create-tigra 3.0.0 → 3.0.3

package/template/server/src/libs/requestLogger.ts

@@ -1,5 +1,6 @@
 import type { FastifyRequest, FastifyReply } from 'fastify';
 import { logger } from '@libs/logger.js';
+import { getClientIp } from '@libs/client-ip.js';
 
 const colors = {
   // Methods: blue=read, green=create, yellow=update, red=destroy, gray=meta
@@ -44,17 +45,22 @@ export function markRequestStart(request: FastifyRequest): void {
 /**
  * Log a single-line request/response summary (called in onResponse)
  *
- * Format: GET /api/v1/auth/me 200 OK (12ms)
+ * Format: GET /api/v1/auth/me 200 OK (12ms) [ip=203.0.113.7 reqId=<uuid>]
+ *
+ * The IP is the Cloudflare-/proxy-aware resolved client IP (getClientIp), so
+ * behind Cloudflare we log the CF-Connecting-IP, not the shared edge IP. reqId
+ * is request.id (inbound X-Request-Id or the minted UUID) for log↔Sentry tie-up.
  */
 export function logRequestLine(request: FastifyRequest, reply: FastifyReply): void {
   const duration = request.startTime ? Date.now() - request.startTime : 0;
   const statusCode = reply.statusCode;
   const statusMessage = reply.raw.statusMessage || '';
+  const clientIp = getClientIp(request);
 
   const methodColor = colors[request.method as keyof typeof colors] || colors.reset;
   const statusColor = getStatusColor(statusCode);
 
-  const line = `${methodColor}${request.method.padEnd(7)}${colors.reset}${request.url} ${statusColor}${statusCode} ${statusMessage}${colors.reset} ${colors.dim}(${formatDuration(duration)})${colors.reset}`;
+  const line = `${methodColor}${request.method.padEnd(7)}${colors.reset}${request.url} ${statusColor}${statusCode} ${statusMessage}${colors.reset} ${colors.dim}(${formatDuration(duration)}) [ip=${clientIp} reqId=${request.id}]${colors.reset}`;
 
   if (statusCode >= 500) {
     logger.error(line);

package/template/server/src/libs/storage/file-storage.service.ts

@@ -2,11 +2,25 @@
  * File Storage Service
  *
  * Handles local file system operations for user-uploaded files.
- * Directory structure: uploads/users/{userId}/<media-type>/
+ *
+ * ── Two-tier storage (security: closes the @fastify/static over-exposure) ──────
+ * PUBLIC tier  (UPLOAD_PUBLIC_DIR, default <cwd>/uploads/public):
+ *   uploads/public/users/{userId}/<media-type>/ — avatars and other assets meant
+ *   to be world-readable. THIS is the only directory @fastify/static serves at
+ *   /uploads/, so a private file can never leak through the static mount.
+ * PRIVATE tier (UPLOAD_PRIVATE_DIR, default <cwd>/uploads/private):
+ *   uploads/private/users/{userId}/ — sensitive files. Lives OUTSIDE the static
+ *   root and is reachable ONLY through the auth-gated, owner-scoped streaming
+ *   route GET /api/v1/files/:filename (see src/modules/files/).
+ *
+ * The public avatar URL shape is UNCHANGED — `/uploads/users/{id}/avatar/x.webp`
+ * — because the static mount serves UPLOAD_PUBLIC_DIR at prefix `/uploads/`, so
+ * the file just moves one level down on disk (under public/) with no URL churn.
  */
 
 import fs from 'fs/promises';
 import path from 'path';
+import { env } from '@config/env.js';
 import { logger } from '@libs/logger.js';
 import { InternalError } from '@shared/errors/errors.js';
 import { generateAvatarFilename } from './filename-sanitizer.js';
@@ -15,28 +29,53 @@ import { generateAvatarFilename } from './filename-sanitizer.js';
  * File Storage Service
  *
  * Manages local file storage with per-user directories and SEO-friendly naming.
- * All user media lives under uploads/users/{userId}/ for easy per-user cleanup.
+ * All user media lives under {tier}/users/{userId}/ for easy per-user cleanup.
  */
 class FileStorageService {
-  private readonly uploadDir: string;
-  private readonly usersDir: string;
+  /** PUBLIC tier root — served as static files at /uploads/ (world-readable). */
+  private readonly publicDir: string;
+  /** PRIVATE tier root — NEVER served statically; auth-gated route only. */
+  private readonly privateDir: string;
+  /** {publicDir}/users — per-user public media. */
+  private readonly publicUsersDir: string;
+  /** {privateDir}/users — per-user private media. */
+  private readonly privateUsersDir: string;
 
