evaldoc 1.0.0

package/storage.rules

@@ -0,0 +1,22 @@
+rules_version = '2';
+
+service firebase.storage {
+  match /b/{bucket}/o {
+
+    // Doctor certificates — users can upload their own, 10 MB max, PDF/images only
+    match /certificates/{userId}/{allPaths=**} {
+      allow write: if request.auth != null
+                   && request.auth.uid == userId
+                   && request.resource.size < 10 * 1024 * 1024
+                   && request.resource.contentType.matches('application/pdf|image/.*');
+
+      // Only the uploader can read their own certificates
+      allow read: if request.auth != null && request.auth.uid == userId;
+    }
+
+    // Deny everything else by default
+    match /{allPaths=**} {
+      allow read, write: if false;
+    }
+  }
+}

package/test-api.json

@@ -0,0 +1 @@
+{"handle":"mollit-lorem-consequ","sessionId":"test-001","message":"What are the symptoms of flu?"}

package/tests/emulator/README.md

@@ -0,0 +1,38 @@
+# Firestore Emulator Tests
+
+These tests exercise **real Firestore behavior** (atomic `FieldValue` operations and
+`runTransaction` conflict handling) against the Firebase **Firestore emulator**. They are
+NOT part of the default `jest` run because they require the emulator binary to be installed
+and running.
+
+## Why they are excluded from the default run
+
+The default test suite (`npm test`) ignores everything under `tests/emulator/` via
+`testPathIgnorePatterns` in `jest.config.js`. This keeps the unit/integration suite fast and
+runnable without external dependencies (no emulator, no network).
+
+Files named `*.emulator.test.js` are the emulator suite.
+
+## Prerequisites
+
+- Java 11+ (required by the Firestore emulator)
+- Firebase CLI: `npm install -g firebase-tools`
+- Emulator installed: `firebase setup:emulators:firestore`
+
+## Running
+
+Run the emulator suite through `firebase emulators:exec`, which starts the emulator, runs the
+command, and tears the emulator down afterwards:
+
+```bash
+firebase emulators:exec --only firestore \
+  "npx jest tests/emulator --testPathIgnorePatterns='' "
+```
+
+The emulator exposes `FIRESTORE_EMULATOR_HOST` (e.g. `localhost:8080`) to the process it runs,
+which `firebase-admin` picks up automatically so all reads/writes hit the emulator instead of
+production.
+
+> The provided test file (`counters.emulator.test.js`) is currently a **skeleton**
+> (`describe.skip(...)`). Remove `.skip` and implement the bodies once you have the emulator
+> available locally / in CI.

