api: JSON API over the engine; server mode in cmd/spreadlab

internal/api stays a translation layer: decode (with
DisallowUnknownFields so typos 400 instead of silently defaulting),
run the engine, encode; all validation stays in the engine. Routes use
Go 1.22 mux patterns ('POST /api/comparison'), so wrong methods get
405 from the stdlib for free. httptest runs handlers fully in memory;
the API test re-pins the 99/70/7 golden values end to end.
ComparisonResponse is added to tygo.yaml with a type mapping so the
generated web/src/types/api.ts reuses the engine's TS types.
cmd/spreadlab now serves on -addr (default localhost:8080); -table
keeps the CLI comparison as a sanity check.

internal/api/api.go

@@ -0,0 +1,80 @@
+// Package api exposes the engine over HTTP as a small JSON API. It stays
+// thin on purpose: decode, run the engine, encode. All validation lives in
+// the engine; the API only translates errors into status codes.
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/JustinZeus/spreadlab/internal/engine"
+)
+
+// ComparisonResponse bundles what the dashboard needs to render one
+// comparison: the config that was run, echoed back so frontend state stays
+// honest, and one result per strategy.
+type ComparisonResponse struct {
+	Config  engine.Config   `json:"config"`
+	Results []engine.Result `json:"results"`
+}
+
+// errorResponse is the JSON shape of every non-2xx body.
+type errorResponse struct {
+	Error string `json:"error"`
+}
+
+// NewServer returns the API as an http.Handler. Routes use the Go 1.22+
+// pattern syntax, method and path in one string; the stdlib answers 405
+// for wrong methods on a known path by itself.
+func NewServer() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/config/default", handleDefaultConfig)
+	mux.HandleFunc("POST /api/comparison", handleComparison)
+	return mux
+}
+
+func handleDefaultConfig(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, engine.DefaultConfig())
+}
+
+func handleComparison(w http.ResponseWriter, r *http.Request) {
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields() // a typo in a field name fails loudly
+	var config engine.Config
+	if err := decoder.Decode(&config); err != nil {
+		writeError(w, http.StatusBadRequest, fmt.Errorf("invalid config: %w", err))
+		return
+	}
+
+	strategies := engine.AllStrategies()
+	results := make([]engine.Result, 0, len(strategies))
+	for _, strategy := range strategies {
+		result, err := engine.RunScenario(config, strategy)
+		if err != nil {
+			// The engine only errors on bad parameter values, which is
+			// the client's mistake, not the server's.
+			writeError(w, http.StatusBadRequest, err)
+			return
+		}
+		results = append(results, result)
+	}
+	writeJSON(w, http.StatusOK, ComparisonResponse{Config: config, Results: results})
+}
+
+// writeJSON marshals first and writes after, so an encoding failure can
+// still become a clean 500 instead of a half-written body.
+func writeJSON(w http.ResponseWriter, status int, payload any) {
+	body, err := json.Marshal(payload)
+	if err != nil {
+		http.Error(w, "encoding response failed", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_, _ = w.Write(body) // a failed write means the client went away
+}
+
+func writeError(w http.ResponseWriter, status int, err error) {
+	writeJSON(w, status, errorResponse{Error: err.Error()})
+}

internal/api/api_test.go

@@ -0,0 +1,108 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/JustinZeus/spreadlab/internal/engine"
+)
+
+// httptest exercises handlers fully in memory: no port, no network, just
+// a recorded response to assert on.
+
+func serve(t *testing.T, method, path string, body []byte) *httptest.ResponseRecorder {
+	t.Helper()
+	request := httptest.NewRequest(method, path, bytes.NewReader(body))
+	recorder := httptest.NewRecorder()
+	NewServer().ServeHTTP(recorder, request)
+	return recorder
+}
+
+func TestDefaultConfigEndpoint(t *testing.T) {
+	recorder := serve(t, http.MethodGet, "/api/config/default", nil)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", recorder.Code, http.StatusOK)
+	}
+	var config engine.Config
+	if err := json.Unmarshal(recorder.Body.Bytes(), &config); err != nil {
+		t.Fatal(err)
+	}
+	if config != engine.DefaultConfig() {
+		t.Errorf("served config %+v, want %+v", config, engine.DefaultConfig())
+	}
+}
+
+func TestComparisonEndpointMatchesGoldenValues(t *testing.T) {
+	body, err := json.Marshal(engine.DefaultConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := serve(t, http.MethodPost, "/api/comparison", body)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body: %s", recorder.Code, http.StatusOK, recorder.Body)
+	}
+	var comparison ComparisonResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &comparison); err != nil {
+		t.Fatal(err)
+	}
+
+	// The same golden values the engine tests pin; the API must not
+	// change them in transit.
+	wantReached := map[engine.Strategy]int{
+		engine.StrategyNone:          99,
+		engine.StrategyRandom:        70,
+		engine.StrategyMostConnected: 7,
+	}
+	if len(comparison.Results) != len(wantReached) {
+		t.Fatalf("got %d results, want %d", len(comparison.Results), len(wantReached))
+	}
+	for _, result := range comparison.Results {
+		if want := wantReached[result.Strategy]; result.NumReached != want {
+			t.Errorf("%s: NumReached = %d, want %d", result.Strategy, result.NumReached, want)
+		}
+	}
+}
+
+func TestComparisonEndpointRejectsBadRequests(t *testing.T) {
+	invalidValues, err := json.Marshal(func() engine.Config {
+		config := engine.DefaultConfig()
+		config.ForwardProb = 2.0
+		return config
+	}())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name string
+		body []byte
+	}{
+		{name: "not json", body: []byte("not json")},
+		{name: "unknown field", body: []byte(`{"numStudentz": 5}`)},
+		{name: "invalid parameter values", body: invalidValues},
+	}
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			recorder := serve(t, http.MethodPost, "/api/comparison", testCase.body)
+			if recorder.Code != http.StatusBadRequest {
+				t.Errorf("status = %d, want %d", recorder.Code, http.StatusBadRequest)
+			}
+			if !strings.Contains(recorder.Body.String(), `"error"`) {
+				t.Errorf("body %q is not an error response", recorder.Body)
+			}
+		})
+	}
+
+	t.Run("wrong method", func(t *testing.T) {
+		recorder := serve(t, http.MethodGet, "/api/comparison", nil)
+		if recorder.Code != http.StatusMethodNotAllowed {
+			t.Errorf("status = %d, want %d", recorder.Code, http.StatusMethodNotAllowed)
+		}
+	})
+}