unit tests

backend/tests/unit/middleware/auth.test.js

@@ -23,33 +23,33 @@ describe('Auth Middleware', () => {
     };
     next = jest.fn();
     jest.clearAllMocks();
-    process.env.JWT_SECRET = 'test-secret';
+    process.env.JWT_ACCESS_SECRET = 'test-secret';
   });
 
   describe('Valid token', () => {
     it('should verify valid token from cookie and call next', async () => {
-      const mockUser = { id: 1, email: 'test@test.com' };
+      const mockUser = { id: 1, email: 'test@test.com', jwtVersion: 1 };
       req.cookies.accessToken = 'validtoken';
-      jwt.verify.mockReturnValue({ id: 1 });
+      jwt.verify.mockReturnValue({ id: 1, jwtVersion: 1 });
       User.findByPk.mockResolvedValue(mockUser);
 
       await authenticateToken(req, res, next);
 
-      expect(jwt.verify).toHaveBeenCalledWith('validtoken', process.env.JWT_SECRET);
+      expect(jwt.verify).toHaveBeenCalledWith('validtoken', process.env.JWT_ACCESS_SECRET);
       expect(User.findByPk).toHaveBeenCalledWith(1);
       expect(req.user).toEqual(mockUser);
       expect(next).toHaveBeenCalled();
     });
 
     it('should handle token with valid user', async () => {
-      const mockUser = { id: 2, email: 'user@test.com', firstName: 'Test' };
+      const mockUser = { id: 2, email: 'user@test.com', firstName: 'Test', jwtVersion: 1 };
       req.cookies.accessToken = 'validtoken2';
-      jwt.verify.mockReturnValue({ id: 2 });
+      jwt.verify.mockReturnValue({ id: 2, jwtVersion: 1 });
       User.findByPk.mockResolvedValue(mockUser);
 
       await authenticateToken(req, res, next);
 
-      expect(jwt.verify).toHaveBeenCalledWith('validtoken2', process.env.JWT_SECRET);
+      expect(jwt.verify).toHaveBeenCalledWith('validtoken2', process.env.JWT_ACCESS_SECRET);
       expect(User.findByPk).toHaveBeenCalledWith(2);
       expect(req.user).toEqual(mockUser);
       expect(next).toHaveBeenCalled();

backend/tests/unit/middleware/csrf.test.js

@@ -28,6 +28,7 @@ describe('CSRF Middleware', () => {
     res = {
       status: jest.fn().mockReturnThis(),
       json: jest.fn(),
+      send: jest.fn(),
       cookie: jest.fn(),
       set: jest.fn(),
       locals: {}
@@ -404,7 +405,8 @@ describe('CSRF Middleware', () => {
       getCSRFToken(req, res);
 
       expect(mockTokensInstance.create).toHaveBeenCalledWith('mock-secret');
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'mock-token-123' });
+      expect(res.status).toHaveBeenCalledWith(204);
+      expect(res.send).toHaveBeenCalled();
     });
 
     it('should set token in cookie with proper options', () => {
@@ -465,10 +467,13 @@ describe('CSRF Middleware', () => {
         .mockReturnValueOnce('token-2');
 
       getCSRFToken(req, res);
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'token-1' });
+      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-1', expect.any(Object));
+      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-1');
 
+      jest.clearAllMocks();
       getCSRFToken(req, res);
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'token-2' });
+      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-2', expect.any(Object));
+      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-2');
     });
   });
 
@@ -495,12 +500,15 @@ describe('CSRF Middleware', () => {
     it('should handle token generation endpoint flow', () => {
       getCSRFToken(req, res);
 
-      const tokenFromResponse = res.json.mock.calls[0][0].csrfToken;
       const cookieCall = res.cookie.mock.calls[0];
+      const headerCall = res.set.mock.calls[0];
 
       expect(cookieCall[0]).toBe('csrf-token');
-      expect(cookieCall[1]).toBe(tokenFromResponse);
-      expect(tokenFromResponse).toBe('mock-token-123');
+      expect(cookieCall[1]).toBe('mock-token-123');
+      expect(headerCall[0]).toBe('X-CSRF-Token');
+      expect(headerCall[1]).toBe('mock-token-123');
+      expect(res.status).toHaveBeenCalledWith(204);
+      expect(res.send).toHaveBeenCalled();
     });
   });
 });