   constructor() {
-    // Base upload directory: server/uploads
-    this.uploadDir = path.join(process.cwd(), 'uploads');
-    // Users media directory: server/uploads/users
-    this.usersDir = path.join(this.uploadDir, 'users');
+    // Env-driven base paths, optional with <cwd>/uploads/{public,private}
+    // defaults so a clean env still boots (see src/config/env.ts).
+    this.publicDir = env.UPLOAD_PUBLIC_DIR ?? path.join(process.cwd(), 'uploads', 'public');
+    this.privateDir = env.UPLOAD_PRIVATE_DIR ?? path.join(process.cwd(), 'uploads', 'private');
+    this.publicUsersDir = path.join(this.publicDir, 'users');
+    this.privateUsersDir = path.join(this.privateDir, 'users');
+  }
+
+  /** PUBLIC tier root — read by app.ts to scope the @fastify/static mount. */
+  getPublicDir(): string {
+    return this.publicDir;
+  }
+
+  /** PRIVATE tier root — read by the files route for path-containment checks. */
+  getPrivateDir(): string {
+    return this.privateDir;
   }
 
   /**
-   * Gets the base directory for a user's media
+   * Gets the base PUBLIC directory for a user's media
    */
   private getUserDir(userId: string): string {
-    return path.join(this.usersDir, userId);
+    return path.join(this.publicUsersDir, userId);
   }
 
   /**
-   * Gets the avatar directory for a user
+   * Gets the PRIVATE per-user directory
+   */
+  private getUserPrivateDir(userId: string): string {
+    return path.join(this.privateUsersDir, userId);
+  }
+
+  /**
+   * Gets the avatar directory for a user (PUBLIC tier)
    */
   private getUserAvatarDir(userId: string): string {
     return path.join(this.getUserDir(userId), 'avatar');
@@ -189,6 +228,88 @@ class FileStorageService {
     return `/uploads/users/${userId}/avatar/${filename}`;
   }
 
+  /**
+   * Sanitizes a single-segment filename for safe disk storage.
+   *
+   * Strips every path component (returns only the basename) and rejects any
+   * remaining traversal/separator/null-byte chars, so the result can never
+   * escape the user's private directory. This is a storage-side guard; the
+   * files route applies its OWN validation + path-containment check on read.
+   *
+   * @throws InternalError on an empty or unusable name
+   */
+  private sanitizePrivateFilename(filename: string): string {
+    // Reject obvious traversal/separator/null-byte input up front.
+    if (!filename || filename.includes('\0') || filename.includes('/') || filename.includes('\\')) {
+      throw new InternalError('Invalid private filename', 'INVALID_FILENAME');
+    }
+    // Collapse to the basename and drop any leading dots so `..`/`.` can't slip
+    // through; keep a conservative allowlist (letters, digits, . _ -).
+    const base = path.basename(filename).replace(/^\.+/, '');
+    const cleaned = base.replace(/[^a-zA-Z0-9._-]/g, '');
+    if (!cleaned) {
+      throw new InternalError('Invalid private filename', 'INVALID_FILENAME');
+    }
+    return cleaned;
+  }
+
+  /**
+   * Saves a PRIVATE file for a user (PRIVATE tier — never served statically).
+   *
+   * Writes to UPLOAD_PRIVATE_DIR/users/{userId}/<sanitized-filename>. The file
+   * is reachable ONLY through the auth-gated, owner-scoped route
+   * GET /api/v1/files/:filename — there is no static mount over this tier.
+   *
+   * @param userId - User's unique ID (the owner; scopes the directory)
+   * @param filename - Desired filename (sanitized to a safe single segment)
+   * @param buffer - File contents
+   * @returns The sanitized filename and the owner-scoped absolute path
+   */
+  async savePrivateFile(
+    userId: string,
+    filename: string,
+    buffer: Buffer
+  ): Promise<{ filename: string; path: string }> {
+    try {
+      const safeName = this.sanitizePrivateFilename(filename);
+      const userDir = this.getUserPrivateDir(userId);
+      await this.ensureDirectoryExists(userDir);
+
+      const filePath = path.join(userDir, safeName);
+      await fs.writeFile(filePath, buffer);
+
+      logger.info({
+        msg: 'Private file saved successfully',
+        userId,
+        filename: safeName,
+        fileSize: buffer.length,
+      });
+
+      return { filename: safeName, path: filePath };
+    } catch (error) {
+      if (error instanceof InternalError) throw error;
+      logger.error({ err: error, msg: 'Failed to save private file', userId });
+      throw new InternalError('Failed to save private file', 'FILE_SAVE_FAILED');
+    }
+  }
+
+  /**
+   * Resolves the absolute path of a PRIVATE file for a user.
+   *
+   * Owner-scoped by construction: the path is derived from the supplied userId
+   * (the AUTHENTICATED user at the call site) — never a client-supplied owner.
+   * Returns the path WITHOUT touching disk; the caller checks existence and
+   * re-asserts path containment before streaming.
+   *
+   * @param userId - User's unique ID (the owner)
+   * @param filename - File name within the user's private directory
+   * @returns Absolute file path under UPLOAD_PRIVATE_DIR/users/{userId}/
+   */
+  getPrivateFilePath(userId: string, filename: string): string {
+    const safeName = this.sanitizePrivateFilename(filename);
+    return path.join(this.getUserPrivateDir(userId), safeName);
+  }
+
   /**
    * Checks if a file exists
    *
@@ -239,14 +360,21 @@ class FileStorageService {
   /**
    * Initializes the upload directory structure
    *
-   * Creates base uploads directory and users subdirectory if they don't exist.
-   * Should be called at application startup.
+   * Creates BOTH tiers (public + private) and their per-user subdirectories if
+   * they don't exist. Should be called at application startup. Creating the
+   * public dir up front matters because @fastify/static is mounted on it.
    */
   async initialize(): Promise<void> {
     try {
-      await this.ensureDirectoryExists(this.uploadDir);
-      await this.ensureDirectoryExists(this.usersDir);
-      logger.info({ msg: 'File storage initialized', uploadDir: this.uploadDir });
+      await this.ensureDirectoryExists(this.publicDir);
+      await this.ensureDirectoryExists(this.publicUsersDir);
+      await this.ensureDirectoryExists(this.privateDir);
+      await this.ensureDirectoryExists(this.privateUsersDir);
+      logger.info({
+        msg: 'File storage initialized',
+        publicDir: this.publicDir,
+        privateDir: this.privateDir,
+      });
     } catch (error) {
       logger.error({ err: error, msg: 'Failed to initialize file storage' });
       throw new InternalError('Failed to initialize file storage', 'STORAGE_INIT_FAILED');

