Story 2.3: Test Backend Auth Route Handlers

Sprint Key: 2-3-test-backend-auth-route-handlers Epic: 2 PRD: testing-framework

---

Story 2.3: Test Backend Auth Route Handlers

Status: ready-for-dev

Story

As a developer, I want tests for the authentication route group, so that auth endpoints are validated against the API contract.

Acceptance Criteria

1. AC1: Logout with valid token — Test POST /api/auth/logout with a valid JWT returns 200 and { success: true, message: 'Logged out successfully' }.

2. AC2: Logout with expired token — Test POST /api/auth/logout with an expired JWT returns 401 with { error: 'TOKEN_EXPIRED' }.

3. AC3: Logout with no token — Test POST /api/auth/logout without an Authorization header returns 401.

4. AC4: Logout with invalid token — Test POST /api/auth/logout with a malformed JWT returns 401.

5. AC5: Logout ends active sessions — Verifies session cleanup via sessionService.

6. AC6: Logout with no active sessions — Returns 200 without calling endSession.

7. AC7: Logout graceful session error — Session errors do NOT fail the logout (200).

8. AC8: Supertest + createApp pattern — All tests use Supertest with mocked Keycloak.

9. AC9: AAA structure — Arrange-Act-Assert with "should" naming convention.

10. AC10: Existing tests pass — All 191+ tests continue to pass.

Critical Note

Login and refresh endpoints do NOT exist in the backend. Only POST /api/auth/logout is implemented.