User API Integration Tests

Comprehensive test coverage documentation for all user-related API endpoints including authentication, avatar management, and invitations.

7/18/2026

3 min read

Edit on GitHub

On this page

Complete test coverage for all user-related API endpoints in SveltyCMS, now secured by the Fail-Closed Gatekeeper.

UI control map (profile + admin): see routes/user.mdx for the 1:1 unit/integration/E2E plan for /user.

Test Overview

Test Files: tests/unit/api/user.test.ts, tests/unit/routes/user-page-server.test.ts, tests/unit/user/user-remote-helpers.test.ts, auth-2fa.test.ts, security.test.ts
Total Suite: 1,122 unit tests (consolidated)
Coverage: 100% (All core user endpoints)
Framework: Vitest (jsdom)

Endpoint Coverage

Endpoint	Tests	Status
`POST /api/user/create-user`	8	✅
`POST /api/user/login`	4	✅
`PUT /api/user/update-user-attributes`	8	✅
`POST /api/user/batch`	6	✅
`POST /api/user/logout`	2	✅
`POST /api/user/save-avatar`	8	✅
`DELETE /api/user/delete-avatar`	8	✅
`GET /api/user` (index)	4	✅
`POST /api/user` (invitations)	12	✅
Fail-Closed Security v2.0	45	✅
Audit Chaining (Worker Pool)	12	✅
TOTP Timing Resistance	6	✅

Running the Tests

Run Commands

# Run all user API tests
bun run test:unit -- user

# Run specific test suite
bun run test:unit -- auth-2fa
bun run test:unit -- security

# Run with coverage
bun run test:unit -- user --coverage

Expected Results

Pass Rate: 100%
✅ Core functionality verified
✅ Fail-Closed Protection: Confirmed for all restricted paths
✅ Session management: 3 tests
✅ Avatar management: 11 tests
✅ Invitations: 5 tests (verified via local-api bridge)

Security Features (Fail-Closed)

All User API endpoints are now protected by a central gatekeeper. If an endpoint is not explicitly mapped in the security registry, it is denied by default with a 403 Forbidden response.

🛡️ Mandatory Authorization

Self-profile updates: Requires valid session and ownership.
Admin actions: Requires isAdmin: true flag in session roles.
Role Escalation Protection: Users are prevented from modifying their own roles.

Test Helpers

Mock Event Creation

All User API tests use a standardized createMockEvent helper that injects mandatory roles and tenantId into the request locals.

function createMockEvent(pathname: string, method: string = "GET"): RequestEvent {
  return {
    url: new URL(pathname, "http://localhost"),
    request: new Request("http://localhost" + pathname, { method }),
    locals: {
      tenantId: "test-tenant",
      roles: [{ name: "admin", isAdmin: true, permissions: [] }],
    },
  } as unknown as RequestEvent;
}

Documentation