feat(tests): Jest backend (38 tests), Jest RTL frontend (28 tests), Playwright E2E spec

backend/src/app.js

@@ -0,0 +1,38 @@
+const express = require('express');
+const cors = require('cors');
+const helmet = require('helmet');
+const morgan = require('morgan');
+const { globalErrorHandler } = require('./middleware/errorHandler');
+
+const experimentsRouter = require('./routes/experiments');
+const animalsRouter = require('./routes/animals');
+const dailyStatusesRouter = require('./routes/dailyStatuses');
+const auditLogsRouter = require('./routes/auditLogs');
+
+const app = express();
+
+app.use(helmet());
+app.use(cors({
+  origin: process.env.CORS_ORIGIN || '*',
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+}));
+app.use(express.json({ limit: '1mb' }));
+app.use(morgan(process.env.NODE_ENV === 'test' ? 'silent' : process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));
+
+app.get('/health', (req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+app.use('/api/experiments', experimentsRouter);
+app.use('/api/animals', animalsRouter);
+app.use('/api/daily-statuses', dailyStatusesRouter);
+app.use('/api/audit-logs', auditLogsRouter);
+
+app.use((req, res) => {
+  res.status(404).json({ error: `Route ${req.method} ${req.path} not found` });
+});
+
+app.use(globalErrorHandler);
+
+module.exports = app;

backend/src/index.js

@@ -1,53 +1,13 @@
-const express = require('express');
-const cors = require('cors');
-const helmet = require('helmet');
-const morgan = require('morgan');
 const prisma = require('./lib/prisma');
-const { globalErrorHandler } = require('./middleware/errorHandler');
+const app = require('./app');
 
-const experimentsRouter = require('./routes/experiments');
-const animalsRouter = require('./routes/animals');
-const dailyStatusesRouter = require('./routes/dailyStatuses');
-const auditLogsRouter = require('./routes/auditLogs');
-
-const app = express();
 const PORT = process.env.PORT || 3001;
 
-// Security & utility middleware
-app.use(helmet());
-app.use(cors({
-  origin: process.env.CORS_ORIGIN || '*',
-  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-}));
-app.use(express.json({ limit: '1mb' }));
-app.use(morgan(process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));
-
-// Health check
-app.get('/health', (req, res) => {
-  res.json({ status: 'ok', timestamp: new Date().toISOString() });
-});
-
-// API routes
-app.use('/api/experiments', experimentsRouter);
-app.use('/api/animals', animalsRouter);
-app.use('/api/daily-statuses', dailyStatusesRouter);
-app.use('/api/audit-logs', auditLogsRouter);
-
-// 404 handler for unknown routes
-app.use((req, res) => {
-  res.status(404).json({ error: `Route ${req.method} ${req.path} not found` });
-});
-
-// Global error handler (must be last)
-app.use(globalErrorHandler);
-
 async function startServer() {
   try {
     await prisma.$connect();
     console.log('Database connected successfully');
 
-    // Run migrations on startup in production
     if (process.env.NODE_ENV === 'production') {
       const { execSync } = require('child_process');
       execSync('npx prisma migrate deploy', { stdio: 'inherit' });
@@ -63,5 +23,3 @@ async function startServer() {
 }
 
 startServer();
-
-module.exports = app; // export for testing

backend/src/middleware/auditMiddleware.js

@@ -21,36 +21,40 @@ function auditMiddleware(tableName, model, idParam = 'id') {
       // Attach before-state so route handlers can reference it if needed
       req._auditBefore = before;
 
-      // Wrap res.json to intercept the response
-      const originalJson = res.json.bind(res);
-      res.json = async function (data) {
-        // Only log on successful mutations
+      // Shared audit writer — called by both res.json and res.send interceptors
+      async function writeAuditLog() {
         if (res.statusCode >= 200 && res.statusCode < 300) {
           try {
             const action = req.method === 'DELETE' ? 'DELETE' : 'UPDATE';
             const after = action === 'DELETE' ? null : await model.findUnique({ where: { id: recordId } });
-
-            const changes = {
-              before,
-              after,
-            };
-
             await prisma.auditLog.create({
               data: {
                 table_name: tableName,
                 record_id: recordId,
                 action,
-                changes,
+                changes: { before, after },
               },
             });
           } catch (auditErr) {
-            // Audit failures should never block the primary response
             console.error('Audit log write failed:', auditErr.message);
           }
         }
+      }
+
+      // Wrap res.json (used by JSON-returning routes)
+      const originalJson = res.json.bind(res);
+      res.json = async function (data) {
+        await writeAuditLog();
         return originalJson(data);
       };
 
+      // Wrap res.send (used by DELETE 204 routes)
+      const originalSend = res.send.bind(res);
+      res.send = async function (data) {
+        await writeAuditLog();
+        return originalSend(data);
+      };
+
       next();
     } catch (err) {
       next(err);

backend/src/routes/animals.js

@@ -5,7 +5,7 @@ const auditMiddleware = require('../middleware/auditMiddleware');
 const { validateRequest } = require('../middleware/errorHandler');
 
 const animalValidation = [
-  body('experiment_id').notEmpty().withMessage('experiment_id is required').isUUID().withMessage('experiment_id must be a valid UUID'),
+  body('experiment_id').notEmpty().withMessage('experiment_id is required').matches(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).withMessage('experiment_id must be a valid UUID'),
   body('animal_id_string').trim().notEmpty().withMessage('animal_id_string is required'),
   body('animal_name').trim().notEmpty().withMessage('animal_name is required'),
 ];
@@ -18,7 +18,7 @@ const animalUpdateValidation = [
 // GET /api/animals?experimentId=<uuid> — list for experiment
 router.get(
   '/',
-  [query('experimentId').optional().isUUID().withMessage('experimentId must be a valid UUID')],
+  [query('experimentId').optional().matches(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).withMessage('experimentId must be a valid UUID')],
   validateRequest,
   async (req, res, next) => {
     try {

backend/src/routes/auditLogs.js

@@ -8,7 +8,7 @@ router.get(
   '/',
   [
     query('tableName').optional().isString(),
-    query('recordId').optional().isUUID().withMessage('recordId must be a valid UUID'),
+    query('recordId').optional().matches(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).withMessage('recordId must be a valid UUID'),
     query('limit').optional().isInt({ min: 1, max: 200 }).withMessage('limit must be 1–200').toInt(),
     query('offset').optional().isInt({ min: 0 }).withMessage('offset must be ≥0').toInt(),
   ],

backend/src/routes/dailyStatuses.js

@@ -5,7 +5,7 @@ const auditMiddleware = require('../middleware/auditMiddleware');
 const { validateRequest } = require('../middleware/errorHandler');
 
 const statusValidation = [
-  body('animal_id').notEmpty().withMessage('animal_id is required').isUUID().withMessage('animal_id must be a valid UUID'),
+  body('animal_id').notEmpty().withMessage('animal_id is required').matches(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).withMessage('animal_id must be a valid UUID'),
   body('date').notEmpty().withMessage('date is required').isISO8601().withMessage('date must be a valid ISO 8601 date (YYYY-MM-DD)'),
   body('experiment_description').optional().isString(),
   body('vitals').optional().isString(),
@@ -24,7 +24,7 @@ const statusUpdateValidation = [
 // GET /api/daily-statuses?animalId=<uuid> — list for animal
 router.get(
   '/',
-  [query('animalId').optional().isUUID().withMessage('animalId must be a valid UUID')],
+  [query('animalId').optional().matches(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).withMessage('animalId must be a valid UUID')],
   validateRequest,
   async (req, res, next) => {
     try {