Add comprehensive backend test suite (#339)

* add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-06-21 22:31:46 +00:00 · 2026-04-03 13:17:53 +02:00
parent d48714d17a
commit 905c7d460b
74 changed files with 12821 additions and 311 deletions
@@ -0,0 +1,243 @@
+import express, { Request, Response, NextFunction } from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import cookieParser from 'cookie-parser';
+import path from 'node:path';
+import fs from 'node:fs';
+
+import jwt from 'jsonwebtoken';
+import { JWT_SECRET } from './config';
+import { logDebug, logWarn, logError } from './services/auditLog';
+import { enforceGlobalMfaPolicy } from './middleware/mfaPolicy';
+import { authenticate } from './middleware/auth';
+import { db } from './db/database';
+
+import authRoutes from './routes/auth';
+import tripsRoutes from './routes/trips';
+import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './routes/days';
+import placesRoutes from './routes/places';
+import assignmentsRoutes from './routes/assignments';
+import packingRoutes from './routes/packing';
+import tagsRoutes from './routes/tags';
+import categoriesRoutes from './routes/categories';
+import adminRoutes from './routes/admin';
+import mapsRoutes from './routes/maps';
+import filesRoutes from './routes/files';
+import reservationsRoutes from './routes/reservations';
+import dayNotesRoutes from './routes/dayNotes';
+import weatherRoutes from './routes/weather';
+import settingsRoutes from './routes/settings';
+import budgetRoutes from './routes/budget';
+import collabRoutes from './routes/collab';
+import backupRoutes from './routes/backup';
+import oidcRoutes from './routes/oidc';
+import vacayRoutes from './routes/vacay';
+import atlasRoutes from './routes/atlas';
+import immichRoutes from './routes/immich';
+import notificationRoutes from './routes/notifications';
+import shareRoutes from './routes/share';
+import { mcpHandler } from './mcp';
+import { Addon } from './types';
+
+export function createApp(): express.Application {
+  const app = express();
+
+  // Trust first proxy (nginx/Docker) for correct req.ip
+  if (process.env.NODE_ENV === 'production' || process.env.TRUST_PROXY) {
+    app.set('trust proxy', Number.parseInt(process.env.TRUST_PROXY) || 1);
+  }
+
+  const allowedOrigins = process.env.ALLOWED_ORIGINS
+    ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
+    : null;
+
+  let corsOrigin: cors.CorsOptions['origin'];
+  if (allowedOrigins) {
+    corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
+      if (!origin || allowedOrigins.includes(origin)) callback(null, true);
+      else callback(new Error('Not allowed by CORS'));
+    };
+  } else if (process.env.NODE_ENV === 'production') {
+    corsOrigin = false;
+  } else {
+    corsOrigin = true;
+  }
+
+  const shouldForceHttps = process.env.FORCE_HTTPS === 'true';
+
+  app.use(cors({ origin: corsOrigin, credentials: true }));
+  app.use(helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
+        imgSrc: ["'self'", "data:", "blob:", "https:"],
+        connectSrc: [
+          "'self'", "ws:", "wss:",
+          "https://nominatim.openstreetmap.org", "https://overpass-api.de",
+          "https://places.googleapis.com", "https://api.openweathermap.org",
+          "https://en.wikipedia.org", "https://commons.wikimedia.org",
+          "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
+          "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
+          "https://geocoding-api.open-meteo.com", "https://api.exchangerate-api.com",
+          "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/master/geojson/ne_50m_admin_0_countries.geojson"
+        ],
+        fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
+        objectSrc: ["'none'"],
+        frameSrc: ["'none'"],
+        frameAncestors: ["'self'"],
+        upgradeInsecureRequests: shouldForceHttps ? [] : null
+      }
+    },
+    crossOriginEmbedderPolicy: false,
+    hsts: shouldForceHttps ? { maxAge: 31536000, includeSubDomains: false } : false,
+  }));
+
+  if (shouldForceHttps) {
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
+      res.redirect(301, 'https://' + req.headers.host + req.url);
+    });
+  }
+
+  app.use(express.json({ limit: '100kb' }));
+  app.use(express.urlencoded({ extended: true }));
+  app.use(cookieParser());
+  app.use(enforceGlobalMfaPolicy);
+
+  // Request logging with sensitive field redaction
+  {
+    const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
+    const redact = (value: unknown): unknown => {
+      if (!value || typeof value !== 'object') return value;
+      if (Array.isArray(value)) return (value as unknown[]).map(redact);
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v);
+      }
+      return out;
+    };
+
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path === '/api/health') return next();
+      const startedAt = Date.now();
+      res.on('finish', () => {
+        const ms = Date.now() - startedAt;
