test/cookieAuth.test.js

const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');

test('authController.login sets HttpOnly cookie', () => {
  const src = fs.readFileSync(
    path.resolve(__dirname, '../controllers/authController.js'),
    'utf8'
  );
  assert.ok(src.includes('res.cookie('), 'login must call res.cookie to set HttpOnly token');
});

test('authMiddleware reads token from cookie when no Authorization header', () => {
  const src = fs.readFileSync(
    path.resolve(__dirname, '../middleware/authMiddleware.js'),
    'utf8'
  );
  assert.ok(src.includes('req.cookies?.token'), 'authMiddleware must read token from cookie');
});