package/template/server/src/libs/url-safety.ts

@@ -0,0 +1,121 @@
+/**
+ * URL/IP safety helpers shared across outbound-HTTP code paths.
+ *
+ *  - `redactUrl`            — strips secrets (Telegram bot tokens, query strings)
+ *                             from a URL before it reaches any log sink.
+ *  - `isPrivateOrReservedIp`— SSRF building block: returns true for any loopback /
+ *                             private / link-local / ULA / reserved address so the
+ *                             image-fetch guard can reject internal targets.
+ *
+ * Pure, dependency-free, and side-effect-free so they are trivial to unit test.
+ */
+
+/**
+ * Redact a URL so it is safe to log.
+ *
+ * Telegram embeds the bot token directly in the request path:
+ *   https://api.telegram.org/bot<TOKEN>/getFile
+ *   https://api.telegram.org/file/bot<TOKEN>/photos/file_1.jpg
+ * Both forms (`/bot<token>/` and `/file/bot<token>/`) are rewritten to
+ * `/bot<redacted>/`. Any query string is dropped wholesale (it can also carry
+ * media tokens / signatures). Non-Telegram URLs pass through unchanged apart
+ * from query stripping. NEVER throws — an unparseable string is returned with
+ * just the same path-level redaction applied.
+ */
+export function redactUrl(url: string): string {
+  if (typeof url !== 'string' || url.length === 0) {
+    return url;
+  }
+
+  // Drop the query string (and fragment) — may hold signed tokens.
+  const noQuery = url.split(/[?#]/, 1)[0];
+
+  // Rewrite Telegram bot-token path segments. The token charset is [A-Za-z0-9_-]
+  // plus the ':' separating bot-id from secret, e.g. 123456:AAH...
+  return noQuery.replace(/\/bot[A-Za-z0-9:_-]+/g, '/bot<redacted>');
+}
+
+/**
+ * True when `addr` is a loopback / private / link-local / ULA / unspecified /
+ * reserved IP that an SSRF target could use to reach internal infrastructure.
+ *
+ * Covers:
+ *   IPv4: 0.0.0.0, 127/8, 10/8, 172.16/12, 192.168/16, 169.254/16, 100.64/10 (CGNAT)
+ *   IPv6: ::, ::1, fc00::/7 (ULA), fe80::/10 (link-local)
+ *   IPv4-mapped IPv6 (::ffff:a.b.c.d) — re-checked against the IPv4 rules.
+ *
+ * Unrecognised / unparseable input returns true (fail-closed) — the caller
+ * uses this purely to BLOCK, so an address it cannot classify is treated as
+ * unsafe rather than silently allowed.
+ */
+export function isPrivateOrReservedIp(addr: string): boolean {
+  if (typeof addr !== 'string' || addr.length === 0) {
+    return true;
+  }
+
+  const ip = addr.trim().toLowerCase();
+
+  // IPv4-mapped IPv6, e.g. ::ffff:10.0.0.5 or ::ffff:0a00:0005 — extract the v4 tail.
+  const mapped = ip.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) {
+    return isPrivateOrReservedIpv4(mapped[1]);
+  }
+
+  if (ip.includes(':')) {
+    return isReservedIpv6(ip);
+  }
+
+  return isPrivateOrReservedIpv4(ip);
+}
+
+function isPrivateOrReservedIpv4(ip: string): boolean {
+  const parts = ip.split('.');
+  if (parts.length !== 4) {
+    return true; // not a clean dotted-quad → block
+  }
+
+  const octets = parts.map((p) => Number(p));
+  if (octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255)) {
+    return true; // malformed → block
+  }
+
+  const [a, b] = octets;
+
+  if (a === 0) return true; // 0.0.0.0/8 (incl. unspecified)
+  if (a === 127) return true; // 127.0.0.0/8 loopback
+  if (a === 10) return true; // 10.0.0.0/8 private
+  if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12 private
+  if (a === 192 && b === 168) return true; // 192.168.0.0/16 private
+  if (a === 169 && b === 254) return true; // 169.254.0.0/16 link-local
+  if (a === 100 && b >= 64 && b <= 127) return true; // 100.64.0.0/10 CGNAT
+
+  return false;
+}
+
+function isReservedIpv6(ip: string): boolean {
+  // Normalise: drop zone id (fe80::1%eth0) and any brackets.
+  const bare = ip.replace(/^\[|\]$/g, '').split('%')[0];
+
+  if (bare === '::' || bare === '::0' || bare === '0:0:0:0:0:0:0:0') return true; // unspecified
+  if (bare === '::1') return true; // loopback
+
+  // First hextet determines ULA / link-local ranges.
+  const firstHextet = bare.split(':')[0];
+  if (firstHextet === '') {
+    // Address starts with '::' (e.g. '::abcd') — already handled the special
+    // cases above; remaining such addresses are not in fc00::/7 or fe80::/10.
+    return false;
+  }
+
+  const value = parseInt(firstHextet, 16);
+  if (Number.isNaN(value)) {
+    return true; // unparseable hextet → block
+  }
+
+  // fc00::/7  → first 7 bits = 1111110  → first byte 0xfc or 0xfd
+  if ((value & 0xfe00) === 0xfc00) return true;
+  // fe80::/10 → first 10 bits = 1111111010 → 0xfe80..0xfebf
+  if ((value & 0xffc0) === 0xfe80) return true;
+
+  return false;
+}