+        if (res.statusCode >= 500) {
+          logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        } else if (res.statusCode === 401 || res.statusCode === 403) {
+          logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        } else if (res.statusCode >= 400) {
+          logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        }
+        const q = Object.keys(req.query).length ? ` query=${JSON.stringify(redact(req.query))}` : '';
+        const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(redact(req.body))}` : '';
+        logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
+      });
+      next();
+    });
+  }
+
+  // Static: avatars and covers are public
+  app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
+  app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
+
+  // Photos require auth or valid share token
+  app.get('/uploads/photos/:filename', (req: Request, res: Response) => {
+    const safeName = path.basename(req.params.filename);
+    const filePath = path.join(__dirname, '../uploads/photos', safeName);
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(path.resolve(__dirname, '../uploads/photos'))) {
+      return res.status(403).send('Forbidden');
+    }
+    if (!fs.existsSync(resolved)) return res.status(404).send('Not found');
+
+    const authHeader = req.headers.authorization;
+    const token = (req.query.token as string) || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
+    if (!token) return res.status(401).send('Authentication required');
+
+    try {
+      jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] });
+    } catch {
+      const shareRow = db.prepare('SELECT id FROM share_tokens WHERE token = ?').get(token);
+      if (!shareRow) return res.status(401).send('Authentication required');
+    }
+    res.sendFile(resolved);
+  });
+
+  // Block direct access to /uploads/files
+  app.use('/uploads/files', (_req: Request, res: Response) => {
+    res.status(401).send('Authentication required');
+  });
+
+  // API Routes
+  app.use('/api/auth', authRoutes);
+  app.use('/api/auth/oidc', oidcRoutes);
+  app.use('/api/trips', tripsRoutes);
+  app.use('/api/trips/:tripId/days', daysRoutes);
+  app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
+  app.use('/api/trips/:tripId/places', placesRoutes);
+  app.use('/api/trips/:tripId/packing', packingRoutes);
+  app.use('/api/trips/:tripId/files', filesRoutes);
+  app.use('/api/trips/:tripId/budget', budgetRoutes);
+  app.use('/api/trips/:tripId/collab', collabRoutes);
+  app.use('/api/trips/:tripId/reservations', reservationsRoutes);
+  app.use('/api/trips/:tripId/days/:dayId/notes', dayNotesRoutes);
+  app.get('/api/health', (_req: Request, res: Response) => res.json({ status: 'ok' }));
+  app.use('/api', assignmentsRoutes);
+  app.use('/api/tags', tagsRoutes);
+  app.use('/api/categories', categoriesRoutes);
+  app.use('/api/admin', adminRoutes);
+
+  // Addons list endpoint
+  app.get('/api/addons', authenticate, (_req: Request, res: Response) => {
+    const addons = db.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
+    res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled })) });
+  });
+
+  // Addon routes
+  app.use('/api/addons/vacay', vacayRoutes);
+  app.use('/api/addons/atlas', atlasRoutes);
+  app.use('/api/integrations/immich', immichRoutes);
+  app.use('/api/maps', mapsRoutes);
+  app.use('/api/weather', weatherRoutes);
+  app.use('/api/settings', settingsRoutes);
+  app.use('/api/backup', backupRoutes);
+  app.use('/api/notifications', notificationRoutes);
+  app.use('/api', shareRoutes);
+
+  // MCP endpoint
+  app.post('/mcp', mcpHandler);
+  app.get('/mcp', mcpHandler);
+  app.delete('/mcp', mcpHandler);
+
+  // Production static file serving
+  if (process.env.NODE_ENV === 'production') {
+    const publicPath = path.join(__dirname, '../public');
+    app.use(express.static(publicPath, {
+      setHeaders: (res, filePath) => {
+        if (filePath.endsWith('index.html')) {
+          res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+        }
+      },
+    }));
+    app.get('*', (_req: Request, res: Response) => {
+      res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+      res.sendFile(path.join(publicPath, 'index.html'));
+    });
+  }
+
+  // Global error handler
+  app.use((err: Error & { status?: number; statusCode?: number }, _req: Request, res: Response, _next: NextFunction) => {
+    if (process.env.NODE_ENV === 'production') {
+      console.error('Unhandled error:', err.message);
+    } else {
+      console.error('Unhandled error:', err);
+    }
+    const status = err.statusCode || 500;
+    res.status(status).json({ error: 'Internal server error' });
+  });
+
+  return app;
+}
@@ -1,6 +1,6 @@
-import crypto from 'crypto';
-import fs from 'fs';
-import path from 'path';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';

 const dataDir = path.resolve(__dirname, '../data');

