Add backend unit/integration tests, Playwright e2e tests, README, cookie Secure fix

backend/tests/integration/customers.integration.test.ts

@@ -0,0 +1,94 @@
+import request from 'supertest';
+import app from '../../src/app';
+import { pool } from '../../src/db';
+import { resetDb, closeDb } from './setup/testDb';
+
+beforeEach(async () => {
+  await resetDb();
+});
+
+afterAll(async () => {
+  await pool.end();
+  await closeDb();
+});
+
+describe('POST /api/customers/register', () => {
+  it('creates an account with marketing consent unchecked by default', async () => {
+    const res = await request(app).post('/api/customers/register').send({
+      email: 'jane@example.com',
+      password: 'supersecret123',
+      name: 'Jane'
+    });
+    expect(res.status).toBe(200);
+    expect(res.body.email).toBe('jane@example.com');
+    expect(res.body.marketing_consent).toBe(false);
+    expect(res.headers['set-cookie']).toBeDefined();
+  });
+
+  it('respects an explicit marketing opt-in', async () => {
+    const res = await request(app).post('/api/customers/register').send({
+      email: 'opt-in@example.com',
+      password: 'supersecret123',
+      marketingConsent: true
+    });
+    expect(res.body.marketing_consent).toBe(true);
+  });
+
+  it('rejects a duplicate email', async () => {
+    await request(app).post('/api/customers/register').send({
+      email: 'dupe@example.com',
+      password: 'supersecret123'
+    });
+    const res = await request(app).post('/api/customers/register').send({
+      email: 'dupe@example.com',
+      password: 'anotherpassword'
+    });
+    expect(res.status).toBe(409);
+  });
+
+  it('rejects a password under 8 characters', async () => {
+    const res = await request(app).post('/api/customers/register').send({
+      email: 'short@example.com',
+      password: '123'
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('rejects a malformed email', async () => {
+    const res = await request(app).post('/api/customers/register').send({
+      email: 'not-an-email',
+      password: 'supersecret123'
+    });
+    expect(res.status).toBe(400);
+  });
+});
+
+describe('session-gated routes', () => {
+  it('logs in and can access /me with the returned session cookie', async () => {
+    const agent = request.agent(app);
+    await agent.post('/api/customers/register').send({
+      email: 'login-test@example.com',
+      password: 'supersecret123'
+    });
+    const me = await agent.get('/api/customers/me');
+    expect(me.status).toBe(200);
+    expect(me.body.email).toBe('login-test@example.com');
+  });
+
+  it('rejects /me with no session', async () => {
+    const res = await request(app).get('/api/customers/me');
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects login with the wrong password', async () => {
+    await request(app).post('/api/customers/register').send({
+      email: 'wrongpass@example.com',
+      password: 'supersecret123'
+    });
+    const res = await request(app).post('/api/customers/login').send({
+      email: 'wrongpass@example.com',
+      password: 'incorrect-password'
+    });
+    expect(res.status).toBe(401);
+  });
+});