sugarr/test/core/server/authHook.test.ts

import { describe, expect, it } from 'vitest';
import Fastify from 'fastify';
import { registerAuthHook } from '../../../src/core/server/authHook';

function buildApp(secretKey: string) {
  const app = Fastify();
  registerAuthHook(app, secretKey);
  app.get('/health', async () => ({ status: 'ok' }));
  app.get('/recommendations', async () => ({ items: [] }));
  return app;
}

describe('registerAuthHook', () => {
  it('allows all requests through when secretKey is empty', async () => {
    const app = buildApp('');
    const res = await app.inject({ method: 'GET', url: '/recommendations' });
    expect(res.statusCode).toBe(200);
  });

  it('always exempts /health even when a secret is configured', async () => {
    const app = buildApp('s3cret');
    const res = await app.inject({ method: 'GET', url: '/health' });
    expect(res.statusCode).toBe(200);
  });

  it('rejects requests without a matching bearer token', async () => {
    const app = buildApp('s3cret');
    const res = await app.inject({ method: 'GET', url: '/recommendations' });
    expect(res.statusCode).toBe(401);
  });

  it('allows requests with the correct bearer token', async () => {
    const app = buildApp('s3cret');
    const res = await app.inject({
      method: 'GET',
      url: '/recommendations',
      headers: { authorization: 'Bearer s3cret' },
    });
    expect(res.statusCode).toBe(200);
  });
});