@@ -1,273 +1,29 @@
 import 'dotenv/config';
-import express, { Request, Response, NextFunction } from 'express';
-import { enforceGlobalMfaPolicy } from './middleware/mfaPolicy';
-import cors from 'cors';
-import helmet from 'helmet';
-import cookieParser from 'cookie-parser';
-import path from 'path';
-import fs from 'fs';
+import path from 'node:path';
+import fs from 'node:fs';
+import { createApp } from './app';

-const app = express();
-const DEBUG = String(process.env.DEBUG || 'false').toLowerCase() === 'true';
-const LOG_LVL = (process.env.LOG_LEVEL || 'info').toLowerCase();
-
-// Trust first proxy (nginx/Docker) for correct req.ip
-if (process.env.NODE_ENV === 'production' || process.env.TRUST_PROXY) {
-  app.set('trust proxy', parseInt(process.env.TRUST_PROXY as string) || 1);
-}
-
-// Create upload directories on startup
+// Create upload and data directories on startup
 const uploadsDir = path.join(__dirname, '../uploads');
 const photosDir = path.join(uploadsDir, 'photos');
 const filesDir = path.join(uploadsDir, 'files');
 const coversDir = path.join(uploadsDir, 'covers');
+const avatarsDir = path.join(uploadsDir, 'avatars');
 const backupsDir = path.join(__dirname, '../data/backups');
 const tmpDir = path.join(__dirname, '../data/tmp');

-[uploadsDir, photosDir, filesDir, coversDir, backupsDir, tmpDir].forEach(dir => {
+[uploadsDir, photosDir, filesDir, coversDir, avatarsDir, backupsDir, tmpDir].forEach(dir => {
  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 });

