`tests/audit.test.js`

39 lines
// /audit auth-gate + /api/audit/events JSON shape

const test = require('node:test');
const assert = require('node:assert');
const http = require('node:http');

require('dotenv').config();
const app = require('../server');
const { pool } = require('../lib/db');

let server;
test.before(() => new Promise((r) => { server = app.listen(0, r); }));
test.after(async () => {
  await new Promise((r) => server.close(r));
  await pool.end();
});

function get(p) {
  return new Promise((resolve, reject) => {
    const port = server.address().port;
    http.get(`http://127.0.0.1:${port}${p}`, (res) => {
      let body = '';
      res.on('data', (c) => (body += c));
      res.on('end', () => resolve({ status: res.statusCode, body, headers: res.headers }));
    }).on('error', reject);
  });
}

test('/audit is auth-gated', async () => {
  const r = await get('/audit');
  assert.strictEqual(r.status, 302);
  assert.match(r.headers.location, /\/sign(in|up)/);
});

test('/api/audit/events is auth-gated (returns 401)', async () => {
  const r = await get('/api/audit/events');
  assert.ok([302, 401].includes(r.status), `expected 302 or 401, got ${r.status}`);
});