feat(auth): add JWT token revocation with Redis blocklist

.github/scripts/ciScript.js

@@ -36,13 +36,21 @@ module.exports = async ({ github, context, core }) => {
         backendFiles.push(fileName);
 
         const relative = fileName.replace('apps/backend/src/', '');
-        const baseName = relative
-          .split('/')
-          .pop()
-          ?.replace(/\.(ts|tsx|js|jsx)$/, '');
 
-        if (baseName) {
-          backendTests.push(`src/__tests__/${baseName}.test.ts`);
+        if (relative.startsWith('__tests__/')) {
+          // Already a test file — use it directly. Without this guard the
+          // extension strip above turns logout.test.ts into logout.test and
+          // then appends .test.ts again, producing logout.test.test.ts.
+          backendTests.push(`src/${relative}`);
+        } else {
+          const baseName = relative
+            .split('/')
+            .pop()
+            ?.replace(/\.(ts|tsx|js|jsx)$/, '');
+
+          if (baseName) {
+            backendTests.push(`src/__tests__/${baseName}.test.ts`);
+          }
         }
 
       } else if (fileName.startsWith('apps/mobile/')) {

apps/backend/src/__tests__/analytics.test.ts

@@ -1,3 +1,6 @@
+import Fastify, {
+  type FastifyInstance,
+} from 'fastify';
 import {
   describe,
   it,
@@ -7,13 +10,11 @@ import {
   vi,
 } from 'vitest';
 
-import Fastify, {
-  type FastifyInstance,
-} from 'fastify';
+
+import { analyticsRoutes } from '../routes/analytics';
 
 import type { PrismaClient } from '@prisma/client';
 
-import { analyticsRoutes } from '../routes/analytics';
 
 // ─── Shared mock data ────────────────────────────────────────────────────────
 
@@ -34,7 +35,7 @@ const prismaMock = {
 
 // ─── App factory ─────────────────────────────────────────────────────────────
 
-let mockJwtVerify = vi.fn();
+const mockJwtVerify = vi.fn();
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify({

apps/backend/src/__tests__/app.test.ts

@@ -1,8 +1,13 @@
-process.env.NODE_ENV = 'test';
-
 import { describe, it, expect } from 'vitest';
+
 import { buildApp } from '../app';
 
+process.env.NODE_ENV = 'test';
+// validateEnv() runs inside buildApp() and exits if these are absent.
+// Provide safe test-only fallbacks so CI doesn't need real secrets here.
+process.env.JWT_SECRET ??= 'test-jwt-secret-not-for-production-xxxxxxxxxxxxxxxxxxxxxxx';
+process.env.ENCRYPTION_KEY ??= 'a'.repeat(64);
+
 describe('GET /health', () => {
   it('should return status ok', async () => {
     const app = await buildApp();

apps/backend/src/__tests__/cards.test.ts

@@ -1,5 +1,6 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
 import Fastify from 'fastify';
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
 import { cardRoutes } from '../routes/cards.js';
 
 const USER_ID = 'user-123';

apps/backend/src/__tests__/event.test.ts

@@ -1,8 +1,10 @@
+import Fastify, { type FastifyInstance } from 'fastify';
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import Fastify, { FastifyInstance } from 'fastify';
-import { PrismaClient } from '@prisma/client';
+
 import { eventRoutes } from '../routes/event';
 
+import type { PrismaClient } from '@prisma/client';
+
 // ─── Shared mock data ────────────────────────────────────────────────────────
 
 const MOCK_USER_ID = 'user-uuid-001';
@@ -64,7 +66,7 @@
 //
 // This mirrors the real app setup without touching a real DB or real JWT keys.
 
-let mockJwtVerify = vi.fn();
+const mockJwtVerify = vi.fn();
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify({ logger: false });
@@ -138,7 +140,7 @@
       prismaMock.event.findUnique.mockResolvedValue(null); // slug is free
       prismaMock.event.create.mockResolvedValue(MOCK_EVENT);
 
       const res = await createEvent(app, validBody);
 
       expect(res.statusCode).toBe(201);
       const body = res.json();
@@ -163,34 +165,34 @@
       expect(res.json()).toMatchObject({ error: 'Unauthorized' });
     });
 
     it('400 — rejects missing required fields (no dates, no location)', async () => {
       const res = await createEvent(app, { name: 'Hello World' }); // missing dates + location
       expect(res.statusCode).toBe(400);
     });
 
     it('400 — rejects missing location', async () => {
       const { location: _omit, ...bodyWithoutLocation } = validBody;
       const res = await createEvent(app, bodyWithoutLocation);
       expect(res.statusCode).toBe(400);
     });
 
     it('400 — rejects location shorter than 2 characters', async () => {
       const res = await createEvent(app, { ...validBody, location: 'A' });
       expect(res.statusCode).toBe(400);
     });
 
     it('400 — rejects location longer than 100 characters', async () => {
       const res = await createEvent(app, { ...validBody, location: 'A'.repeat(101) });
       expect(res.statusCode).toBe(400);
     });
 
     it('400 — rejects event name shorter than 3 characters', async () => {
       const res = await createEvent(app, { ...validBody, name: 'Hi' });
       expect(res.statusCode).toBe(400);
     });
 
     it('400 — rejects event name longer than 100 characters', async () => {
       const longName = 'A'.repeat(101);
       const res = await createEvent(app, { ...validBody, name: longName });
       expect(res.statusCode).toBe(400);
     });
@@ -198,7 +200,7 @@
     it('400 — rejects invalid date format', async () => {
       const res = await createEvent(app, {
         ...validBody,
         startDate: 'not-a-date',
       });
       expect(res.statusCode).toBe(400);
     });
@@ -214,7 +216,7 @@
         slug: 'devcard-conf-2025-ab12',
       });
 
       const res = await createEvent(app, validBody);
 
       expect(res.statusCode).toBe(201);
       // create was eventually called with a slug different from the base one

apps/backend/src/__tests__/follow.test.ts

@@ -1,4 +1,4 @@
-import Fastify, { FastifyInstance } from 'fastify';
+import Fastify, { type FastifyInstance } from 'fastify';
 import { describe, expect, it, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 
 import { followRoutes } from '../routes/follow.js';