-// Middleware
-const allowedOrigins = process.env.ALLOWED_ORIGINS
-  ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
-  : null;
-
-let corsOrigin: cors.CorsOptions['origin'];
-if (allowedOrigins) {
-  corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
-    if (!origin || allowedOrigins.includes(origin)) callback(null, true);
-    else callback(new Error('Not allowed by CORS'));
-  };
-} else if (process.env.NODE_ENV === 'production') {
-  corsOrigin = false;
-} else {
-  corsOrigin = true;
-}
-
-const shouldForceHttps = process.env.FORCE_HTTPS === 'true';
-
-app.use(cors({
-  origin: corsOrigin,
-  credentials: true
-}));
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
-      imgSrc: ["'self'", "data:", "blob:", "https:"],
-      connectSrc: [
-        "'self'", "ws:", "wss:",
-        "https://nominatim.openstreetmap.org", "https://overpass-api.de",
-        "https://places.googleapis.com", "https://api.openweathermap.org",
-        "https://en.wikipedia.org", "https://commons.wikimedia.org",
-        "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
-        "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
-        "https://geocoding-api.open-meteo.com", "https://api.exchangerate-api.com",
-        "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/master/geojson/ne_50m_admin_0_countries.geojson"
-      ],
-      fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
-      objectSrc: ["'none'"],
-      frameSrc: ["'none'"],
-      frameAncestors: ["'self'"],
-      upgradeInsecureRequests: shouldForceHttps ? [] : null
-    }
-  },
-  crossOriginEmbedderPolicy: false,
-  hsts: shouldForceHttps ? { maxAge: 31536000, includeSubDomains: false } : false,
-}));
-
-// Redirect HTTP to HTTPS (opt-in via FORCE_HTTPS=true)
-if (shouldForceHttps) {
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
-    res.redirect(301, 'https://' + req.headers.host + req.url);
-  });
-}
-app.use(express.json({ limit: '100kb' }));
-app.use(express.urlencoded({ extended: true }));
-app.use(cookieParser());
-
-app.use(enforceGlobalMfaPolicy);
-
-{
-  const { logInfo: _logInfo, logDebug: _logDebug, logWarn: _logWarn, logError: _logError } = require('./services/auditLog');
-  const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
-  const _redact = (value: unknown): unknown => {
-    if (!value || typeof value !== 'object') return value;
-    if (Array.isArray(value)) return value.map(_redact);
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-      out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : _redact(v);
-    }
-    return out;
-  };
-
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.path === '/api/health') return next();
-
-    const startedAt = Date.now();
-    res.on('finish', () => {
-      const ms = Date.now() - startedAt;
-
-      if (res.statusCode >= 500) {
-        _logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      } else if (res.statusCode === 401 || res.statusCode === 403) {
-        _logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      } else if (res.statusCode >= 400) {
-        _logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      }
-
-      const q = Object.keys(req.query).length ? ` query=${JSON.stringify(_redact(req.query))}` : '';
-      const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(_redact(req.body))}` : '';
-      _logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
-    });
-    next();
-  });
-}
-
-// Avatars are public (shown on login, sharing screens)
-import { authenticate } from './middleware/auth';
-app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
-app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
-
-// Serve uploaded photos — require auth token or valid share token
-app.get('/uploads/photos/:filename', (req: Request, res: Response) => {
-  const safeName = path.basename(req.params.filename);
-  const filePath = path.join(__dirname, '../uploads/photos', safeName);
-  const resolved = path.resolve(filePath);
-  if (!resolved.startsWith(path.resolve(__dirname, '../uploads/photos'))) {
-    return res.status(403).send('Forbidden');
-  }
-  if (!fs.existsSync(resolved)) return res.status(404).send('Not found');
-
-  // Allow if authenticated or if a valid share token is present
-  const authHeader = req.headers.authorization;
-  const token = req.query.token as string || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
-  if (!token) return res.status(401).send('Authentication required');
-
-  try {
-    const jwt = require('jsonwebtoken');
-    jwt.verify(token, process.env.JWT_SECRET || require('./config').JWT_SECRET);
-  } catch {
-    // Check if it's a share token
-    const shareRow = addonDb.prepare('SELECT id FROM share_tokens WHERE token = ?').get(token);
-    if (!shareRow) return res.status(401).send('Authentication required');
-  }
-  res.sendFile(resolved);
-});
-
-// Block direct access to /uploads/files — served via authenticated /api/trips/:tripId/files/:id/download
-app.use('/uploads/files', (_req: Request, res: Response) => {
-  res.status(401).send('Authentication required');
-});
-
-// Routes
-import authRoutes from './routes/auth';
-import tripsRoutes from './routes/trips';
-import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './routes/days';
-import placesRoutes from './routes/places';
-import assignmentsRoutes from './routes/assignments';
-import packingRoutes from './routes/packing';
-import tagsRoutes from './routes/tags';
-import categoriesRoutes from './routes/categories';
-import adminRoutes from './routes/admin';
-import mapsRoutes from './routes/maps';
-import filesRoutes from './routes/files';
-import reservationsRoutes from './routes/reservations';
-import dayNotesRoutes from './routes/dayNotes';
-import weatherRoutes from './routes/weather';
-import settingsRoutes from './routes/settings';
-import budgetRoutes from './routes/budget';
-import collabRoutes from './routes/collab';
-import backupRoutes from './routes/backup';
-import oidcRoutes from './routes/oidc';
-app.use('/api/auth', authRoutes);
-app.use('/api/auth/oidc', oidcRoutes);
-app.use('/api/trips', tripsRoutes);
-app.use('/api/trips/:tripId/days', daysRoutes);
-app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
-app.use('/api/trips/:tripId/places', placesRoutes);
-app.use('/api/trips/:tripId/packing', packingRoutes);
-app.use('/api/trips/:tripId/files', filesRoutes);
-app.use('/api/trips/:tripId/budget', budgetRoutes);
-app.use('/api/trips/:tripId/collab', collabRoutes);
-app.use('/api/trips/:tripId/reservations', reservationsRoutes);
-app.use('/api/trips/:tripId/days/:dayId/notes', dayNotesRoutes);
-app.get('/api/health', (req: Request, res: Response) => res.json({ status: 'ok' }));
-app.use('/api', assignmentsRoutes);
-app.use('/api/tags', tagsRoutes);
-app.use('/api/categories', categoriesRoutes);
-app.use('/api/admin', adminRoutes);
-
-// Public addons endpoint (authenticated but not admin-only)
-import { authenticate as addonAuth } from './middleware/auth';
-import {db as addonDb} from './db/database';
-import { Addon } from './types';
-app.get('/api/addons', addonAuth, (req: Request, res: Response) => {
-  const addons = addonDb.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
-  res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled })) });
-});
-
-// Addon routes
-import vacayRoutes from './routes/vacay';
-app.use('/api/addons/vacay', vacayRoutes);
-import atlasRoutes from './routes/atlas';
-app.use('/api/addons/atlas', atlasRoutes);
-import immichRoutes from './routes/immich';
-app.use('/api/integrations/immich', immichRoutes);
-
-app.use('/api/maps', mapsRoutes);
-app.use('/api/weather', weatherRoutes);
-app.use('/api/settings', settingsRoutes);
-app.use('/api/backup', backupRoutes);
-
-import notificationRoutes from './routes/notifications';
-app.use('/api/notifications', notificationRoutes);
-
-import shareRoutes from './routes/share';
-app.use('/api', shareRoutes);
-
-// MCP endpoint (Streamable HTTP transport, per-user auth)
-import { mcpHandler, closeMcpSessions } from './mcp';
-app.post('/mcp', mcpHandler);
-app.get('/mcp', mcpHandler);
-app.delete('/mcp', mcpHandler);
-
-// Serve static files in production
-if (process.env.NODE_ENV === 'production') {
-  const publicPath = path.join(__dirname, '../public');
-  app.use(express.static(publicPath, {
-    setHeaders: (res, filePath) => {
-      // Never cache index.html so version updates are picked up immediately
-      if (filePath.endsWith('index.html')) {
-        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-      }
-    },
-  }));
-  app.get('*', (req: Request, res: Response) => {
-    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-    res.sendFile(path.join(publicPath, 'index.html'));
-  });
-}
-
-// Global error handler — do not leak stack traces in production
-app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
-  if (process.env.NODE_ENV !== 'production') {
-    console.error('Unhandled error:', err);
-  } else {
-    console.error('Unhandled error:', err.message);
-  }
-  res.status(500).json({ error: 'Internal server error' });
-});
+const app = createApp();