package/tests/emulator/counters.emulator.test.js

@@ -0,0 +1,81 @@
+'use strict';
+
+/**
+ * Firestore EMULATOR integration tests (SKELETON — intentionally skipped).
+ *
+ * These tests are designed to run against a REAL Firestore emulator (not mocks),
+ * so they validate the actual server-side semantics of atomic field operations and
+ * transaction conflict handling that unit tests with mocks cannot guarantee.
+ *
+ * How to run (see ./README.md for full setup):
+ *
+ *   firebase emulators:exec --only firestore \
+ *     "npx jest tests/emulator --testPathIgnorePatterns='' "
+ *
+ * `firebase-admin` automatically routes to the emulator when the
+ * FIRESTORE_EMULATOR_HOST env var is set by `firebase emulators:exec`.
+ *
+ * This suite is wrapped in `describe.skip(...)` so that:
+ *   - it never runs (and never fails) if someone points jest at this directory
+ *     without an emulator, and
+ *   - the default `npm test` run ignores this whole directory anyway via
+ *     `testPathIgnorePatterns` in jest.config.js.
+ *
+ * To activate: install/start the emulator, then remove `.skip`.
+ */
+
+// Example wiring (uncomment when implementing against the emulator):
+//
+// const admin = require('firebase-admin');
+// const { FieldValue } = require('firebase-admin/firestore');
+//
+// let db;
+// beforeAll(() => {
+//   if (!process.env.FIRESTORE_EMULATOR_HOST) {
+//     throw new Error(
+//       'FIRESTORE_EMULATOR_HOST is not set — run this suite via `firebase emulators:exec`.'
+//     );
+//   }
+//   if (!admin.apps.length) {
+//     admin.initializeApp({ projectId: 'evaldoc-emulator-test' });
+//   }
+//   db = admin.firestore();
+// });
+
+describe.skip('Firestore emulator: counters and transactions', () => {
+  describe('FieldValue.increment on monthlyChatCount', () => {
+    it('increments monthlyChatCount atomically against the real emulator', async () => {
+      // INTENT:
+      //   1. Seed a usage doc with { monthlyChatCount: 0 }.
+      //   2. Apply update({ monthlyChatCount: FieldValue.increment(1) }) N times
+      //      (ideally concurrently) and read the doc back.
+      //   3. Expect monthlyChatCount === N — proving increment is atomic on the server,
+      //      not a read-modify-write race.
+      expect(true).toBe(true);
+    });
+  });
+
+  describe('FieldValue.arrayUnion on uniqueSessions', () => {
+    it('dedupes session ids so uniqueSessions contains no duplicates', async () => {
+      // INTENT:
+      //   1. Seed a doc with { uniqueSessions: [] }.
+      //   2. arrayUnion the SAME sessionId multiple times, plus a couple of distinct ids.
+      //   3. Read back and expect uniqueSessions to contain each id exactly once
+      //      (arrayUnion deduplicates on the server).
+      expect(true).toBe(true);
+    });
+  });
+
+  describe('runTransaction handle-uniqueness conflict', () => {
+    it('rejects a transaction that would create a duplicate provider handle', async () => {
+      // INTENT:
+      //   1. Reserve a handle by writing a /handles/{handle} doc inside a transaction
+      //      that first asserts the doc does not exist.
+      //   2. Run a second, concurrent transaction attempting to claim the SAME handle.
+      //   3. Expect exactly one transaction to succeed and the other to be REJECTED
+      //      (contention / already-exists) — proving uniqueness is enforced by the
+      //      transaction, not by application-level checks alone.
+      await expect(Promise.reject(new Error('conflict'))).rejects.toThrow();
+    });
+  });
+});

package/tests/integration/api-account-selfserve.test.js

@@ -0,0 +1,312 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: '{"response":"x"}' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({ generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } }) })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(), createAccountLink: jest.fn(), refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(), createCheckoutSession: jest.fn(), createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(), cancelSubscription: jest.fn(), checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(), handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'valid-doctor-token') return { uid: 'doctor-uid-1', email: 'doc@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+function seedProvider(overrides = {}) {
+  admin.__seed('providers', 'doctor-uid-1', {
+    ownerUid: 'doctor-uid-1',
+    handle: 'drsmith',
+    displayName: 'Dr. Smith',
+    specialty: 'General',
+    status: 'published',
+    enabledTopics: ['general_health_info'],
+    plan: 'free',
+    monthlyChatLimit: 50,
+    monthlyChatCount: 5,
+    verificationStatus: 'pending',
+    ...overrides
+  });
+  admin.__seed('handles', 'drsmith', { providerId: 'doctor-uid-1' });
+}
+
+describe('Account & Self-Serve API', () => {
+  beforeEach(() => {
+    admin.__reset();
+    seedProvider();
+  });
+
+  describe('GET /api/provider/verification-status', () => {
+    it('returns pending status with SLA message and canUsePreview=true', async () => {
+      seedProvider({ verificationStatus: 'pending' });
+
+      const res = await request(app)
+        .get('/api/provider/verification-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.verificationStatus).toBe('pending');
+      expect(res.body.slaHours).toBe(48);
+      expect(res.body.message).toMatch(/under review/i);
+      expect(res.body.canUsePreview).toBe(true);
+      expect(res.body.canResubmit).toBe(false);
+    });
+
+    it('returns verified status with canUsePreview=false', async () => {
+      seedProvider({ verificationStatus: 'verified' });
+
+      const res = await request(app)
+        .get('/api/provider/verification-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.verificationStatus).toBe('verified');
+      expect(res.body.canUsePreview).toBe(false);
+      expect(res.body.canResubmit).toBe(false);
+      expect(res.body.message).toMatch(/verified/i);
+    });
+
+    it('returns rejected status with canResubmit=true and rejectionReason', async () => {
+      seedProvider({
+        verificationStatus: 'rejected',
+        verificationRejectionReason: 'License could not be verified'
+      });
+
+      const res = await request(app)
+        .get('/api/provider/verification-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.verificationStatus).toBe('rejected');
+      expect(res.body.canResubmit).toBe(true);
+      expect(res.body.rejectionReason).toBe('License could not be verified');
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app).get('/api/provider/verification-status');
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/provider/onboarding-status', () => {
+    it('returns steps, percentComplete, and nextStep for a partially-onboarded provider', async () => {
+      seedProvider({
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        welcomeMessage: '',
+        brandPrimaryColor: '',
+        certificateUrl: '',
+        status: 'draft'
+      });
+
+      const res = await request(app)
+        .get('/api/provider/onboarding-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body.steps)).toBe(true);
+      expect(res.body.steps.length).toBeGreaterThan(0);
+      expect(typeof res.body.percentComplete).toBe('number');
+      expect(res.body.nextStep).not.toBeNull();
+      expect(res.body.isComplete).toBe(false);
+    });
+
+    it('returns isComplete=true when all required steps are done', async () => {
+      seedProvider({
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        welcomeMessage: 'Welcome!',
+        brandPrimaryColor: '#112233',
+        enabledTopics: ['general_health_info'],
+        certificateUrl: 'https://example.com/cert.pdf',
+        // 'published' satisfies both the preview step and the final published
+        // required step, which is needed for isComplete to be true.
+        status: 'published'
+      });
+
+      const res = await request(app)
+        .get('/api/provider/onboarding-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.isComplete).toBe(true);
+      expect(res.body.percentComplete).toBe(100);
+      expect(res.body.nextStep).toBeNull();
+    });
+
+    it('returns percentComplete as a number between 0 and 100', async () => {
+      const res = await request(app)
+        .get('/api/provider/onboarding-status')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(typeof res.body.percentComplete).toBe('number');
+      expect(res.body.percentComplete).toBeGreaterThanOrEqual(0);
+      expect(res.body.percentComplete).toBeLessThanOrEqual(100);
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app).get('/api/provider/onboarding-status');
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/account/export', () => {
+    it('returns exportData with provider, threads, conversations arrays and counts', async () => {
+      admin.__seed('threads', 't1', { doctorId: 'doctor-uid-1', topic: 'general_health_info' });
+      admin.__seed('threads', 't2', { doctorId: 'doctor-uid-1', topic: 'general_health_info' });
+      admin.__seed('conversations', 'c1', { providerId: 'doctor-uid-1', sessionId: 's1' });
+
+      const res = await request(app)
+        .get('/api/account/export')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.provider).toBeDefined();
+      expect(res.body.provider.id).toBe('doctor-uid-1');
+      expect(Array.isArray(res.body.threads)).toBe(true);
+      expect(Array.isArray(res.body.conversations)).toBe(true);
+      expect(res.body.counts.threads).toBe(2);
+      expect(res.body.counts.conversations).toBe(1);
+    });
+
+    it('sets a Content-Disposition attachment header', async () => {
+      const res = await request(app)
+        .get('/api/account/export')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.headers['content-disposition']).toMatch(/attachment/);
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app).get('/api/account/export');
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('DELETE /api/account', () => {
+    it('requires confirm:DELETE in body (400 without it)', async () => {
+      const res = await request(app)
+        .delete('/api/account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({});
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/confirm/i);
+    });
+
+    it('deletes provider, releases handle, and cascades threads/conversations when confirmed', async () => {
+      admin.__seed('threads', 't1', { doctorId: 'doctor-uid-1' });
+      admin.__seed('threads/t1/messages', 'm1', { text: 'hi' });
+      admin.__seed('conversations', 'c1', { providerId: 'doctor-uid-1', sessionId: 's1' });
+
+      const res = await request(app)
+        .delete('/api/account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ confirm: 'DELETE' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.deleted.provider).toBe('doctor-uid-1');
+      expect(res.body.deleted.threads).toBe(1);
+      expect(res.body.deleted.conversations).toBe(1);
+
+      expect(admin.__getAll('providers')['doctor-uid-1']).toBeUndefined();
+      expect(admin.__getAll('handles')['drsmith']).toBeUndefined();
+      expect(admin.__getAll('threads')['t1']).toBeUndefined();
+      expect(admin.__getAll('conversations')['c1']).toBeUndefined();
+    });
+
+    it('returns 404 when no provider exists', async () => {
+      admin.__reset();
+
+      const res = await request(app)
+        .delete('/api/account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ confirm: 'DELETE' });
+
+      expect(res.status).toBe(404);
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app)
+        .delete('/api/account')
+        .send({ confirm: 'DELETE' });
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/pricing', () => {
+    it('returns the b2b_saas model with all plans and patientPayAddOn', async () => {
+      const res = await request(app).get('/api/pricing');
+
+      expect(res.status).toBe(200);
+      expect(res.body.model).toBe('b2b_saas');
+      expect(Array.isArray(res.body.plans)).toBe(true);
+      const keys = res.body.plans.map(p => p.key);
+      expect(keys).toEqual(expect.arrayContaining(['free', 'pro', 'clinic', 'enterprise']));
+      expect(res.body.patientPayAddOn).toBeDefined();
+      expect(res.body.patientPayAddOn.available).toBe(true);
+    });
+
+    it('is public (no auth needed)', async () => {
+      const res = await request(app).get('/api/pricing');
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('GET /api/pricing/:handle', () => {
+    it('returns free:true for a provider with free pricing / payment disabled', async () => {
+      seedProvider({ paymentEnabled: false, pricingModel: 'free' });
+
+      const res = await request(app).get('/api/pricing/drsmith');
+
+      expect(res.status).toBe(200);
+      expect(res.body.free).toBe(true);
+      expect(res.body.pricingModel).toBe('free');
+      expect(res.body.perChatPrice).toBe(0);
+    });
+
+    it('returns pricing details for a paid provider', async () => {
+      seedProvider({ paymentEnabled: true, pricingModel: 'per-chat', perChatPrice: 5 });
+
+      const res = await request(app).get('/api/pricing/drsmith');
+
+      expect(res.status).toBe(200);
+      expect(res.body.free).toBe(false);
+      expect(res.body.pricingModel).toBe('per-chat');
+      expect(res.body.perChatPrice).toBe(5);
+    });
+
+    it('returns 404 for a non-existent handle', async () => {
+      const res = await request(app).get('/api/pricing/nobody');
+      expect(res.status).toBe(404);
+    });
+
+    it('does not expose pricing for a draft (unpublished) provider', async () => {
+      seedProvider({ status: 'draft', paymentEnabled: true, pricingModel: 'per-chat', perChatPrice: 5 });
+      const res = await request(app).get('/api/pricing/drsmith');
+      expect(res.status).toBe(404);
+    });
+  });
+});

