || window.CURRENT_USER || !authScreen) return;
-    // Admin-enabled preview: a signed-out visitor at /assistant may try the
-    // assistant instead of meeting a wall. Everything else still needs an
-    // account, and the server enforces that independently — this only decides
-    // whether to show the login screen.
-    // Any path, not only /assistant: with preview on, a visitor landing on the
-    // root should meet the assistant, not a wall. enterPreview moves them there.
-    fetch('/api/clinical-assistant/status', { credentials: 'same-origin' })
-      .then(function(r) { return r.ok ? r.json() : null; })
-      .then(function(data) {
-        if (data && data.success && data.preview) return enterPreview();
-        authScreen.style.display = 'flex';
-      })
-      .catch(function() { authScreen.style.display = 'flex'; });
-  }
-
-  // Raised by authFetch when a preview visitor reaches for something that needs
-  // an account. The screen stays an overlay, so their chat is still underneath.
-  document.addEventListener('preview-needs-account', function() {
-    if (authScreen && document.body.classList.contains('assistant-preview')) authScreen.style.display = 'flex';
-  });
-
-  // The auth screen is an overlay over an already-rendered app, so entering
-  // preview is simply declining to raise it.
-  function enterPreview() {
-    document.body.classList.add('assistant-preview');
-    if (authScreen) authScreen.style.display = 'none';
-    // The app container starts hidden and enterApp is what reveals it. Declining
-    // the overlay without doing the same left a hidden app under a hidden
-    // overlay — /assistant in the address bar and nothing on the screen.
-    if (mainApp) mainApp.style.display = 'block';
-    if (typeof window.activateTab === 'function') window.activateTab('assistant');
+    authScreen.style.display = 'flex';
   }
 
   // ── Check for SSO redirect (token is in httpOnly cookie) ──
diff --git a/public/js/authFetch.js b/public/js/authFetch.js
index 7c947532..d944e00e 100644
--- a/public/js/authFetch.js
+++ b/public/js/authFetch.js
@@ -9,18 +9,6 @@ if (!window.__fetchAuthIntercepted) {
     '/api/auth/verify-email', '/api/auth/resend-verification',
     '/api/auth/oidc', '/api/auth/oidc-status', '/api/auth/registration-status'
   ]);
-  // The signed-out preview. Same four paths the server allow-lists; nothing
-  // else may leave the browser without an account. Until these were here the
-  // status call was rejected before it was ever sent, so the server-side
-  // preview could never be reached from the page.
-  var previewPaths = new Set([
-    '/api/clinical-assistant/status', '/api/clinical-assistant/examples',
-    '/api/clinical-assistant/chat', '/api/clinical-assistant/chat/stream'
-  ]);
-  function inPreview() { return document.body && document.body.classList.contains('assistant-preview'); }
-
-  // Narrow transition requests bypass the frozen clinical transport. Logout
-  // headers are captured before freezing; its verification is cookie-only.
   boundary.logoutRequest = function(headers) {
     return rawFetch('/api/auth/logout', {
       method: 'POST', headers: headers, credentials: 'same-origin', keepalive: true
@@ -49,14 +37,6 @@ if (!window.__fetchAuthIntercepted) {
     if (boundary.blocked()) return Promise.reject(boundary.error());
     // No clinical module may preload a previous cookie's data on the login screen.
     if (!ticket && !authPaths.has(url.pathname) && url.pathname !== '/api/auth/me' && url.pathname !== '/api/models') {
-      if (previewPaths.has(url.pathname)) return rawFetch(input, Object.assign({}, init, { credentials: 'same-origin' }));
-      // A preview visitor reaching for anything else is exactly the moment to
-      // ask them to sign in — one hook here, not a check on every button. Only
-      // for something the visitor did, though: the page also fetches saved
-      // chats and config in the background on load, and raising the sign-in
-      // screen for those buried the assistant under it before a word was typed.
-      var gesture = navigator.userActivation ? navigator.userActivation.isActive : false;
-      if (inPreview() && gesture) document.dispatchEvent(new CustomEvent('preview-needs-account', { detail: { path: url.pathname } }));
       return Promise.reject(boundary.error());
     }
     var login = (url.pathname === '/api/auth/login' || url.pathname === '/api/auth/register')
diff --git a/src/routes/clinicalAssistant.js b/src/routes/clinicalAssistant.js
index 71238970..38f6ede9 100644
--- a/src/routes/clinicalAssistant.js
+++ b/src/routes/clinicalAssistant.js
@@ -45,60 +45,10 @@ var translateLanguageCache = clinicalTranslation.createLanguageCache();
 
