Add comprehensive backend test suite (#339)

* add test suite, mostly covers integration testing, tests are only backend side

* workflow runs the correct script

* workflow runs the correct script

* workflow runs the correct script

* unit tests incoming

* Fix multer silent rejections and error handler info leak

- Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts,
  and files.ts so invalid uploads return an error instead of silently
  dropping the file
- Error handler in app.ts now always returns 500 / "Internal server
  error" instead of forwarding err.message to the client

* Use statusCode consistently for multer errors and error handler

- Error handler in app.ts reads err.statusCode to forward the correct
  HTTP status while keeping the response body generic

server/src/routes/auth.ts

@@ -59,7 +59,9 @@ const avatarUpload = multer({
   fileFilter: (_req, file, cb) => {
     const ext = path.extname(file.originalname).toLowerCase();
     if (!file.mimetype.startsWith('image/') || !ALLOWED_AVATAR_EXTS.includes(ext)) {
-      return cb(new Error('Only .jpg, .jpeg, .png, .gif, .webp images are allowed'));
+      const err: Error & { statusCode?: number } = new Error('Only image files (jpg, png, gif, webp) are allowed');
+      err.statusCode = 400;
+      return cb(err);
     }
     cb(null, true);
   },
@@ -321,3 +323,6 @@ router.post('/resource-token', authenticate, (req: Request, res: Response) => {
 });
 
 export default router;
+
+// Exported for test resets only — do not use in production code
+export { loginAttempts, mfaAttempts };

server/src/routes/collab.ts

@@ -43,7 +43,9 @@ const noteUpload = multer({
     const ext = path.extname(file.originalname).toLowerCase();
     const BLOCKED = ['.svg', '.html', '.htm', '.xml', '.xhtml', '.js', '.jsx', '.ts', '.exe', '.bat', '.sh', '.cmd', '.msi', '.dll', '.com', '.vbs', '.ps1', '.php'];
     if (BLOCKED.includes(ext) || file.mimetype.includes('svg') || file.mimetype.includes('html') || file.mimetype.includes('javascript')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
     }
     cb(null, true);
   },

server/src/routes/files.ts

@@ -57,14 +57,18 @@ const upload = multer({
   fileFilter: (_req, file, cb) => {
     const ext = path.extname(file.originalname).toLowerCase();
     if (BLOCKED_EXTENSIONS.includes(ext) || file.mimetype.includes('svg')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
     }
     const allowed = getAllowedExtensions().split(',').map(e => e.trim().toLowerCase());
     const fileExt = ext.replace('.', '');
     if (allowed.includes(fileExt) || (allowed.includes('*') && !BLOCKED_EXTENSIONS.includes(ext))) {
       cb(null, true);
     } else {
-      cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      cb(err);
     }
   },
 });

server/src/routes/packing.ts

@@ -74,6 +74,21 @@ router.post('/', authenticate, (req: Request, res: Response) => {
   broadcast(tripId, 'packing:created', { item }, req.headers['x-socket-id'] as string);
 });
 
+router.put('/reorder', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  const { orderedIds } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  reorderItems(tripId, orderedIds);
+  res.json({ success: true });
+});
+
 router.put('/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
@@ -220,19 +235,4 @@ router.put('/category-assignees/:categoryName', authenticate, (req: Request, res
   }
 });
 
-router.put('/reorder', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { tripId } = req.params;
-  const { orderedIds } = req.body;
-
-  const trip = verifyTripAccess(tripId, authReq.user.id);
-  if (!trip) return res.status(404).json({ error: 'Trip not found' });
-
-  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
-    return res.status(403).json({ error: 'No permission' });
-
-  reorderItems(tripId, orderedIds);
-  res.json({ success: true });
-});
-
 export default router;