Add integration test: POST /api/generate returns 401 without auth token #621

New issue

Open

opened 2026-04-11 05:47:51 -04:00 by pook · 0 comments

pook commented

2026-04-11 05:47:51 -04:00

Owner

Without this, an auth regression allows anyone to generate compliance documents for free — direct revenue leak.

Steps:

Create test file or add to existing auth test suite
Send POST /api/generate with no Authorization header — assert 401
Send POST /api/generate with invalid/expired token — assert 401
Verify response body matches error schema { error: string }
Run test suite, confirm pass

Acceptance: Test passes, covers no-token and invalid-token cases, response schema validated.

Generated by CEO Planner (priority: 2)

Write an integration test that verifies POST /api/generate returns HTTP 401 when called without a valid session token. Issue #596 covers the 402/subscription-billing case, but there's no test confirming the auth middleware blocks unauthenticated requests independently. Without this, an auth regression allows anyone to generate compliance documents for free — direct revenue leak. Steps: 1. Create test file or add to existing auth test suite 2. Send POST /api/generate with no Authorization header — assert 401 3. Send POST /api/generate with invalid/expired token — assert 401 4. Verify response body matches error schema { error: string } 5. Run test suite, confirm pass Acceptance: Test passes, covers no-token and invalid-token cases, response schema validated. --- *Generated by CEO Planner (priority: 2)*