Expand test coverage for authentication routes (#565)

[wheelsandcogs]

Overview

Closes #565. Expands test coverage for the authentication routes, which were previously excluded from coverage measurement and largely untested.

Changes

Coverage config

• Remove src/controllers/auth.ts and src/middleware/passport-auth.ts from coveragePathIgnorePatterns in jest.config.ts so the auth code is actually measured.

Source (behaviour-neutral refactors to enable testing)

• Export checkTokenFitsInCookie from auth.ts.
• Extract the inline EntraID verify closure in passport-auth.ts into an exported entraIdVerify(openidConfig) factory; initEntraId now uses it. No behaviour change.

Tests

• test/unit/controllers/auth.test.ts (new): cookie size-cap helper (under/over 4096 bytes); loginEntraID controller branches — provider error, no user, req.login failure, and success (sets jwt cookie + redirects). passport.authenticate is mocked.
• test/unit/middleware/passport-auth.test.ts (new): entraIdVerify branches — missing sub/email, match by provider id, match by email, no match, and lookup error. openid-client and UserRepository are mocked.
• test/integration/routes/auth.test.ts (extended): loginLocal via GET /auth/local (success sets cookie + redirects; missing username and unknown user redirect with ?error=login); JWT middleware gaps via /healthcheck/jwt (expired token → 401, permissions-changed-since-issue → 401).

The existing no-token / invalid-token / unknown-user / valid JWT cases continue to live in healthcheck.test.ts.

Notes on EntraID testing

In the CI/test config only AuthProvider.Local is enabled, so the /auth/entraid/callback route is not registered and initEntraId() performs live OIDC discovery. EntraID is therefore covered by mocking (openid-client + passport) rather than over HTTP. The uncovered lines in passport-auth.ts are the init/discovery paths that require a real provider.

Coverage

• src/controllers/auth.ts: 100% statements
• src/middleware/passport-auth.ts: ~85% statements

Both above the issue's 80% target.

Verification

• Full suite passes (78 suites / 1483 tests); global coverage thresholds still hold with the two files now measured.
• tsc build, Prettier and ESLint all clean.

[Copilot]

Pull request overview

This PR improves the security-critical authentication surface by bringing the auth controller/middleware back under Jest coverage measurement and adding targeted unit + integration tests for local and EntraID login flows and JWT enforcement.

Changes:

• Jest: stop excluding src/controllers/auth.ts and src/middleware/passport-auth.ts from coverage reporting.
• Refactor for testability: export checkTokenFitsInCookie and extract EntraID verify logic into an exported entraIdVerify(openidConfig) factory.
• Tests: add unit tests for loginEntraID and entraIdVerify, and extend integration coverage for /auth/local and additional JWT failure branches.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
jest.config.ts	Removes auth controller/middleware from coverage ignore patterns so they’re measured.
src/controllers/auth.ts	Exports checkTokenFitsInCookie to enable direct unit testing.
src/middleware/passport-auth.ts	Extracts EntraID verify callback into exported entraIdVerify for unit testing.
test/unit/controllers/auth.test.ts	Adds unit coverage for cookie size helper + loginEntraID branches.
test/unit/middleware/passport-auth.test.ts	Adds unit coverage for entraIdVerify success/error branches.
test/integration/routes/auth.test.ts	Adds integration coverage for /auth/local and extra JWT rejection scenarios.

[j-maynard]

LGTM 🤘🏻