 import * as scheduler from './scheduler';

 const PORT = process.env.PORT || 3001;
 const server = app.listen(PORT, () => {
  const { logInfo: sLogInfo, logWarn: sLogWarn } = require('./services/auditLog');
+  const LOG_LVL = (process.env.LOG_LEVEL || 'info').toLowerCase();
  const tz = process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
  const origins = process.env.ALLOWED_ORIGINS || '(same-origin)';
  const banner = [
@@ -301,6 +57,7 @@ const server = app.listen(PORT, () => {
 // Graceful shutdown
 function shutdown(signal: string): void {
  const { logInfo: sLogInfo, logError: sLogError } = require('./services/auditLog');
+  const { closeMcpSessions } = require('./mcp');
  sLogInfo(`${signal} received — shutting down gracefully...`);
  scheduler.stop();
  closeMcpSessions();
@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';
 import { AuthRequest, OptionalAuthRequest, User } from '../types';

-function extractToken(req: Request): string | null {
+export function extractToken(req: Request): string | null {
  // Prefer httpOnly cookie; fall back to Authorization: Bearer (MCP, API clients)
  const cookieToken = (req as any).cookies?.trek_session;
  if (cookieToken) return cookieToken;
@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';

 /** Paths that never require MFA (public or pre-auth). */
-function isPublicApiPath(method: string, pathNoQuery: string): boolean {
+export function isPublicApiPath(method: string, pathNoQuery: string): boolean {
  if (method === 'GET' && pathNoQuery === '/api/health') return true;
  if (method === 'GET' && pathNoQuery === '/api/auth/app-config') return true;
  if (method === 'POST' && pathNoQuery === '/api/auth/login') return true;
@@ -17,7 +17,7 @@ function isPublicApiPath(method: string, pathNoQuery: string): boolean {
 }

