unit tests

backend/tests/unit/middleware/csrf.test.js

@@ -28,6 +28,7 @@ describe('CSRF Middleware', () => {
     res = {
       status: jest.fn().mockReturnThis(),
       json: jest.fn(),
+      send: jest.fn(),
       cookie: jest.fn(),
       set: jest.fn(),
       locals: {}
@@ -404,7 +405,8 @@ describe('CSRF Middleware', () => {
       getCSRFToken(req, res);
 
       expect(mockTokensInstance.create).toHaveBeenCalledWith('mock-secret');
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'mock-token-123' });
+      expect(res.status).toHaveBeenCalledWith(204);
+      expect(res.send).toHaveBeenCalled();
     });
 
     it('should set token in cookie with proper options', () => {
@@ -465,10 +467,13 @@ describe('CSRF Middleware', () => {
         .mockReturnValueOnce('token-2');
 
       getCSRFToken(req, res);
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'token-1' });
+      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-1', expect.any(Object));
+      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-1');
 
+      jest.clearAllMocks();
       getCSRFToken(req, res);
-      expect(res.json).toHaveBeenCalledWith({ csrfToken: 'token-2' });
+      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-2', expect.any(Object));
+      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-2');
     });
   });
 
@@ -495,12 +500,15 @@ describe('CSRF Middleware', () => {
     it('should handle token generation endpoint flow', () => {
       getCSRFToken(req, res);
 
-      const tokenFromResponse = res.json.mock.calls[0][0].csrfToken;
       const cookieCall = res.cookie.mock.calls[0];
+      const headerCall = res.set.mock.calls[0];
 
       expect(cookieCall[0]).toBe('csrf-token');
-      expect(cookieCall[1]).toBe(tokenFromResponse);
-      expect(tokenFromResponse).toBe('mock-token-123');
+      expect(cookieCall[1]).toBe('mock-token-123');
+      expect(headerCall[0]).toBe('X-CSRF-Token');
+      expect(headerCall[1]).toBe('mock-token-123');
+      expect(res.status).toHaveBeenCalledWith(204);
+      expect(res.send).toHaveBeenCalled();
     });
   });
 });