tests/app.js: mount csrfMiddleware to mirror server.js

4d68e2aeed420e8a752b1e84d8a71129088c9a11 · 2026-05-18 16:09:41 -0700 · SteveStudio2

The COI-request partial references csrfToken; the test app factory never
got the CSRF middleware server.js added, so installer pages 500'd under
supertest. GET smoke tests pass through unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M tests/app.js

Diff

commit 4d68e2aeed420e8a752b1e84d8a71129088c9a11
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 16:09:41 2026 -0700

    tests/app.js: mount csrfMiddleware to mirror server.js
    
    The COI-request partial references csrfToken; the test app factory never
    got the CSRF middleware server.js added, so installer pages 500'd under
    supertest. GET smoke tests pass through unaffected.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 tests/app.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/app.js b/tests/app.js
index 5979e43..0eb053e 100644
--- a/tests/app.js
+++ b/tests/app.js
@@ -7,6 +7,7 @@ const path = require('path');
 const session = require('express-session');
 const { pool } = require('../lib/db');
 const { attachInstaller } = require('../lib/auth');
+const { csrfMiddleware } = require('../lib/csrf');
 const segmentImage = require('../lib/segment-image');
 
 const publicRoutes      = require('../routes/public');
@@ -48,6 +49,9 @@ app.use((req, res, next) => {
 });
 
 app.use(attachInstaller);
+// Mirrors server.js — exposes res.locals.csrfToken so views that embed forms
+// (COI request, paper comments, booking) render. GET smoke tests pass through.
+app.use(csrfMiddleware);
 app.use('/', publicRoutes);
 app.use('/', authRoutes);
 app.use('/', claimRoutes);

← 0cf8dae claimLimiter: widen to 100/hr in non-prod so back-to-back e2 · back to NationalPaperHangers · smoke.test.js: update /map assertion for address-driven near f4d5c8f →