merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/tests/users.test.ts

@@ -10,6 +10,7 @@ describe('Users API', () => {
   let app: FastifyInstance;
   let db: SqliteAdapter;
   let testUserId: string;
+  let authToken: string;
 
   beforeAll(async () => {
     db = new SqliteAdapter(':memory:');
@@ -25,6 +26,15 @@ describe('Users API', () => {
       role: 'admin',
     });
     testUserId = user.id;
+
+    // Register an admin user via API to get a valid auth token
+    const regRes = await app.inject({
+      method: 'POST',
+      url: '/api/auth/register',
+      payload: { email: 'admin-auth@example.com', password: 'Password123!', name: 'Admin Auth', role: 'admin' },
+    });
+    const regBody = JSON.parse(regRes.body);
+    authToken = regBody.session.token;
   });
 
   afterAll(async () => {
@@ -35,10 +45,19 @@ describe('Users API', () => {
   // ─── List ───────────────────────────────────────────
 
   describe('GET /api/users', () => {
+    it('should return 401 without authorization header', async () => {
+      const response = await app.inject({
+        method: 'GET',
+        url: '/api/users',
+      });
+      expect(response.statusCode).toBe(401);
+    });
+
     it('should list all users', async () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/users',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
@@ -50,6 +69,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/users',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       const body = JSON.parse(response.body);
       for (const user of body) {
@@ -65,6 +85,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'GET',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
@@ -78,6 +99,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'GET',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       const body = JSON.parse(response.body);
       expect(body.password_hash).toBeUndefined();
@@ -87,6 +109,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'GET',
         url: '/api/users/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(404);
     });
@@ -99,6 +122,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'Updated Name' },
       });
       expect(response.statusCode).toBe(200);
@@ -111,6 +135,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { role: 'planer' },
       });
       expect(response.statusCode).toBe(200);
@@ -122,6 +147,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'Another Name' },
       });
       const body = JSON.parse(response.body);
@@ -132,6 +158,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: `/api/users/${testUserId}`,
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { password_hash: 'hacked-hash' },
       });
       expect(response.statusCode).toBe(200);
@@ -144,6 +171,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'PATCH',
         url: '/api/users/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
         payload: { name: 'New Name' },
       });
       expect(response.statusCode).toBe(404);
@@ -165,6 +193,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'DELETE',
         url: `/api/users/${user.id}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(204);
 
@@ -172,6 +201,7 @@ describe('Users API', () => {
       const getRes = await app.inject({
         method: 'GET',
         url: `/api/users/${user.id}`,
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(getRes.statusCode).toBe(404);
     });
@@ -180,6 +210,7 @@ describe('Users API', () => {
       const response = await app.inject({
         method: 'DELETE',
         url: '/api/users/non-existent-id',
+        headers: { authorization: `Bearer ${authToken}` },
       });
       expect(response.statusCode).toBe(404);
     });