Mocks @/auth (vi.mock) instead of exercising the real auth(): that
helper reads cookies via next/headers under the hood, which only
works inside Next.js own request-handling machinery, not when these
tests import and call GET()/POST() directly. beforeEach mocks a
valid session by default so the existing business-logic tests are
unaffected, and two new tests mock a null session to assert both
GET and POST return 401 with { error: Unauthorized } and that POST
does not create a row.
middleware.ts itself has no automated test - it runs on the Edge
Runtime and is not exercised by vitest calling route handlers
directly. Verified manually instead via next build + next start:
curl confirmed GET / redirects to /login (307), GET /login stays
200 with no redirect loop, GET/POST /api/requests return 401 JSON
unauthenticated, and GET /api/auth/session (needed for the login
flow) is not blocked.
toanhoang
1770f68379