package/template/server/src/modules/admin/__tests__/admin.integration.test.ts

@@ -0,0 +1,128 @@
+/**
+ * Admin role-gate integration test against REAL containers.
+ *
+ * Exercises the admin-gated route (`GET /api/v1/admin/stats`, behind
+ * `authenticate` + `authorize('ADMIN')`) at all three gates:
+ *   - 401 unauthenticated
+ *   - 403 as a normal logged-in USER
+ *   - 200 as an ADMIN
+ *
+ * The register endpoint cannot mint admins, so we SEED an ADMIN User row
+ * directly via prisma against the container DB, hashing the password with the
+ * server's own `@libs/password` lib so the real login path verifies it.
+ *
+ * Env-before-import: `@/app`, `@/libs/prisma`, `@/libs/password` are all
+ * imported LAZILY inside `beforeAll`, after integration.setup.ts has populated
+ * process.env with the container URLs.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import type { FastifyInstance } from 'fastify';
+
+let app: FastifyInstance;
+let prisma: typeof import('@/libs/prisma.js')['prisma'];
+
+function extractCookie(setCookie: string[] | string | undefined, name: string): string | undefined {
+  const headers = Array.isArray(setCookie) ? setCookie : setCookie ? [setCookie] : [];
+  for (const header of headers) {
+    const first = header.split(';')[0];
+    const eq = first.indexOf('=');
+    if (eq === -1) continue;
+    if (first.slice(0, eq).trim() === name) {
+      return first.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+async function loginAndGetAccessCookie(email: string, password: string): Promise<string> {
+  const res = await app.inject({
+    method: 'POST',
+    url: '/api/v1/auth/login',
+    payload: { email, password },
+  });
+  expect(res.statusCode, `login for ${email} should succeed`).toBe(200);
+  const cookie = extractCookie(res.headers['set-cookie'], 'access_token');
+  expect(cookie, `login for ${email} must set an access_token cookie`).toBeTruthy();
+  return cookie!;
+}
+
+const adminCreds = { email: 'admin-it@example.com', password: 'AdminPass123!' };
+const userCreds = {
+  email: 'normal-it@example.com',
+  password: 'UserPass123!',
+  firstName: 'Normal',
+  lastName: 'User',
+};
+
+let adminCookie: string;
+let userCookie: string;
+
+beforeAll(async () => {
+  const [{ buildApp }, prismaMod, { hashPassword }] = await Promise.all([
+    import('@/app.js'),
+    import('@/libs/prisma.js'),
+    import('@/libs/password.js'),
+  ]);
+  prisma = prismaMod.prisma;
+
+  app = await buildApp();
+  await app.ready();
+
+  // Seed an ADMIN directly — the register endpoint only mints USER role.
+  await prisma.user.create({
+    data: {
+      email: adminCreds.email,
+      password: await hashPassword(adminCreds.password),
+      firstName: 'Admin',
+      lastName: 'It',
+      role: 'ADMIN',
+      isActive: true,
+    },
+  });
+
+  // Create the normal user via the real register endpoint.
+  const reg = await app.inject({
+    method: 'POST',
+    url: '/api/v1/auth/register',
+    payload: userCreds,
+  });
+  expect(reg.statusCode).toBe(201);
+
+  adminCookie = await loginAndGetAccessCookie(adminCreds.email, adminCreds.password);
+  userCookie = await loginAndGetAccessCookie(userCreds.email, userCreds.password);
+});
+
+afterAll(async () => {
+  await app?.close();
+});
+
+describe('admin role gate (real containers)', () => {
+  const ADMIN_ROUTE = '/api/v1/admin/stats';
+
+  it('rejects an UNAUTHENTICATED request (401)', async () => {
+    const res = await app.inject({ method: 'GET', url: ADMIN_ROUTE });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('rejects a normal logged-in USER (403)', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: ADMIN_ROUTE,
+      cookies: { access_token: userCookie },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it('allows an ADMIN (200)', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: ADMIN_ROUTE,
+      cookies: { access_token: adminCookie },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    // Dashboard stats shape (see admin.controller.getDashboardStats).
+    expect(body.data).toHaveProperty('totalUsers');
+  });
+});