package/tests/integration/api-admin-digest.test.js

@@ -0,0 +1,202 @@
+process.env.NODE_ENV = 'test';
+process.env.INTERNAL_API_KEY = 'test-internal-key';
+process.env.ADMIN_UIDS = 'admin-uid-1';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: '{"response":"Draft reply"}' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } })
+    })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(),
+  createAccountLink: jest.fn(),
+  refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(),
+  cancelSubscription: jest.fn(),
+  checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(),
+  handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'valid-admin-token') return { uid: 'admin-uid-1', email: 'admin@test.com' };
+  if (token === 'non-admin-token') return { uid: 'random-uid', email: 'doc@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+describe('Admin & Internal API Endpoints', () => {
+  beforeEach(() => {
+    admin.__reset();
+  });
+
+  // -------------------------------------------------------
+  // POST /api/internal/daily-digest
+  // -------------------------------------------------------
+  describe('POST /api/internal/daily-digest', () => {
+    it('should return 401 when no API key provided', async () => {
+      const res = await request(app)
+        .post('/api/internal/daily-digest')
+        .send();
+
+      expect(res.status).toBe(401);
+      expect(res.body.error).toBe('Unauthorized');
+    });
+
+    it('should return 401 when wrong API key provided', async () => {
+      const res = await request(app)
+        .post('/api/internal/daily-digest')
+        .set('X-API-Key', 'wrong-key')
+        .send();
+
+      expect(res.status).toBe(401);
+      expect(res.body.error).toBe('Unauthorized');
+    });
+
+    it('should succeed with correct API key and no providers', async () => {
+      const res = await request(app)
+        .post('/api/internal/daily-digest')
+        .set('X-API-Key', 'test-internal-key')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.digests).toBe(0);
+    });
+
+    it('should iterate providers and send digest notifications', async () => {
+      // Seed published providers
+      admin.__seed('providers', 'provider-1', {
+        status: 'published',
+        displayName: 'Dr. Alpha',
+        notificationPreferences: { dailyDigestEnabled: true }
+      });
+      admin.__seed('providers', 'provider-2', {
+        status: 'published',
+        displayName: 'Dr. Beta',
+        notificationPreferences: { dailyDigestEnabled: true }
+      });
+
+      // Seed threads with recent activity so generateDailyDigest produces results
+      const now = new Date();
+      admin.__seed('threads', 'thread-p1', {
+        doctorId: 'provider-1',
+        lastMessageAt: now,
+        triageCategory: 'urgent',
+        unreadByDoctor: 2
+      });
+      admin.__seed('threads', 'thread-p2', {
+        doctorId: 'provider-2',
+        lastMessageAt: now,
+        triageCategory: 'needs_review',
+        unreadByDoctor: 1
+      });
+
+      const res = await request(app)
+        .post('/api/internal/daily-digest')
+        .set('X-API-Key', 'test-internal-key')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.digests).toBe(2);
+    });
+
+    it('should skip providers with dailyDigestEnabled set to false', async () => {
+      admin.__seed('providers', 'provider-no-digest', {
+        status: 'published',
+        displayName: 'Dr. NoDigest',
+        notificationPreferences: { dailyDigestEnabled: false }
+      });
+
+      const res = await request(app)
+        .post('/api/internal/daily-digest')
+        .set('X-API-Key', 'test-internal-key')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.digests).toBe(0);
+    });
+  });
+
+  // -------------------------------------------------------
+  // GET /api/admin/analytics
+  // -------------------------------------------------------
+  describe('GET /api/admin/analytics', () => {
+    it('should return analytics data for authenticated admin', async () => {
+      // Seed some providers
+      admin.__seed('providers', 'doc-1', {
+        displayName: 'Dr. One',
+        email: 'one@test.com',
+        handle: 'drone',
+        specialty: 'Cardiology',
+        status: 'published'
+      });
+      admin.__seed('providers', 'doc-2', {
+        displayName: 'Dr. Two',
+        email: 'two@test.com',
+        handle: 'drtwo',
+        specialty: 'Dermatology',
+        status: 'draft'
+      });
+
+      // Seed conversations
+      admin.__seed('conversations', 'conv-1', {
+        providerId: 'doc-1',
+        sessionId: 'session-a',
+        createdAt: new Date()
+      });
+      admin.__seed('conversations', 'conv-2', {
+        providerId: 'doc-1',
+        sessionId: 'session-b',
+        createdAt: new Date()
+      });
+
+      const res = await request(app)
+        .get('/api/admin/analytics')
+        .set('Authorization', 'Bearer valid-admin-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.summary).toBeDefined();
+      expect(res.body.summary.totalDoctors).toBe(2);
+      expect(res.body.summary.activeDoctors).toBe(1);
+      expect(res.body.doctors).toHaveLength(2);
+      expect(res.body.period).toBe('all');
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .get('/api/admin/analytics');
+
+      expect(res.status).toBe(401);
+      expect(res.body.error).toBe('Unauthorized');
+    });
+
+    it('should reject authenticated non-admin users (403)', async () => {
+      const res = await request(app)
+        .get('/api/admin/analytics')
+        .set('Authorization', 'Bearer non-admin-token');
+
+      expect(res.status).toBe(403);
+    });
+  });
+});