merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/tests/projects.test.ts

@@ -10,12 +10,20 @@ describe('Projects API', () => {
   let app: FastifyInstance;
   let db: SqliteAdapter;
   let createdProjectId: string | null = null;
+  let authToken: string;
 
   beforeAll(async () => {
     db = new SqliteAdapter(':memory:');
     await db.init();
     app = await createServer({ db, port: 0 });
     await app.ready();
+
+    const regRes = await app.inject({
+      method: 'POST',
+      url: '/api/auth/register',
+      payload: { email: 'admin-test@example.com', password: 'Password123!', name: 'Admin Test', role: 'admin' },
+    });
+    authToken = JSON.parse(regRes.body).session.token;
   });
 
   afterAll(async () => {
@@ -23,6 +31,18 @@ describe('Projects API', () => {
     db.close();
   });
 
+  // ─── Auth Check ──────────────────────────────────────
+
+  describe('Authentication', () => {
+    it('should return 401 without authorization header', async () => {
+      const response = await app.inject({
+        method: 'GET',
+        url: '/api/projects',
+      });
+      expect(response.statusCode).toBe(401);
+    });
+  });
+
   // ─── Create ─────────────────────────────────────────
 
   describe('POST /api/projects', () => {
@@ -30,6 +50,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'POST',
         url: '/api/projects',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: {
           name: 'Test Project',
           description: 'A test project',
@@ -47,6 +68,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'POST',
         url: '/api/projects',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { description: 'No name' },
       });
       expect(response.statusCode).toBe(400);
@@ -56,6 +78,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'POST',
         url: '/api/projects',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'Minimal Project' },
       });
       expect(response.statusCode).toBe(201);
@@ -72,6 +95,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/projects',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
@@ -87,6 +111,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'GET',
         url: `/api/projects/${createdProjectId}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
@@ -98,6 +123,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/projects/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(404);
     });
@@ -110,6 +136,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/projects/${createdProjectId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'Updated Project Name' },
       });
       expect(response.statusCode).toBe(200);
@@ -122,6 +149,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/projects/${createdProjectId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { description: 'Updated description' },
       });
       expect(response.statusCode).toBe(200);
@@ -133,6 +161,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: '/api/projects/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'New Name' },
       });
       expect(response.statusCode).toBe(404);
@@ -147,6 +176,7 @@ describe('Projects API', () => {
       const createRes = await app.inject({
         method: 'POST',
         url: '/api/projects',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'To Be Deleted' },
       });
       const projectId = JSON.parse(createRes.body).id;
@@ -154,6 +184,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'DELETE',
         url: `/api/projects/${projectId}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(204);
 
@@ -161,6 +192,7 @@ describe('Projects API', () => {
       const getRes = await app.inject({
         method: 'GET',
         url: `/api/projects/${projectId}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(getRes.statusCode).toBe(404);
     });
@@ -169,6 +201,7 @@ describe('Projects API', () => {
       const response = await app.inject({
         method: 'DELETE',
         url: '/api/projects/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(404);
     });