From ed70e4d1cd79c55f93fde3676eac515252459979 Mon Sep 17 00:00:00 2001
From: Tyler Gillispie <mrteye@gmail.com>
Date: Thu, 27 Aug 2026 20:53:29 -0700
Subject: [PATCH] test(smoke): add comprehensive in-memory HTTP router smoke
 test

---
 src/tests/smoke_test.ts | 60 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 src/tests/smoke_test.ts

diff --git a/src/tests/smoke_test.ts b/src/tests/smoke_test.ts
new file mode 100644
index 0000000..3b7075c
--- /dev/null
+++ b/src/tests/smoke_test.ts
@@ -0,0 +1,60 @@
+import { assertEquals } from "jsr:@std/assert@1";
+import app from "../main.ts";
+
+Deno.test("[Smoke Test] Core Server Routing & Hypermedia Endpoints", async () => {
+  // 1. Health check
+  const resHealth = await app.fetch(new Request("http://localhost/healthz"));
+  assertEquals(resHealth.status, 200);
+  assertEquals(await resHealth.text(), "OK");
+
+  // 2. Public Login page returns HTML
+  const resLogin = await app.fetch(new Request("http://localhost/login"));
+  assertEquals(resLogin.status, 200);
+  assertEquals(
+    resLogin.headers.get("content-type")?.includes("text/html"),
+    true,
+  );
+
+  // 3. Public Register page returns HTML
+  const resRegister = await app.fetch(new Request("http://localhost/register"));
+  assertEquals(resRegister.status, 200);
+  assertEquals(
+    resRegister.headers.get("content-type")?.includes("text/html"),
+    true,
+  );
+
+  // 4. Public Join page returns HTML
+  const resJoin = await app.fetch(new Request("http://localhost/join"));
+  assertEquals(resJoin.status, 200);
+  assertEquals(
+    resJoin.headers.get("content-type")?.includes("text/html"),
+    true,
+  );
+
+  // 5. Unauthenticated Dashboard redirects to /login
+  const resDash = await app.fetch(
+    new Request("http://localhost/dashboard/sessions"),
+  );
+  assertEquals(resDash.status, 302);
+  assertEquals(resDash.headers.get("location")?.includes("/login"), true);
+
+  // 6. Magic Link Pass without token redirects to /login
+  const resPass = await app.fetch(new Request("http://localhost/pass"));
+  assertEquals(resPass.status, 302);
+  assertEquals(
+    resPass.headers.get("location")?.includes(
+      "/login?error=invalid_or_expired_pass",
+    ),
+    true,
+  );
+
+  // 7. Forward Auth check without host returns 400
+  const resForwardAuth = await app.fetch(
+    new Request("http://localhost/api/forward-auth"),
+  );
+  assertEquals(resForwardAuth.status, 400);
+
+  // 8. Admin route unauthenticated redirects or denies
+  const resAdmin = await app.fetch(new Request("http://localhost/admin/users"));
+  assertEquals(resAdmin.status === 302 || resAdmin.status === 401, true);
+});