 /** Authenticated paths allowed while MFA is not yet enabled (setup + lockout recovery). */
-function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
+export function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
  if (method === 'GET' && pathNoQuery === '/api/auth/me') return true;
  if (method === 'POST' && pathNoQuery === '/api/auth/mfa/setup') return true;
  if (method === 'POST' && pathNoQuery === '/api/auth/mfa/enable') return true;
@@ -59,7 +59,9 @@ const avatarUpload = multer({
  fileFilter: (_req, file, cb) => {
    const ext = path.extname(file.originalname).toLowerCase();
    if (!file.mimetype.startsWith('image/') || !ALLOWED_AVATAR_EXTS.includes(ext)) {
-      return cb(new Error('Only .jpg, .jpeg, .png, .gif, .webp images are allowed'));
+      const err: Error & { statusCode?: number } = new Error('Only image files (jpg, png, gif, webp) are allowed');
+      err.statusCode = 400;
+      return cb(err);
    }
    cb(null, true);
  },
@@ -321,3 +323,6 @@ router.post('/resource-token', authenticate, (req: Request, res: Response) => {
 });

 export default router;
+
+// Exported for test resets only — do not use in production code
+export { loginAttempts, mfaAttempts };
@@ -43,7 +43,9 @@ const noteUpload = multer({
    const ext = path.extname(file.originalname).toLowerCase();
    const BLOCKED = ['.svg', '.html', '.htm', '.xml', '.xhtml', '.js', '.jsx', '.ts', '.exe', '.bat', '.sh', '.cmd', '.msi', '.dll', '.com', '.vbs', '.ps1', '.php'];
    if (BLOCKED.includes(ext) || file.mimetype.includes('svg') || file.mimetype.includes('html') || file.mimetype.includes('javascript')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
    }
    cb(null, true);
  },
@@ -57,14 +57,18 @@ const upload = multer({
  fileFilter: (_req, file, cb) => {
    const ext = path.extname(file.originalname).toLowerCase();
    if (BLOCKED_EXTENSIONS.includes(ext) || file.mimetype.includes('svg')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
    }
    const allowed = getAllowedExtensions().split(',').map(e => e.trim().toLowerCase());
    const fileExt = ext.replace('.', '');
    if (allowed.includes(fileExt) || (allowed.includes('*') && !BLOCKED_EXTENSIONS.includes(ext))) {
      cb(null, true);
    } else {
-      cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      cb(err);
    }
  },
 });
@@ -74,6 +74,21 @@ router.post('/', authenticate, (req: Request, res: Response) => {
  broadcast(tripId, 'packing:created', { item }, req.headers['x-socket-id'] as string);
 });

+router.put('/reorder', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  const { orderedIds } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  reorderItems(tripId, orderedIds);
+  res.json({ success: true });
+});
+
 router.put('/:id', authenticate, (req: Request, res: Response) => {
  const authReq = req as AuthRequest;
  const { tripId, id } = req.params;
@@ -220,19 +235,4 @@ router.put('/category-assignees/:categoryName', authenticate, (req: Request, res
  }
 });

-router.put('/reorder', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { tripId } = req.params;
-  const { orderedIds } = req.body;
-
-  const trip = verifyTripAccess(tripId, authReq.user.id);
-  if (!trip) return res.status(404).json({ error: 'Trip not found' });
-
-  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
-    return res.status(403).json({ error: 'No permission' });
-
-  reorderItems(tripId, orderedIds);
-  res.json({ success: true });
-});
-
 export default router;
@@ -1,7 +1,7 @@
 import cron, { type ScheduledTask } from 'node-cron';
 import archiver from 'archiver';
-import path from 'path';
-import fs from 'fs';
+import path from 'node:path';
+import fs from 'node:fs';

 const dataDir = path.join(__dirname, '../data');
 const backupsDir = path.join(dataDir, 'backups');
@@ -9,8 +9,8 @@ const uploadsDir = path.join(__dirname, '../uploads');
 const settingsFile = path.join(dataDir, 'backup-settings.json');

 const VALID_INTERVALS = ['hourly', 'daily', 'weekly', 'monthly'];
-const VALID_DAYS_OF_WEEK = [0, 1, 2, 3, 4, 5, 6]; // 0=Sunday
-const VALID_HOURS = Array.from({ length: 24 }, (_, i) => i);
+const VALID_DAYS_OF_WEEK = new Set([0, 1, 2, 3, 4, 5, 6]); // 0=Sunday
+const VALID_HOURS = new Set(Array.from({length: 24}, (_, i) => i));

 interface BackupSettings {
  enabled: boolean;
@@ -21,9 +21,9 @@ interface BackupSettings {
  day_of_month: number;
 }