package/template/server/src/modules/auth/__tests__/auth.integration.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Money-path integration test — auth flow against REAL containers.
+ *
+ * No payments module exists in the scaffold, so the auth flow (register → login →
+ * authenticated read) is the money-adjacent critical path. This drives the REAL
+ * Fastify app via `app.inject()` against a real MySQL 8 + Redis booted by
+ * `src/test/integration.setup.ts`.
+ *
+ * Env-before-import: `@/app` (which pulls `env.ts` + prisma) is imported LAZILY
+ * inside `beforeAll`, AFTER the setup file has populated process.env with the
+ * container URLs. See integration.setup.ts for the full rationale.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import type { FastifyInstance } from 'fastify';
+
+let app: FastifyInstance;
+
+/**
+ * Pull the `access_token` cookie value out of a set-cookie header array.
+ * The login/register controllers set `access_token`, `refresh_token`, and a
+ * non-httpOnly `auth_session` indicator (see src/libs/cookies.ts).
+ */
+function extractCookie(setCookie: string[] | string | undefined, name: string): string | undefined {
+  const headers = Array.isArray(setCookie) ? setCookie : setCookie ? [setCookie] : [];
+  for (const header of headers) {
+    const first = header.split(';')[0];
+    const eq = first.indexOf('=');
+    if (eq === -1) continue;
+    if (first.slice(0, eq).trim() === name) {
+      return first.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+const validUser = {
+  email: 'moneypath@example.com',
+  password: 'Password123!',
+  firstName: 'Money',
+  lastName: 'Path',
+};
+
+beforeAll(async () => {
+  // LAZY import — env is now populated by integration.setup.ts.
+  const { buildApp } = await import('@/app.js');
+  app = await buildApp();
+  await app.ready();
+});
+
+afterAll(async () => {
+  await app?.close();
+});
+
+describe('auth money-path (real containers)', () => {
+  let accessCookie: string | undefined;
+
+  it('POST /api/v1/auth/register with a valid body succeeds (201) and returns the user', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/register',
+      payload: validUser,
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.user.email).toBe(validUser.email);
+    expect(body.data.user.role).toBe('USER');
+    // Password must never be echoed back.
+    expect(body.data.user.password).toBeUndefined();
+  });
+
+  it('POST /api/v1/auth/register with an INVALID body is rejected (400, Zod validation)', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/register',
+      payload: { email: 'not-an-email', password: 'short', firstName: 'A', lastName: '' },
+    });
+
+    // fastify-type-provider-zod surfaces body validation as a Fastify
+    // validation error → the app's error handler maps it to 400 BAD_REQUEST.
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('POST /api/v1/auth/login with valid credentials succeeds and sets an access_token cookie', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/login',
+      payload: { email: validUser.email, password: validUser.password },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.user.email).toBe(validUser.email);
+
+    const setCookie = res.headers['set-cookie'];
+    accessCookie = extractCookie(setCookie, 'access_token');
+    expect(accessCookie, 'login must set an access_token cookie').toBeTruthy();
+    // The refresh cookie is also set (path-scoped to /api/v1/auth).
+    expect(extractCookie(setCookie, 'refresh_token')).toBeTruthy();
+  });
+
+  it('POST /api/v1/auth/login with a wrong password fails (401)', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/login',
+      payload: { email: validUser.email, password: 'WrongPassword123!' },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('GET /api/v1/auth/me WITHOUT the cookie is rejected (401)', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('GET /api/v1/auth/me WITH the access_token cookie returns 200 and the right user', async () => {
+    expect(accessCookie, 'login test must have captured the cookie first').toBeTruthy();
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+      cookies: { access_token: accessCookie! },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.email).toBe(validUser.email);
+    expect(body.data.role).toBe('USER');
+  });
+});