deckhearth/test/setup.js

process.env.JWT_SECRET = 'test-secret-for-vitest-only-do-not-use-in-prod';
process.env.NODE_ENV = 'test';
test(auth): add vitest harness + 16 auth-focused unit tests (Brief 5 of fix-auth-bypass) Closes AGENTS.md gotcha #11 (well, the relevant half of it — "Testing: None yet" line in §6 is now stale). Installs vitest@^3.2.4 (single devDep, no UI / coverage / jsdom) and adds 16 unit tests across 3 files that lock in post-Brief-1/2/4 behavior: test/lib/auth-secret.test.js (3 tests) - JWT_SECRET exports the env value - JWT_TOKEN_TTL is canonical 24h - Module throws at load when JWT_SECRET is empty test/lib/permission-middleware.test.js (8 tests) - getUserFromRequest returns null for: missing header, non-Bearer scheme, malformed token, wrong-secret token, expired token, valid-token-no-user-row - Returns user object for valid token + user row - Brief 2 regression lock: does NOT return the synthetic admin shape { userId: 1, email: 'admin@tcgvault.com', role: 'admin' } when no Authorization header is present test/api/auth-utils.test.js (5 tests) - generateToken issues 24h JWT (exp - iat === 86400) - Payload includes userId, email, role - verifyToken round-trips valid tokens - Returns null for malformed / wrong-secret tokens CI: re-enabled the previously commented-out test: job in .github/workflows/ci.yml. Blocking (no \|\| true wrapper) — vitest is the first runner in this repo and we want CI red on test regression. JWT_SECRET is set via a CI-only fake; production secret is unaffected. Rate-limit (Brief 4) coverage deferred to a future expand-auth-tests convoy per architect's call (R11). package.json has "type": "module" so vitest's default Vite-based transform handles .js ESM out of the box — no transform config needed. Convoy: fix-auth-bypass / Brief 5 (last brief) Co-authored-by: Cursor <cursoragent@cursor.com> 2026-05-23 12:06:54 -04:00			`process.env.JWT_SECRET = 'test-secret-for-vitest-only-do-not-use-in-prod';`
			`process.env.NODE_ENV = 'test';`