 var { DEFAULT_BEHAVIOR } = require('../utils/clinicalPrompts');
 
-// ── Signed-out preview (admin opt-in, default OFF) ──────────────────────────
-// Deliberately narrow. A preview visitor may ask questions and read the answer;
-// they get NO identity, so nothing can be owned, saved, billed or addressed to
-// them. Everything else on this router still requires real authentication,
-// which is enforced by allow-listing exact paths rather than by pattern —
-// a new route is private unless someone adds it here on purpose.
-var PREVIEW_PATHS = new Set([
-  '/clinical-assistant/status',
-  '/clinical-assistant/examples',
-  '/clinical-assistant/chat',
-  '/clinical-assistant/chat/stream'
-]);
-var PREVIEW_USER = Object.freeze({ id: null, preview: true, role: 'preview' });
-
-// It is a feature flag and now lives with the others under feature.*, which also
-// means an ordinary admin can still toggle it under ADMIN_LOCKDOWN — the
-// clinical_assistant.* prefix is locked, and burying a day-to-day switch behind
-// host access was not the intent.
-//
-// The old key is still honoured when the new one has never been written, so an
-// installation that enabled preview before the move keeps it enabled.
-async function previewEnabled() {
-  var flag = await getSetting('feature.assistant_preview', '');
-  if (String(flag) === '') flag = await getSetting('clinical_assistant.preview_enabled', 'false');
-  return String(flag) === 'true';
-}
-
-router.use(async function(req, res, next) {
-  if (req.user) return next();
-  if (!PREVIEW_PATHS.has(req.path)) return authMiddleware(req, res, next);
-  try {
-    if (!(await previewEnabled())) return authMiddleware(req, res, next);
-  } catch (_) {
-    return authMiddleware(req, res, next); // a lookup failure must not open the door
-  }
-  // An authenticated caller keeps their own identity; this only covers the
-  // no-credential case, so preview can never downgrade a real session.
-  var hasCredential = Boolean((req.headers.authorization || '').startsWith('Bearer ') || (req.cookies && req.cookies.ped_auth));
-  if (hasCredential) return authMiddleware(req, res, next);
-  req.user = PREVIEW_USER;
-  next();
-});
-
-// The middleware above may have assigned the anonymous preview identity.
-// authMiddleware knows nothing about that — it only looks for a token — so
-// calling it unconditionally here rejected exactly the requests preview exists
-// to allow, and the feature never worked at all. authMiddleware itself stays
-// strict: it is used everywhere else and must keep refusing anyone without a
-// credential. Only the preview identity, which this router assigns on
-// allow-listed paths when an admin has opted in, may pass.
-router.use(function(req, res, next) {
-  if (req.user && req.user.preview) return next();
-  return authMiddleware(req, res, next);
-});
+// Scoped to this router's own prefix. Mounted on /api, a bare
+// router.use(authMiddleware) gates every /api path, including routes owned by
+// routers mounted after it in server.js.
+router.use('/clinical-assistant', authMiddleware);
 
 var MAX_SAVED_CHATS_PER_USER = 100;
 var MAX_SAVED_CHAT_TITLE = 160;
@@ -159,8 +109,6 @@ router.get('/clinical-assistant/status', async function(req, res) {
       conversationMeasure: budget.measure,
       translateProvider: translateProvider,
       showSources: await showSourcesEnabled(),
-      previewEnabled: await previewEnabled(),
-      preview: Boolean(req.user && req.user.preview),
       mcp: mcpHealth
     });
   } catch (e) {
@@ -357,12 +305,6 @@ router.post('/clinical-assistant/patient-takehome/email', async function(req, re
     res.status(e.statusCode || 502).json({ error: e.statusCode ? e.message : 'Could not send the email', code: e.code });
   }
 });
-function refusePreviewWrite(req, res) {
-  if (!req.user || !req.user.preview) return false;
-  res.status(401).json({ error: 'Create an account or sign in to use this', preview: true });
-  return true;
-}
-
 // Citation quality tracking. Loaded on demand and allowed to be absent: it is
 // observation, not part of producing an answer, so it must never be able to
 // fail one — including in a harness that stubs this route's module graph.
@@ -379,7 +321,7 @@ function trackCitations(req, question, answer, sources) {
   if (!tracker) return;
   var result = tracker.record(answer, sources);
   // Not awaited: the clinician is waiting for this answer.
-  if (!req.user.preview) tracker.store(req.user.id, question, result, sources);
+  tracker.store(req.user.id, question, result, sources);
 }
 
 router.post('/clinical-assistant/chat', async function(req, res) {
@@ -391,13 +333,13 @@ router.post('/clinical-assistant/chat', async function(req, res) {
     var ai = await callAI(prepared.messages, assistantGenerationOptions({
       model: prepared.chatModel || undefined,
       temperature: 0.15,
-      tools: req.user.preview ? undefined : imageTool.tools,
+      tools: imageTool.tools,
       maxTokens: 2600,
       images: prepared.images
     }));
-    if (!req.user.preview) ai = await imageTool.dispatch(ai, { owner: req.user.id, workflow: 'clinical_assistant', body: req.body,
+    ai = await imageTool.dispatch(ai, { owner: req.user.id, workflow: 'clinical_assistant', body: req.body,
       imageContext: prepared.imageContext, imageModel: prepared.imageModel, messages: prepared.messages, options: assistantGenerationOptions({ model: prepared.chatModel || undefined, temperature: 0.15 }), callAI: callAI });
-    if (!req.user.preview) ai = await dispatchImageRequestFallback(ai, prepared, req);
+    ai = await dispatchImageRequestFallback(ai, prepared, req);
     var finalized = ai.imageToolHandled ? { answer: String(ai.content || ''), ai: ai } : await finalizeAssistantAnswer(ai, {
       messages: prepared.messages,
       chatModel: prepared.chatModel,
@@ -407,7 +349,7 @@ router.post('/clinical-assistant/chat', async function(req, res) {
     var answer = finalized.answer;
     ai = finalized.ai;
 
-    if (!req.user.preview) logger.audit(req.user.id, 'clinical_assistant_query', 'Clinical assistant query', req, {
+    logger.audit(req.user.id, 'clinical_assistant_query', 'Clinical assistant query', req, {
       category: 'clinical', model: ai.model || prepared.chatModel, duration: Date.now() - started
     });
 
@@ -465,14 +407,14 @@ router.post('/clinical-assistant/chat/stream', async function(req, res) {
     var ai = await callAIStream(prepared.messages, assistantGenerationOptions({
       model: prepared.chatModel || undefined,
       temperature: 0.15,
-      tools: req.user.preview ? undefined : imageTool.tools,
+      tools: imageTool.tools,
       maxTokens: 2600,
       images: prepared.images
     }), function(delta) {
       sendEvent('token', { token: delta });
     });
 
