Closes #31. Adds a hermetic HTTP smoke-test suite for the two existing endpoints plus a regression pin for issue #3 (the missing-auth bug on `/v1/customer/bycompany/:id`). ## What lands - `npm test` and `npm run test:watch` scripts. - `vitest.config.js` configured for hermetic, no-network test runs against `tests/**/*.test.js`. - `tests/api/customer.test.js` — covers `GET /v1/customer/:id`: - 403 when `authKey` header is missing (controller's first-line short-circuit, no DB touched). - Route mounts and resolves (not a 404). - `tests/api/customer-bycompany.test.js` — covers `GET /v1/customer/bycompany/:id`: - Route mounts and resolves. - **Regression pin** for #3 using `test.fails`: asserts the correct future behavior (403 when authKey missing). Today the controller has no auth check on this endpoint, so the assertion fails and the `test.fails` wrapper succeeds. When #3 is fixed, the assertion starts passing — at which point vitest will fail the wrapper, prompting whoever applied the fix to flip it to plain `test(...)`. - `tests/README.md` documents the conventions (no live DB, `test.fails` for known bugs, how to add tests). ## Dev dependencies added - vitest ^4.1.6 - supertest ^7.2.2 ## Acceptance criteria from #31 - [x] `npm test` runs and exits 0 on a healthy checkout. - [x] At least 4 distinct test cases across the two existing endpoints (3 + 1 expected-fail = 4). - [x] One regression test pinned to the behavior fix from #3.

Broken Authentication in GET endpoint /v1/customer/bycompany/# #3

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions