merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/tests/settings.test.ts

@@ -9,12 +9,20 @@ import { createServer } from '../src/server.js';
 describe('Settings API', () => {
   let app: FastifyInstance;
   let db: SqliteAdapter;
+  let authToken: string;
 
   beforeAll(async () => {
     db = new SqliteAdapter(':memory:');
     await db.init();
     app = await createServer({ db, port: 0 });
     await app.ready();
+
+    const regRes = await app.inject({
+      method: 'POST',
+      url: '/api/auth/register',
+      payload: { email: 'admin-test@example.com', password: 'Password123!', name: 'Admin Test', role: 'admin' },
+    });
+    authToken = JSON.parse(regRes.body).session.token;
   });
 
   afterAll(async () => {
@@ -22,6 +30,18 @@ describe('Settings API', () => {
     db.close();
   });
 
+  // ─── Auth Check ──────────────────────────────────────
+
+  describe('Authentication', () => {
+    it('should return 401 without authorization header', async () => {
+      const response = await app.inject({
+        method: 'GET',
+        url: '/api/settings/non-existent-key',
+      });
+      expect(response.statusCode).toBe(401);
+    });
+  });
+
   // ─── Get (missing key → 404) ─────────────────────────
 
   describe('GET /api/settings/:key', () => {
@@ -29,6 +49,7 @@ describe('Settings API', () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/settings/non-existent-key',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(404);
       const body = JSON.parse(response.body);
@@ -40,12 +61,14 @@ describe('Settings API', () => {
       await app.inject({
         method: 'PUT',
         url: '/api/settings/test-key',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { value: 'test-value' },
       });
 
       const response = await app.inject({
         method: 'GET',
         url: '/api/settings/test-key',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
@@ -62,6 +85,7 @@ describe('Settings API', () => {
       const response = await app.inject({
         method: 'PUT',
         url: '/api/settings/new-setting',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { value: 'new-value' },
       });
       expect(response.statusCode).toBe(200);
@@ -76,6 +100,7 @@ describe('Settings API', () => {
       await app.inject({
         method: 'PUT',
         url: '/api/settings/upsert-key',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { value: 'initial' },
       });
 
@@ -83,6 +108,7 @@ describe('Settings API', () => {
       const response = await app.inject({
         method: 'PUT',
         url: '/api/settings/upsert-key',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { value: 'updated' },
       });
       expect(response.statusCode).toBe(200);
@@ -94,6 +120,7 @@ describe('Settings API', () => {
       const getRes = await app.inject({
         method: 'GET',
         url: '/api/settings/upsert-key',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       const getBody = JSON.parse(getRes.body);
       expect(getBody.value).toBe('updated');
@@ -103,6 +130,7 @@ describe('Settings API', () => {
       const response = await app.inject({
         method: 'PUT',
         url: '/api/settings/no-value-key',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: {},
       });
       const body = JSON.parse(response.body);
@@ -114,6 +142,7 @@ describe('Settings API', () => {
       const response = await app.inject({
         method: 'PUT',
         url: '/api/settings/complex-config',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { value: complexValue },
       });
       expect(response.statusCode).toBe(200);
@@ -121,6 +150,7 @@ describe('Settings API', () => {
       const getRes = await app.inject({
         method: 'GET',
         url: '/api/settings/complex-config',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       const body = JSON.parse(getRes.body);
       expect(body.value).toBe(complexValue);