-    if (!req.user.preview) {
+    {
       ai = await imageTool.dispatch(ai, { owner: req.user.id, workflow: 'clinical_assistant', body: req.body,
         imageContext: prepared.imageContext, imageModel: prepared.imageModel, messages: prepared.messages, options: assistantGenerationOptions({ model: prepared.chatModel || undefined, temperature: 0.15 }), callAI: callAI });
       ai = await dispatchImageRequestFallback(ai, prepared, req);
@@ -489,7 +431,7 @@ router.post('/clinical-assistant/chat/stream', async function(req, res) {
     var answer = finalized.answer;
     ai = finalized.ai;
 
-    if (!req.user.preview) logger.audit(req.user.id, 'clinical_assistant_streaming_query', 'Clinical assistant streaming query', req, {
+    logger.audit(req.user.id, 'clinical_assistant_streaming_query', 'Clinical assistant streaming query', req, {
       category: 'clinical', model: ai.model || prepared.chatModel, duration: Date.now() - started
     });
     // Quality tracking: does every citation the model wrote point at a source
diff --git a/test/assistant-preview.test.js b/test/assistant-preview.test.js
deleted file mode 100644
index a6befa97..00000000
--- a/test/assistant-preview.test.js
+++ /dev/null
@@ -1,119 +0,0 @@
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const root = path.join(__dirname, '..');
-const read = file => fs.readFileSync(path.join(root, file), 'utf8');
-
-// Signed-out preview is an admin opt-in that widens who can reach the assistant,
-// so the boundaries matter more than the feature.
-test('preview is off unless an admin turns it on', () => {
-  const route = read('src/routes/clinicalAssistant.js');
-  assert.match(route, /getSetting\('clinical_assistant\.preview_enabled', 'false'\)/,
-    'default is off');
-  assert.match(route, /=== 'true'/, 'and only the exact string enables it');
-  const admin = read('src/routes/adminConfig.js');
-  assert.match(admin, /clinical_assistant\.preview_enabled' && !\['true', 'false'\]/,
-    'the server refuses a non-boolean');
-});
-
-test('preview reaches an allow-list of paths, never a pattern', () => {
-  const route = read('src/routes/clinicalAssistant.js');
-  const block = route.slice(route.indexOf('var PREVIEW_PATHS'), route.indexOf('var PREVIEW_USER'));
-  // A pattern would silently include future routes; an exact list means a new
-  // endpoint is private until someone adds it here deliberately.
-  for (const allowed of ['/clinical-assistant/status', '/clinical-assistant/examples',
-    '/clinical-assistant/chat', '/clinical-assistant/chat/stream']) {
-    assert.ok(block.includes("'" + allowed + "'"), allowed + ' is previewable');
-  }
-  for (const denied of ['/clinical-assistant/chats', '/clinical-assistant/image',
-    '/clinical-assistant/patient-takehome', '/clinical-assistant/translate']) {
-    assert.ok(!block.includes("'" + denied + "'"), denied + ' must stay private');
-  }
-  assert.match(route, /PREVIEW_PATHS\.has\(req\.path\)/, 'matched exactly, not by prefix');
-});
-
-test('preview never downgrades a real session, and a lookup failure closes the door', () => {
-  const route = read('src/routes/clinicalAssistant.js');
-  const mw = route.slice(route.indexOf('router.use(async function(req, res, next)'), route.indexOf('router.use(authMiddleware);'));
-  assert.match(mw, /if \(req\.user\) return next\(\);/, 'an established identity is untouched');
-  assert.match(mw, /hasCredential[\s\S]*?return authMiddleware/,
-    'a caller presenting a token is authenticated normally, not previewed');
-  assert.match(mw, /catch \(_\) \{\s*\n\s*return authMiddleware/,
-    'if the setting cannot be read, authentication is required');
-});
-
-test('a preview visitor has no identity, so nothing can be owned or billed', () => {
-  const route = read('src/routes/clinicalAssistant.js');
-  assert.match(route, /PREVIEW_USER = Object\.freeze\(\{ id: null, preview: true/,
-    'no user id at all');
-  // Image generation is owned, stored and paid for, so the tool is withheld
-  // rather than left to fail on a null owner downstream.
-  assert.match(route, /tools: req\.user\.preview \? undefined : imageTool\.tools/);
-  // Each dispatch must be reachable only behind a preview check — either inline
-  // on the same statement, or inside an enclosing `if (!req.user.preview) {`.
-  const lines = route.split('\n');
-  lines.forEach((line, i) => {
-    if (!line.includes('imageTool.dispatch(')) return;
-    const guardedInline = line.includes('!req.user.preview');
-    const guardedByBlock = lines.slice(Math.max(0, i - 3), i)
