test(auth): protected route integration coverage

[Jayking40]

test(auth): requireAuth integration coverage for protected routes

Summary

Adds comprehensive integration tests for the requireAuth middleware across all six protected endpoints in the application. The existing protected.test.ts file tested a standalone JWT guard on a mock Express app — the new tests exercise the actual requireAuth middleware against routes wired through createApp, ensuring unauthenticated requests are consistently rejected with correct status codes and error bodies.

This directly addresses the need to verify that protected endpoints reject unauthenticated requests and return consistent { error, code } JSON responses via the global errorHandler.

Changes

• Failure-mode matrix across all protected routes: Added a describe.each block that runs four auth failure scenarios (no header, empty Bearer, whitespace-only Bearer, non-Bearer scheme) against every protected endpoint:

  • GET /api/developers/apis
  • GET /api/developers/analytics
  • POST /api/vault/deposit/prepare
  • GET /api/vault/balance
  • DELETE /api/keys/:id
  • POST /api/developers/apis

• Happy-path credential acceptance: Added tests verifying that both Authorization: Bearer <id> and x-user-id headers pass authentication on each protected route (asserting the response is not 401).

• Error body consistency assertions: Added tests confirming:

  • 401 responses use application/json content type
  • No stack traces or internal details leak in the error body
  • All protected routes return an identical { error: "Unauthorized", code: "UNAUTHORIZED" } shape

• Test infrastructure: Added required jest.mock calls for uuid, better-sqlite3, and userRepository to allow createApp to be imported in the integration test environment without native bindings or the Prisma generated client.

Testing

PASS tests/integration/protected.test.ts GET /api/usage - JWT protected (5 existing tests) requireAuth – rejects unauthenticated requests on all protected routes get /api/developers/apis (4 tests) get /api/developers/analytics (4 tests) post /api/vault/deposit/prepare (4 tests) get /api/vault/balance (4 tests) delete /api/keys/nonexistent-id (4 tests) post /api/developers/apis (4 tests) requireAuth – accepts valid credentials on protected routes (8 tests) requireAuth – error body consistency (3 tests)

Test Suites: 1 passed, 1 total Tests: 40 passed, 40 total

Full test suite: 208 tests pass across 20 suites. Two pre-existing suite failures (app.test.ts, health.test.ts) are caused by a missing Prisma generated client and are unrelated to this change.

Security note: The requireAuth middleware correctly rejects empty and whitespace-only Bearer tokens via .trim() — no bypass vector was found.

Closes #110

[drips-wave]

@Jayking40 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits