@assistkick/create 1.0.0

package/templates/product-system/tests/side_panel.test.ts

@@ -0,0 +1,345 @@
+/**
+ * Tests for SidePanel class — node detail side panel.
+ * Uses node:test built-in runner.
+ */
+import { describe, it, mock } from 'node:test';
+import assert from 'node:assert/strict';
+class SidePanel {
+  panelEl: any;
+  titleEl: any;
+  bodyEl: any;
+  markdownRenderer: any;
+  apiClient: any;
+  onEdgeClick: any;
+  graphData: any = null;
+
+  constructor(panelEl: any, titleEl: any, bodyEl: any, markdownRenderer: any, apiClient: any, onEdgeClick: any) {
+    this.panelEl = panelEl;
+    this.titleEl = titleEl;
+    this.bodyEl = bodyEl;
+    this.markdownRenderer = markdownRenderer;
+    this.apiClient = apiClient;
+    this.onEdgeClick = onEdgeClick;
+  }
+
+  setGraphData(data: any) { this.graphData = data; }
+
+  async open(node: any) {
+    try {
+      const detail = await this.apiClient.fetchNode(node.id);
+      this.renderContent(node, detail.content);
+      this.panelEl.classList.add('open');
+    } catch { /* fail silently */ }
+  }
+
+  close() { this.panelEl.classList.remove('open'); }
+
+  findEdges(nodeId: string) {
+    if (!this.graphData) return [];
+    const edges: any[] = [];
+    this.graphData.edges.forEach((e: any) => {
+      if (e.from === nodeId) edges.push({ neighborId: e.to, relation: e.relation, direction: 'outgoing' });
+      else if (e.to === nodeId) edges.push({ neighborId: e.from, relation: e.relation, direction: 'incoming' });
+    });
+    return edges;
+  }
+
+  buildStatusSection(node: any) {
+    const statusLabel = (node.status || 'draft').replace(/_/g, ' ');
+    const completeness = Math.round((node.completeness || 0) * 100);
+    const typeLabel = node.type ? node.type.replace(/_/g, ' ') : '';
+    return `<div class="panel-status-section"><span class="panel-type-badge">${typeLabel}</span><span class="panel-status-badge panel-status-${node.status || 'draft'}">${statusLabel}</span><span class="panel-completeness">${completeness}% complete</span></div>`;
+  }
+
+  buildEdgesSection(nodeId: string) {
+    const edges = this.findEdges(nodeId);
+    if (edges.length === 0) return '';
+    let html = '<div class="panel-edges-section"><h3>Relationships</h3><ul class="panel-edge-list">';
+    for (const edge of edges) {
+      const neighborNode = this.graphData?.nodes.find((n: any) => n.id === edge.neighborId);
+      const name = neighborNode ? neighborNode.name : edge.neighborId;
+      const direction = edge.direction === 'outgoing' ? '\u2192' : '\u2190';
+      html += `<li class="panel-edge-item"><span class="panel-edge-direction">${direction}</span><span class="panel-edge-relation">${edge.relation.replace(/_/g, ' ')}</span><a class="panel-edge-link" href="#">${name}</a><span class="panel-edge-id">${edge.neighborId}</span></li>`;
+    }
+    html += '</ul></div>';
+    return html;
+  }
+
+  renderMarkdown(md: string) {
+    const stripped = md.replace(/^---[\s\S]*?---\n*/m, '');
+    if (this.markdownRenderer) {
+      try { return this.markdownRenderer(stripped); } catch { return stripped; }
+    }
+    // Basic fallback renderer
+    let html = stripped
+      .replace(/^## (.+)$/gm, '<h2>$1</h2>')
+      .replace(/^- (.+)$/gm, '<li>$1</li>');
+    html = html.replace(/(<li>.*<\/li>\n?)+/g, (match) => `<ul>${match}</ul>`);
+    return html;
+  }
+
+  renderContent(node: any, content: string) {
+    if (this.titleEl) this.titleEl.textContent = `${node.name} (${node.id})`;
+    if (this.bodyEl) {
+      const statusHtml = this.buildStatusSection(node);
+      const mdHtml = this.renderMarkdown(content);
+      const edgesHtml = this.buildEdgesSection(node.id);
+      this.bodyEl.innerHTML = statusHtml + mdHtml + edgesHtml;
+    }
+  }
+}
+
+// --- Mock helpers ---
+
+const createMockPanel = () => ({ classList: { add: mock.fn(), remove: mock.fn() } });
+const createMockTitle = () => ({ textContent: '' });
+const createMockBody = () => ({
+  innerHTML: '',
+  querySelectorAll: mock.fn(() => []),
+});
+
+const SAMPLE_GRAPH_DATA = {
+  nodes: [
+    { id: 'feat_001', name: 'Node CRUD', type: 'feature', status: 'defined', completeness: 1, open_questions_count: 0 },
+    { id: 'comp_001', name: 'GraphStore', type: 'component', status: 'defined', completeness: 0.8, open_questions_count: 0 },
+    { id: 'dec_001', name: 'JSON Storage', type: 'decision', status: 'draft', completeness: 0.5, open_questions_count: 2 },
+  ],
+  edges: [
+    { from: 'feat_001', to: 'comp_001', relation: 'contains' },
+    { from: 'feat_001', to: 'dec_001', relation: 'governed_by' },
+  ],
+};
+
+const SAMPLE_MARKDOWN = `---
+id: feat_001
+type: feature
+---
+## Description
+This is a test node.
+
+## Acceptance Criteria
+- Criterion one
+- Criterion two
+`;
+
+// --- Tests ---
+
+describe('SidePanel', () => {
+
+  describe('constructor', () => {
+    it('stores all injected dependencies', () => {
+      const panelEl = createMockPanel();
+      const titleEl = createMockTitle();
+      const bodyEl = createMockBody();
+      const renderer = mock.fn();
+      const apiClient = {};
+      const onEdgeClick = mock.fn();
+
+      const panel = new SidePanel(panelEl, titleEl, bodyEl, renderer, apiClient, onEdgeClick);
+
+      assert.equal(panel.panelEl, panelEl);
+      assert.equal(panel.titleEl, titleEl);
+      assert.equal(panel.bodyEl, bodyEl);
+      assert.equal(panel.markdownRenderer, renderer);
+      assert.equal(panel.apiClient, apiClient);
+      assert.equal(panel.onEdgeClick, onEdgeClick);
+    });
+  });
+
+  describe('setGraphData', () => {
+    it('stores graph data for edge lookups', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+      assert.equal(panel.graphData, SAMPLE_GRAPH_DATA);
+    });
+  });
+
+  describe('open', () => {
+    it('fetches node content and adds open class', async () => {
+      const panelEl = createMockPanel();
+      const bodyEl = createMockBody();
+      const mockApi = { fetchNode: mock.fn(async () => ({ id: 'feat_001', content: SAMPLE_MARKDOWN })) };
+
+      const panel = new SidePanel(panelEl, createMockTitle(), bodyEl, null, mockApi, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      const node = SAMPLE_GRAPH_DATA.nodes[0];
+      await panel.open(node);
+
+      assert.equal(mockApi.fetchNode.mock.calls.length, 1);
+      assert.equal(mockApi.fetchNode.mock.calls[0].arguments[0], 'feat_001');
+      assert.equal(panelEl.classList.add.mock.calls.length, 1);
+      assert.equal(panelEl.classList.add.mock.calls[0].arguments[0], 'open');
+    });
+
+    it('handles API errors gracefully', async () => {
+      const panelEl = createMockPanel();
+      const mockApi = { fetchNode: mock.fn(async () => { throw new Error('404'); }) };
+
+      const panel = new SidePanel(panelEl, createMockTitle(), createMockBody(), null, mockApi, null);
+
+      await panel.open({ id: 'feat_999', name: 'Missing' });
+      // Should not throw, panel should NOT open
+      assert.equal(panelEl.classList.add.mock.calls.length, 0);
+    });
+  });
+
+  describe('close', () => {
+    it('removes open class from panel', () => {
+      const panelEl = createMockPanel();
+      const panel = new SidePanel(panelEl, createMockTitle(), createMockBody(), null, {}, null);
+
+      panel.close();
+      assert.equal(panelEl.classList.remove.mock.calls.length, 1);
+      assert.equal(panelEl.classList.remove.mock.calls[0].arguments[0], 'open');
+    });
+  });
+
+  describe('buildStatusSection', () => {
+    it('renders status badge and completeness', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+
+      const node = { status: 'defined', completeness: 0.85, type: 'feature' };
+      const html = panel.buildStatusSection(node);
+
+      assert.ok(html.includes('panel-status-defined'));
+      assert.ok(html.includes('defined'));
+      assert.ok(html.includes('85% complete'));
+      assert.ok(html.includes('feature'));
+    });
+
+    it('handles partially_defined status', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+
+      const node = { status: 'partially_defined', completeness: 0.5, type: 'decision' };
+      const html = panel.buildStatusSection(node);
+
+      assert.ok(html.includes('panel-status-partially_defined'));
+      assert.ok(html.includes('partially defined'));
+      assert.ok(html.includes('50% complete'));
+    });
+
+    it('defaults to draft when status is missing', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+
+      const html = panel.buildStatusSection({});
+      assert.ok(html.includes('panel-status-draft'));
+      assert.ok(html.includes('0% complete'));
+    });
+  });
+
+  describe('findEdges', () => {
+    it('finds outgoing edges', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      const edges = panel.findEdges('feat_001');
+      assert.equal(edges.length, 2);
+      assert.equal(edges[0].neighborId, 'comp_001');
+      assert.equal(edges[0].direction, 'outgoing');
+      assert.equal(edges[0].relation, 'contains');
+    });
+
+    it('finds incoming edges', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      const edges = panel.findEdges('comp_001');
+      assert.equal(edges.length, 1);
+      assert.equal(edges[0].neighborId, 'feat_001');
+      assert.equal(edges[0].direction, 'incoming');
+    });
+
+    it('returns empty array when no graph data', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      const edges = panel.findEdges('feat_001');
+      assert.deepEqual(edges, []);
+    });
+
+    it('returns empty array for node with no edges', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData({ nodes: [], edges: [] });
+
+      const edges = panel.findEdges('feat_999');
+      assert.deepEqual(edges, []);
+    });
+  });
+
+  describe('buildEdgesSection', () => {
+    it('renders edge list with neighbor names', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      const html = panel.buildEdgesSection('feat_001');
+      assert.ok(html.includes('GraphStore'));
+      assert.ok(html.includes('JSON Storage'));
+      assert.ok(html.includes('comp_001'));
+      assert.ok(html.includes('dec_001'));
+      assert.ok(html.includes('panel-edge-link'));
+      assert.ok(html.includes('contains'));
+      assert.ok(html.includes('governed by'));
+    });
+
+    it('returns empty string when no graph data', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      const html = panel.buildEdgesSection('feat_001');
+      assert.equal(html, '');
+    });
+
+    it('returns empty string for node with no edges', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+      panel.setGraphData({ nodes: [], edges: [] });
+
+      const html = panel.buildEdgesSection('feat_999');
+      assert.equal(html, '');
+    });
+  });
+
+  describe('renderMarkdown', () => {
+    it('uses injected markdown renderer when provided', () => {
+      const mockRenderer = mock.fn((md) => `<p>rendered: ${md}</p>`);
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), mockRenderer, {}, null);
+
+      const result = panel.renderMarkdown(SAMPLE_MARKDOWN);
+      assert.equal(mockRenderer.mock.calls.length, 1);
+      assert.ok(result.includes('rendered:'));
+      // Should strip frontmatter before passing to renderer
+      assert.ok(!result.includes('id: feat_001'));
+    });
+
+    it('falls back to basic renderer when no marked.js', () => {
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), createMockBody(), null, {}, null);
+
+      const result = panel.renderMarkdown(SAMPLE_MARKDOWN);
+      assert.ok(result.includes('<h2>Description</h2>'));
+      assert.ok(result.includes('<li>Criterion one</li>'));
+      // Should strip frontmatter
+      assert.ok(!result.includes('id: feat_001'));
+    });
+  });
+
+  describe('renderContent', () => {
+    it('sets title with node name and id', () => {
+      const titleEl = createMockTitle();
+      const bodyEl = createMockBody();
+      const panel = new SidePanel(createMockPanel(), titleEl, bodyEl, null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      panel.renderContent(SAMPLE_GRAPH_DATA.nodes[0], SAMPLE_MARKDOWN);
+      assert.equal(titleEl.textContent, 'Node CRUD (feat_001)');
+    });
+
+    it('includes status section, markdown, and edges in body', () => {
+      const bodyEl = createMockBody();
+      const panel = new SidePanel(createMockPanel(), createMockTitle(), bodyEl, null, {}, null);
+      panel.setGraphData(SAMPLE_GRAPH_DATA);
+
+      panel.renderContent(SAMPLE_GRAPH_DATA.nodes[0], SAMPLE_MARKDOWN);
+
+      assert.ok(bodyEl.innerHTML.includes('panel-status-section'));
+      assert.ok(bodyEl.innerHTML.includes('Description'));
+      assert.ok(bodyEl.innerHTML.includes('Relationships'));
+      assert.ok(bodyEl.innerHTML.includes('GraphStore'));
+    });
+  });
+});

package/templates/product-system/tests/spec_completeness_label.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Tests for feat_056: Label Spec Completeness Bar on Kanban Cards.
+ * Verifies that the completeness bar displays a 'Spec' prefix label
+ * to distinguish spec completeness from pipeline task progress.
+ * Uses node:test built-in runner.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+/**
+ * The completeness bar label formatting logic extracted from kanban_renderer.js.
+ * The renderer creates a prefix label 'Spec' and a percentage label like '75%'.
+ */
+const formatCompletenessLabel = (completeness) => {
+  const pct = Math.round((completeness || 0) * 100);
+  return `${pct}%`;
+};
+
+const SPEC_PREFIX = 'Spec';
+
+describe('Spec completeness label on kanban cards', () => {
+  describe('prefix label', () => {
+    it('uses "Spec" as the prefix text', () => {
+      assert.equal(SPEC_PREFIX, 'Spec');
+    });
+  });
+
+  describe('formatCompletenessLabel', () => {
+    it('formats 100% completeness', () => {
+      assert.equal(formatCompletenessLabel(1), '100%');
+    });
+
+    it('formats 0% completeness', () => {
+      assert.equal(formatCompletenessLabel(0), '0%');
+    });
+
+    it('formats partial completeness', () => {
+      assert.equal(formatCompletenessLabel(0.75), '75%');
+    });
+
+    it('rounds fractional completeness', () => {
+      assert.equal(formatCompletenessLabel(0.333), '33%');
+    });
+
+    it('handles null completeness', () => {
+      assert.equal(formatCompletenessLabel(null), '0%');
+    });
+
+    it('handles undefined completeness', () => {
+      assert.equal(formatCompletenessLabel(undefined), '0%');
+    });
+  });
+
+  describe('label disambiguates from pipeline progress', () => {
+    it('spec label and task progress use different formats', () => {
+      // Spec completeness: "Spec 75%"
+      const specDisplay = `${SPEC_PREFIX} ${formatCompletenessLabel(0.75)}`;
+      assert.equal(specDisplay, 'Spec 75%');
+
+      // Pipeline task progress: "3/7 tasks" (from feat_052/055)
+      const taskProgress = '3/7 tasks';
+
+      // They are clearly different formats
+      assert.notEqual(specDisplay, taskProgress);
+      assert.ok(specDisplay.startsWith('Spec'), 'spec display starts with Spec prefix');
+      assert.ok(!taskProgress.startsWith('Spec'), 'task progress does not start with Spec');
+    });
+  });
+});

package/templates/product-system/tests/url_routing_test.ts

@@ -0,0 +1,122 @@
+/**
+ * Tests for URL-based view routing (feat_032).
+ * Tests the hash parsing and tab validation logic.
+ *
+ * Run: node --test ui/url_routing_test.js
+ */
+
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+
+/**
+ * Extracts the tab name from a URL hash string.
+ * Mirrors the logic in App.getTabFromHash.
+ */
+const getTabFromHash = (hash, validTabs) => {
+  const name = hash.replace('#', '');
+  return validTabs.has(name) ? name : 'graph';
+};
+
+const VALID_TABS = new Set(['graph', 'kanban']);
+
+describe('URL routing — getTabFromHash', () => {
+  it('returns "graph" for empty hash', () => {
+    assert.equal(getTabFromHash('', VALID_TABS), 'graph');
+  });
+
+  it('returns "graph" for hash "#graph"', () => {
+    assert.equal(getTabFromHash('#graph', VALID_TABS), 'graph');
+  });
+
+  it('returns "kanban" for hash "#kanban"', () => {
+    assert.equal(getTabFromHash('#kanban', VALID_TABS), 'kanban');
+  });
+
+  it('returns "graph" for unknown hash value', () => {
+    assert.equal(getTabFromHash('#settings', VALID_TABS), 'graph');
+  });
+
+  it('returns "graph" for hash with just "#"', () => {
+    assert.equal(getTabFromHash('#', VALID_TABS), 'graph');
+  });
+
+  it('returns "graph" for hash with invalid characters', () => {
+    assert.equal(getTabFromHash('#kanban/extra', VALID_TABS), 'graph');
+  });
+});
+
+describe('URL routing — switchTab hash update', () => {
+  let hashValue;
+  let activeTab;
+  let tabClasses;
+  let containerDisplays;
+
+  const mockSwitchTab = (tabName, { updateHash = true } = {}) => {
+    activeTab = tabName;
+    if (updateHash) {
+      hashValue = tabName;
+    }
+    tabClasses = {
+      graph: tabName === 'graph' ? 'active' : '',
+      kanban: tabName === 'kanban' ? 'active' : '',
+    };
+    containerDisplays = {
+      graph: tabName === 'graph' ? 'block' : 'none',
+      kanban: tabName === 'graph' ? 'none' : 'flex',
+      legend: tabName === 'graph' ? 'block' : 'none',
+    };
+  };
+
+  beforeEach(() => {
+    hashValue = '';
+    activeTab = 'graph';
+    tabClasses = {};
+    containerDisplays = {};
+  });
+
+  it('updates hash when switching to kanban', () => {
+    mockSwitchTab('kanban');
+    assert.equal(hashValue, 'kanban');
+    assert.equal(activeTab, 'kanban');
+  });
+
+  it('updates hash when switching to graph', () => {
+    mockSwitchTab('kanban');
+    mockSwitchTab('graph');
+    assert.equal(hashValue, 'graph');
+    assert.equal(activeTab, 'graph');
+  });
+
+  it('does not update hash when updateHash is false', () => {
+    hashValue = 'original';
+    mockSwitchTab('kanban', { updateHash: false });
+    assert.equal(hashValue, 'original');
+    assert.equal(activeTab, 'kanban');
+  });
+
+  it('sets correct active tab classes for graph', () => {
+    mockSwitchTab('graph');
+    assert.equal(tabClasses.graph, 'active');
+    assert.equal(tabClasses.kanban, '');
+  });
+
+  it('sets correct active tab classes for kanban', () => {
+    mockSwitchTab('kanban');
+    assert.equal(tabClasses.graph, '');
+    assert.equal(tabClasses.kanban, 'active');
+  });
+
+  it('shows graph container and legend when graph tab active', () => {
+    mockSwitchTab('graph');
+    assert.equal(containerDisplays.graph, 'block');
+    assert.equal(containerDisplays.kanban, 'none');
+    assert.equal(containerDisplays.legend, 'block');
+  });
+
+  it('shows kanban container and hides legend when kanban tab active', () => {
+    mockSwitchTab('kanban');
+    assert.equal(containerDisplays.graph, 'none');
+    assert.equal(containerDisplays.kanban, 'flex');
+    assert.equal(containerDisplays.legend, 'none');
+  });
+});

package/templates/product-system/tests/user_login.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Unit tests for User Login (feat_065).