-function buildCronExpression(settings: BackupSettings): string {
-  const hour = VALID_HOURS.includes(settings.hour) ? settings.hour : 2;
-  const dow = VALID_DAYS_OF_WEEK.includes(settings.day_of_week) ? settings.day_of_week : 0;
+export function buildCronExpression(settings: BackupSettings): string {
+  const hour = VALID_HOURS.has(settings.hour) ? settings.hour : 2;
+  const dow = VALID_DAYS_OF_WEEK.has(settings.day_of_week) ? settings.day_of_week : 0;
  const dom = settings.day_of_month >= 1 && settings.day_of_month <= 28 ? settings.day_of_month : 1;

  switch (settings.interval) {
@@ -1,4 +1,4 @@
-import * as crypto from 'crypto';
+import * as crypto from 'node:crypto';
 import { ENCRYPTION_KEY } from '../config';

 const ENCRYPTED_PREFIX = 'enc:v1:';
@@ -2,7 +2,7 @@ import { Response } from 'express';

 const COOKIE_NAME = 'trek_session';

-function cookieOptions(clear = false) {
+export function cookieOptions(clear = false) {
  const secure = process.env.COOKIE_SECURE !== 'false' && (process.env.NODE_ENV === 'production' || process.env.FORCE_HTTPS === 'true');
  return {
    httpOnly: true,
@@ -175,14 +175,14 @@ const EVENT_TEXTS: Record<string, Record<EventType, EventTextFn>> = {
 };

 // Get localized event text
-function getEventText(lang: string, event: EventType, params: Record<string, string>): EventText {
+export function getEventText(lang: string, event: EventType, params: Record<string, string>): EventText {
  const texts = EVENT_TEXTS[lang] || EVENT_TEXTS.en;
  return texts[event](params);
 }

 // ── Email HTML builder ─────────────────────────────────────────────────────

-function buildEmailHtml(subject: string, body: string, lang: string): string {
+export function buildEmailHtml(subject: string, body: string, lang: string): string {
  const s = I18N[lang] || I18N.en;
  const appUrl = getAppUrl();
  const ctaHref = appUrl || '#';
@@ -256,7 +256,7 @@ async function sendEmail(to: string, subject: string, body: string, userId?: num
  }
 }

-function buildWebhookBody(url: string, payload: { event: string; title: string; body: string; tripName?: string }): string {
+export function buildWebhookBody(url: string, payload: { event: string; title: string; body: string; tripName?: string }): string {
  const isDiscord = /discord(?:app)?\.com\/api\/webhooks\//.test(url);
  const isSlack = /hooks\.slack\.com\//.test(url);

@@ -116,7 +116,7 @@ const TTL_FORECAST_MS = 60 * 60 * 1000;      // 1 hour
 const TTL_CURRENT_MS  = 15 * 60 * 1000;      // 15 minutes
 const TTL_CLIMATE_MS  = 24 * 60 * 60 * 1000; // 24 hours

-function cacheKey(lat: string, lng: string, date?: string): string {
+export function cacheKey(lat: string, lng: string, date?: string): string {
  const rlat = parseFloat(lat).toFixed(2);
  const rlng = parseFloat(lng).toFixed(2);
  return `${rlat}_${rlng}_${date || 'current'}`;
@@ -138,7 +138,7 @@ function setCache(key: string, data: WeatherResult, ttlMs: number): void {

 // ── Helpers ─────────────────────────────────────────────────────────────

-function estimateCondition(tempAvg: number, precipMm: number): string {
+export function estimateCondition(tempAvg: number, precipMm: number): string {
  if (precipMm > 5) return tempAvg <= 0 ? 'Snow' : 'Rain';
  if (precipMm > 1) return tempAvg <= 0 ? 'Snow' : 'Drizzle';
  if (precipMm > 0.3) return 'Clouds';
@@ -1,6 +1,6 @@
-import dns from 'dns/promises';
-import http from 'http';
-import https from 'https';
+import dns from 'node:dns/promises';
+import http from 'node:http';
+import https from 'node:https';

 const ALLOW_INTERNAL_NETWORK = process.env.ALLOW_INTERNAL_NETWORK === 'true';