-      .some(l => l.includes('if (!req.user.preview) {'));
-    assert.ok(guardedInline || guardedByBlock,
-      'unguarded imageTool.dispatch at line ' + (i + 1) + ': ' + line.trim().slice(0, 60));
-  });
-  assert.equal(lines.filter(l => l.includes('imageTool.dispatch(')).length, 2,
-    'both chat paths are covered');
-  assert.match(route, /if \(!req\.user\.preview\) logger\.audit/,
-    'audit rows are not written against a null user');
-});
-
-test('preview is entered by declining the login overlay, not by faking a session', () => {
-  const auth = read('public/js/auth.js');
-  const fn = auth.slice(auth.indexOf('function showAuthScreen()'), auth.indexOf('// ── Check for SSO redirect'));
-  // Any path previews, not only /assistant: a visitor landing on the root should
-  // meet the assistant, not a wall. enterPreview moves them onto that tab.
-  assert.doesNotMatch(fn, /pathname === '\/assistant'/, 'the root previews too');
-  assert.match(fn, /data\.success && data\.preview/, 'and only when the server says so');
-  assert.match(fn, /authScreen\.style\.display = 'flex';/, 'anything else raises the login screen');
-  // No token, no user object, no stored credential — the overlay is simply not
-  // shown, so nothing downstream can mistake a visitor for a signed-in user.
-  assert.doesNotMatch(fn, /CURRENT_USER =|SecureStorage\.set/, 'preview never mints an identity');
-});
-
-test('reaching for the workspace is where a preview visitor is asked to sign in', () => {
-  const app = read('public/js/app.js');
-  const handler = app.slice(app.indexOf('// Assistant / Workspace switch'), app.indexOf('window.activateTab = activateTab;'));
-  assert.match(handler, /assistant-preview'\) && !wantsAssistant/);
-  assert.match(handler, /screen\.style\.display = 'flex'/, 'the login screen is raised');
-
-  // Actions that need an account are hidden rather than offered and refused.
-  const css = read('public/css/styles.css');
-  for (const hidden of ['.assistant-plus', '.assistant-history .card', '.assistant-rail-actions']) {
-    assert.ok(css.includes('body.assistant-preview ' + hidden), hidden + ' is hidden in preview');
-  }
-  assert.match(read('public/components/assistant.html'), /assistant-preview-note/, 'and the state is stated plainly');
-  // The prompt a preview visitor meets is an invitation, not the compliance notice.
-  assert.ok(css.includes('body.assistant-preview .hipaa-notice { display:none; }'), 'no HIPAA notice in preview');
-});
-
-test('the browser lets exactly the preview endpoints out without an account, and nothing else', () => {
-  // Every /api fetch without an account is rejected before it is sent. Until the
-  // preview paths were allowed here, the status call never reached the server,
-  // so the server-side preview was unreachable from the page.
-  const af = read('public/js/authFetch.js');
-  const list = af.slice(af.indexOf('var previewPaths'), af.indexOf('function inPreview'));
-  for (const p of ['/api/clinical-assistant/status', '/api/clinical-assistant/examples',
-                   '/api/clinical-assistant/chat', '/api/clinical-assistant/chat/stream']) {
-    assert.ok(list.includes("'" + p + "'"), p + ' is allowed');
-  }
-  assert.doesNotMatch(list, /saved-chats|\/config|\/images|\/admin/, 'nothing that needs an account');
-  assert.match(af, /if \(previewPaths\.has\(url\.pathname\)\) return rawFetch/, 'they go out with no ticket');
-  // Anything else a preview visitor reaches for raises sign-in via one hook,
-  // rather than a check on every button.
-  // ...and only for something the visitor did. The page fetches saved chats and
-  // config in the background on load; raising sign-in for those buried the
-  // assistant before a word was typed.
-  assert.match(af, /navigator\.userActivation \? navigator\.userActivation\.isActive : false/);
-  assert.match(af, /if \(inPreview\(\) && gesture\) document\.dispatchEvent\(new CustomEvent\('preview-needs-account'/);
-  assert.match(read('public/js/auth.js'), /addEventListener\('preview-needs-account'/, 'and auth.js raises the screen');
-});
diff --git a/test/assistant-workspace-layout.test.js b/test/assistant-workspace-layout.test.js
index 61b60a8e..32e7e1fe 100644
--- a/test/assistant-workspace-layout.test.js
+++ b/test/assistant-workspace-layout.test.js
@@ -394,9 +394,6 @@ test('one menu, ending the same way in both views', () => {
   // Reaching an app tab from the assistant has to leave the assistant.
   assert.match(app, /if \(tab && window\.location\.pathname === '\/assistant'\)/);
 