+ * Tests login route validation logic and data flow
+ * without requiring a real database or HTTP server.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+// --- Login validation tests ---
+
+describe('Login route validation', () => {
+  it('rejects missing email', () => {
+    const body = { password: 'TestPassword123' };
+    const isValid = body.email && body.password;
+    assert.equal(isValid, undefined);
+  });
+
+  it('rejects missing password', () => {
+    const body = { email: 'test@example.com' };
+    const isValid = body.email && (body as any).password;
+    assert.equal(isValid, undefined);
+  });
+
+  it('rejects non-string email', () => {
+    const email = 123;
+    assert.equal(typeof email === 'string', false);
+  });
+
+  it('rejects non-string password', () => {
+    const password = true;
+    assert.equal(typeof password === 'string', false);
+  });
+});
+
+// --- Login credential verification tests ---
+
+describe('Login credential verification', () => {
+  it('verifyPassword returns true for correct password', async () => {
+    const { hash, compare } = await import('bcryptjs');
+    const password = 'CorrectPassword123';
+    const hashed = await hash(password, 12);
+    const result = await compare(password, hashed);
+    assert.equal(result, true);
+  });
+
+  it('verifyPassword returns false for wrong password', async () => {
+    const { hash, compare } = await import('bcryptjs');
+    const hashed = await hash('CorrectPassword123', 12);
+    const result = await compare('WrongPassword', hashed);
+    assert.equal(result, false);
+  });
+
+  it('email lookup is case-insensitive via toLowerCase', () => {
+    const inputEmail = 'Test@EXAMPLE.com';
+    const storedEmail = 'test@example.com';
+    assert.equal(inputEmail.toLowerCase(), storedEmail);
+  });
+});
+
+// --- Login response tests ---
+
+describe('Login response shape', () => {
+  it('returns user object with id, email, and role on success', () => {
+    const user = { id: 'uuid-123', email: 'test@example.com', passwordHash: '$2b$12$xxx', role: 'user' };
+    const response = {
+      user: { id: user.id, email: user.email, role: user.role },
+    };
+    assert.ok(response.user.id);
+    assert.ok(response.user.email);
+    assert.equal(response.user.role, 'user');
+    assert.equal((response.user as any).passwordHash, undefined);
+  });
+
+  it('returns 401 for non-existent user (same message as wrong password)', () => {
+    const userFound = undefined;
+    const statusCode = !userFound ? 401 : 200;
+    assert.equal(statusCode, 401);
+  });
+
+  it('returns 401 for wrong password (same message as non-existent user)', () => {
+    const passwordValid = false;
+    const statusCode = !passwordValid ? 401 : 200;
+    assert.equal(statusCode, 401);
+  });
+
+  it('uses generic error message to prevent user enumeration', () => {
+    const errorMessage = 'Invalid email or password';
+    // Same message whether user doesn't exist or password is wrong
+    assert.equal(errorMessage, 'Invalid email or password');
+  });
+});
+
+// --- Token generation on login ---
+
+describe('Login token generation', () => {
+  it('generates access token with user claims after successful login', async () => {
+    const { SignJWT, jwtVerify } = await import('jose');
+    const secret = new TextEncoder().encode('test-secret-key-for-unit-tests');
+
+    const user = { id: 'user-456', email: 'login@example.com', role: 'user' };
+    const token = await new SignJWT({ sub: user.id, email: user.email, role: user.role })
+      .setProtectedHeader({ alg: 'HS256' })
+      .setIssuedAt()
+      .setExpirationTime('30m')
+      .sign(secret);
+
+    const { payload } = await jwtVerify(token, secret);
+    assert.equal(payload.sub, 'user-456');
+    assert.equal(payload.email, 'login@example.com');
+    assert.equal(payload.role, 'user');
+  });
+
+  it('generates refresh token with type=refresh claim', async () => {
+    const { SignJWT, jwtVerify } = await import('jose');
+    const secret = new TextEncoder().encode('test-secret-key-for-unit-tests');
+
+    const token = await new SignJWT({ sub: 'user-456', type: 'refresh' })
+      .setProtectedHeader({ alg: 'HS256' })
+      .setIssuedAt()
+      .setExpirationTime('7d')
+      .sign(secret);
+
+    const { payload } = await jwtVerify(token, secret);
+    assert.equal(payload.sub, 'user-456');
+    assert.equal(payload.type, 'refresh');
+  });
+
+  it('stores refresh token hash (not raw token) in DB', async () => {
+    const { hash } = await import('bcryptjs');
+    const refreshToken = 'eyJhbGciOiJIUzI1NiJ9.fake.token';
+    const tokenHash = await hash(refreshToken, 12);
+    // Hash should not equal the raw token
+    assert.notEqual(tokenHash, refreshToken);
+    assert.ok(tokenHash.startsWith('$2'));
+  });
+});
+
+// --- Login cookie settings ---
+
+describe('Login cookie settings', () => {
+  it('sets HTTP-only cookies', () => {
+    const cookieOptions = { httpOnly: true, secure: true, sameSite: 'strict' as const };
+    assert.equal(cookieOptions.httpOnly, true);
+  });
+
+  it('refresh token cookie path is restricted to /api/auth', () => {
+    const refreshCookiePath = '/api/auth';
+    assert.equal(refreshCookiePath, '/api/auth');
+  });
+});