addition of new dashboard

backend/http/auth.test.js

@@ -0,0 +1,61 @@
+import { jest } from "@jest/globals";
+import express from "express";
+import request from "supertest";
+
+// Manual mocks: the API-key verifier and the DB pool. No real database, no scrypt
+// — apiMiddleware's branching is what we exercise here.
+const verifyKey = jest.fn();
+const query = jest.fn();
+const release = jest.fn(async () => {});
+jest.unstable_mockModule("../modules/core/apiKey.js", () => ({ verifyKey }));
+jest.unstable_mockModule("../db/index.js", () => ({ getPool: async () => ({ query, release }) }));
+
+const { apiMiddleware } = await import("./auth.js");
+
+function makeApp() {
+  const app = express();
+  app.use((req, _res, next) => { req.session = {}; next(); });
+  app.get("/probe", apiMiddleware, (req, res) => res.json({ userId: req.session.user_id }));
+  return app;
+}
+
+beforeEach(() => {
+  verifyKey.mockReset();
+  query.mockReset();
+  release.mockClear();
+});
+
+describe("apiMiddleware", () => {
+  it("authenticates a valid hashed key and sets req.session.user_id (no legacy lookup)", async () => {
+    verifyKey.mockResolvedValue({ user_id: 42, app_id: 1 });
+    const res = await request(makeApp()).get("/probe").set("Authorization", "Bearer good-key");
+    expect(res.status).toBe(200);
+    expect(res.body.userId).toBe(42);
+    expect(verifyKey).toHaveBeenCalledWith("good-key");
+    expect(query).not.toHaveBeenCalled(); // hashed path short-circuits the legacy fallback
+  });
+
+  it("falls back to the legacy plaintext auth key when the hashed store misses", async () => {
+    verifyKey.mockResolvedValue(null);
+    query.mockResolvedValue({ rowCount: 1, rows: [{ user_id: 7 }] });
+    const res = await request(makeApp()).get("/probe").set("Authorization", "Bearer legacy-key");
+    expect(res.status).toBe(200);
+    expect(res.body.userId).toBe(7);
+    expect(query.mock.calls[0][1]).toEqual(["legacy-key"]);
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects an unknown key with 401", async () => {
+    verifyKey.mockResolvedValue(null);
+    query.mockResolvedValue({ rowCount: 0, rows: [] });
+    const res = await request(makeApp()).get("/probe").set("Authorization", "Bearer bogus");
+    expect(res.status).toBe(401);
+  });
+
+  it("rejects a request with no Authorization header with 401 (no lookups)", async () => {
+    const res = await request(makeApp()).get("/probe");
+    expect(res.status).toBe(401);
+    expect(verifyKey).not.toHaveBeenCalled();
+    expect(query).not.toHaveBeenCalled();
+  });
+});