-  const css = read('public/css/styles.css');
-  assert.match(css, /body\.assistant-preview \.account-card \{ display:none; \}/,
-    'a preview visitor has no account to show');
 });
 
 test('there is no header bar; the brand heads the menu instead', () => {
diff --git a/test/backend-hardening.test.js b/test/backend-hardening.test.js
index 8e13e4cd..fcc102f0 100644
--- a/test/backend-hardening.test.js
+++ b/test/backend-hardening.test.js
@@ -283,5 +283,5 @@ test('citation quality is measured on the server, where answer and sources both
   // to fail an answer.
   assert.match(route, /function citationTracker\(\)/);
   assert.match(route, /if \(!tracker\) return;/);
-  assert.match(route, /if \(!req\.user\.preview\) tracker\.store\(req\.user\.id, question, result, sources\);/);
+  assert.match(route, /tracker\.store\(req\.user\.id, question, result, sources\);/);
 });
diff --git a/test/policy-flows.test.js b/test/policy-flows.test.js
index 3ce84e2c..2422187e 100644
--- a/test/policy-flows.test.js
+++ b/test/policy-flows.test.js
@@ -576,19 +576,3 @@ test('a router mounted on /api must not gate the whole namespace', () => {
   }
 });
 
-test('the signed-out preview is reachable, and stays narrow', () => {
-  const route = readSource('src/routes/clinicalAssistant.js');
-  // authMiddleware only ever looks for a token, so calling it unconditionally
-  // after the preview identity was assigned rejected the very requests preview
-  // exists to serve. Only the preview identity may skip it.
-  assert.match(route, /if \(req\.user && req\.user\.preview\) return next\(\);/);
-  assert.match(route, /return authMiddleware\(req, res, next\);/);
-  // Allow-listed by exact path: a route added later is private unless someone
-  // puts it on this list deliberately.
-  const list = route.slice(route.indexOf('var PREVIEW_PATHS'), route.indexOf('var PREVIEW_USER'));
-  assert.match(list, /'\/clinical-assistant\/chat'/);
-  assert.match(list, /'\/clinical-assistant\/chat\/stream'/);
-  assert.doesNotMatch(list, /saved-chats|\/config|\/images/);
-  // A preview visitor has no identity, so nothing can be owned or billed.
-  assert.match(route, /PREVIEW_USER = Object\.freeze\(\{ id: null, preview: true/);
-});