test: integration and e2e coverage for auth, assets, send-payment, and onboarding

[Realericky]

Summary

Integration tests — /auth routes (#707)

• POST /auth/register: valid creation (201), duplicate username (409), missing fields (422), short password (422)
• POST /auth/login: correct credentials (200 + HttpOnly refresh cookie), wrong password (401), non-existent user (401), locked account (423 + Retry-After header)
• POST /auth/refresh: valid cookie (200 + new access token), missing cookie (401), revoked session (401)
• POST /auth/logout: clears cookie (200), requires auth (401), subsequent refresh fails after logout (401)

All database and session calls are mocked; JWT signing uses a test-specific secret.

Integration tests — /assets routes (#708)

• GET /assets: returns asset list, handles empty list, propagates registry errors (500)
• GET /assets/:code/:issuer: found (200), not found (404), invalid code (422), invalid issuer (422)
• POST /assets/trustline: success (200), invalid secret (422), unsupported asset (422), bad issuer (422), Horizon failure (400)
• GET /assets/trustlines/:publicKey: returns trustlines (200), invalid key (422), Horizon unreachable (500)
• GET /assets/portfolio/:publicKey: returns portfolio (200), zero balances (200), invalid key (422), service error (500)

All Stellar SDK and service calls are mocked via vi.hoisted.

E2E — send-payment flow (#709)

e2e/tests/send-payment.spec.js covers the full journey: login → send form → review screen (fee breakdown, recipient, amount) → confirm → success toast → transaction history entry → balance decrease. A separate test submits to an unfunded address and asserts the error state keeps the user on the confirmation screen. Horizon calls are intercepted for CI reliability; credentials are read from E2E_TEST_EMAIL / E2E_TEST_PASSWORD env vars.

E2E — onboarding flow (#710)

e2e/tests/onboarding.spec.js covers registration (unique email per run via test+{timestamp}@example.com), duplicate-email error, weak-password validation, keypair setup (public key format assertion, optional seed phrase word count), and first dashboard view (public key display, XLM balance, zero console errors). Friendbot calls are intercepted.

Bug fixes uncovered during test authoring

These pre-existing issues blocked the tests from running and were fixed as the minimum necessary to make the suite meaningful:

File	Bug	Fix
backend/src/routes/auth.js	createUser(...) called without await — every registration silently succeeded with an empty user object, making 409 responses impossible	Added await
backend/src/routes/auth.js	Unclosed try block and duplicate const token declaration caused a JS parse error	Removed orphaned incomplete route handler and duplicate declaration
backend/src/routes/assets.js	/trustlines/:publicKey and /portfolio/:publicKey declared after /:code/:issuer, making them unreachable (Express matched the wildcard first)	Moved specific routes before the parameterized catch-all
backend/package.json	bcryptjs imported by auth.js MFA routes but not declared as a dependency	Added to dependencies

Test plan

• npx vitest run backend/tests/auth.routes.test.js — 16/16 pass
• npx vitest run backend/tests/assets.routes.test.js — 19/19 pass
• npx playwright test e2e/tests/send-payment.spec.js — requires running app + test credentials
• npx playwright test e2e/tests/onboarding.spec.js — requires running app + test credentials

Closes #707
Closes #708
Closes #709
Closes #710

[drips-wave]

@Realericky Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits