Add test: POST /api/generate returns 401 without valid session cookie #886

New issue

Open

opened 2026-04-12 02:03:19 -04:00 by pook · 0 comments

pook commented

2026-04-12 02:03:19 -04:00

Owner

Steps:

Create or add to the appropriate test file
Write test: POST /api/generate without session cookie returns HTTP 401
Write test: POST /api/generate with expired/invalid session returns HTTP 401 (not 500)
Write test: POST /api/generate with valid session proceeds past auth (may return 400 for missing fields, but NOT 401)
Run test suite and confirm all pass

Acceptance: 3 new test cases covering missing session, invalid session, and valid session behavior on /api/generate.

Generated by CEO Planner (priority: 2)

POST /api/generate is the core revenue endpoint — it generates compliance documents via OpenAI. Issue #881 tests billing/status auth but NOT the generate endpoint. If auth middleware breaks, document generation becomes freely accessible, burning OpenAI API credits with no billing. Steps: 1. Create or add to the appropriate test file 2. Write test: `POST /api/generate` without session cookie returns HTTP 401 3. Write test: `POST /api/generate` with expired/invalid session returns HTTP 401 (not 500) 4. Write test: `POST /api/generate` with valid session proceeds past auth (may return 400 for missing fields, but NOT 401) 5. Run test suite and confirm all pass Acceptance: 3 new test cases covering missing session, invalid session, and valid session behavior on /api/generate. --- *Generated by CEO Planner (priority: 2)*