@@ -17,11 +17,11 @@ function isAlwaysBlocked(ip: string): boolean {
  const addr = ip.startsWith('[') ? ip.slice(1, -1) : ip;

  // Loopback
-  if (/^127\./.test(addr) || addr === '::1') return true;
+  if (addr.startsWith("127.") || addr === '::1') return true;
  // Unspecified
-  if (/^0\./.test(addr)) return true;
+  if (addr.startsWith("0.")) return true;
  // Link-local / cloud metadata
-  if (/^169\.254\./.test(addr) || /^fe80:/i.test(addr)) return true;
+  if (addr.startsWith("169.254.") || /^fe80:/i.test(addr)) return true;
  // IPv4-mapped loopback / link-local: ::ffff:127.x.x.x, ::ffff:169.254.x.x
  if (/^::ffff:127\./i.test(addr) || /^::ffff:169\.254\./i.test(addr)) return true;

@@ -33,9 +33,9 @@ function isPrivateNetwork(ip: string): boolean {
  const addr = ip.startsWith('[') ? ip.slice(1, -1) : ip;

  // RFC-1918 private ranges
-  if (/^10\./.test(addr)) return true;
+  if (addr.startsWith("10.")) return true;
  if (/^172\.(1[6-9]|2\d|3[01])\./.test(addr)) return true;
-  if (/^192\.168\./.test(addr)) return true;
+  if (addr.startsWith("192.168.")) return true;
  // CGNAT / Tailscale shared address space (100.64.0.0/10)
  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(addr)) return true;
  // IPv6 ULA (fc00::/7)
@@ -2,7 +2,7 @@ import { WebSocketServer, WebSocket } from 'ws';
 import { db, canAccessTrip } from './db/database';
 import { consumeEphemeralToken } from './services/ephemeralTokens';
 import { User } from './types';
-import http from 'http';
+import http from 'node:http';

 interface NomadWebSocket extends WebSocket {
  isAlive: boolean;
@@ -48,7 +48,7 @@ function setupWebSocket(server: http.Server): void {

  const HEARTBEAT_INTERVAL = 30000; // 30 seconds
  const heartbeat = setInterval(() => {
-    wss!.clients.forEach((ws) => {
+    wss.clients.forEach((ws) => {
      const nws = ws as NomadWebSocket;
      if (nws.isAlive === false) return nws.terminate();
      nws.isAlive = false;
@@ -61,7 +61,7 @@ function setupWebSocket(server: http.Server): void {
  wss.on('connection', (ws: WebSocket, req: http.IncomingMessage) => {
    const nws = ws as NomadWebSocket;
    // Extract token from query param
-    const url = new URL(req.url!, 'http://localhost');
+    const url = new URL(req.url, 'http://localhost');
    const token = url.searchParams.get('token');

    if (!token) {
@@ -103,7 +103,7 @@ function setupWebSocket(server: http.Server): void {

    nws.on('message', (data) => {
      // Rate limiting
-      const rate = socketMsgCounts.get(nws)!;
+      const rate = socketMsgCounts.get(nws);
      const now = Date.now();
      if (now - rate.windowStart > WS_MSG_WINDOW) {
        rate.count = 1;
@@ -129,14 +129,14 @@ function setupWebSocket(server: http.Server): void {
      if (msg.type === 'join' && msg.tripId) {
        const tripId = Number(msg.tripId);
        // Verify the user has access to this trip
-        if (!canAccessTrip(tripId, user!.id)) {
+        if (!canAccessTrip(tripId, user.id)) {
          nws.send(JSON.stringify({ type: 'error', message: 'Access denied' }));
          return;
        }
        // Add to room
        if (!rooms.has(tripId)) rooms.set(tripId, new Set());
-        rooms.get(tripId)!.add(nws);
-        socketRooms.get(nws)!.add(tripId);
+        rooms.get(tripId).add(nws);
+        socketRooms.get(nws).add(tripId);
        nws.send(JSON.stringify({ type: 'joined', tripId }));
      }

@@ -198,7 +198,7 @@ function broadcastToUser(userId: number, payload: Record<string, unknown>, exclu
    if (nws.readyState !== 1) continue;
    if (excludeNum && socketId.get(nws) === excludeNum) continue;
    const user = socketUser.get(nws);
-    if (user && user.id === userId) {
+    if (user?.id === userId) {
      nws.send(JSON.stringify(payload));
    }
  }