import { describe, it, expect } from 'vitest' /** * Middleware Route Protection Tests * * These tests verify the route protection logic defined in middleware.ts * Testing the actual middleware requires mocking NextAuth which is complex, * so we test the route matching logic here. */ describe('Middleware Route Protection Logic', () => { // Helper to check if a path is a protected route const isProtectedRoute = (pathname: string): boolean => { return ( pathname === "/" || pathname.startsWith("/list") || pathname.startsWith("/profile") || pathname.startsWith("/invitations") ) } // Helper to check if a path is an auth page const isAuthPage = (pathname: string): boolean => { return pathname.startsWith("/auth") } describe('Protected Routes', () => { it('should identify root path as protected', () => { expect(isProtectedRoute("/")).toBe(true) }) it('should identify list routes as protected', () => { expect(isProtectedRoute("/list")).toBe(true) expect(isProtectedRoute("/list/123")).toBe(true) expect(isProtectedRoute("/list/123/item/456")).toBe(true) }) it('should identify profile routes as protected', () => { expect(isProtectedRoute("/profile")).toBe(true) expect(isProtectedRoute("/profile/settings")).toBe(true) }) it('should identify invitations routes as protected', () => { expect(isProtectedRoute("/invitations")).toBe(true) }) }) describe('Auth Pages', () => { it('should identify login page as auth page', () => { expect(isAuthPage("/auth/login")).toBe(true) }) it('should identify register page as auth page', () => { expect(isAuthPage("/auth/register")).toBe(true) }) it('should identify error page as auth page', () => { expect(isAuthPage("/auth/error")).toBe(true) }) it('should not identify non-auth pages as auth pages', () => { expect(isAuthPage("/")).toBe(false) expect(isAuthPage("/list/123")).toBe(false) }) }) describe('Route Classification', () => { it('should correctly classify various routes', () => { // Protected routes expect(isProtectedRoute("/")).toBe(true) expect(isProtectedRoute("/list/abc123")).toBe(true) expect(isProtectedRoute("/profile")).toBe(true) // Auth pages (not protected, but special handling) expect(isAuthPage("/auth/login")).toBe(true) expect(isAuthPage("/auth/register")).toBe(true) // Public routes (not protected) expect(isProtectedRoute("/api/auth/signin")).toBe(false) expect(isProtectedRoute("/offline")).toBe(false) }) }) describe('Middleware Matcher Pattern', () => { // Test that the matcher pattern would correctly exclude certain paths const shouldBeExcludedByMatcher = (pathname: string): boolean => { // Based on the matcher config in middleware.ts return ( pathname.startsWith("/api") || pathname.startsWith("/_next/static") || pathname.startsWith("/_next/image") || pathname === "/favicon.ico" || /\.(svg|png|jpg|jpeg|gif|webp|ico|json|js)$/.test(pathname) ) } it('should exclude API routes from middleware', () => { expect(shouldBeExcludedByMatcher("/api/lists")).toBe(true) expect(shouldBeExcludedByMatcher("/api/auth/signin")).toBe(true) }) it('should exclude static files from middleware', () => { expect(shouldBeExcludedByMatcher("/_next/static/chunks/main.js")).toBe(true) expect(shouldBeExcludedByMatcher("/_next/image/logo.png")).toBe(true) }) it('should exclude public assets from middleware', () => { expect(shouldBeExcludedByMatcher("/favicon.ico")).toBe(true) expect(shouldBeExcludedByMatcher("/icon-192.png")).toBe(true) expect(shouldBeExcludedByMatcher("/manifest.json")).toBe(true) expect(shouldBeExcludedByMatcher("/sw.js")).toBe(true) }) it('should not exclude regular pages from middleware', () => { expect(shouldBeExcludedByMatcher("/")).toBe(false) expect(shouldBeExcludedByMatcher("/list/123")).toBe(false) expect(shouldBeExcludedByMatcher("/auth/login")).toBe(false) expect(shouldBeExcludedByMatcher("/profile")).toBe(false) }) }) })