Add Authentication Tests for Unauthorized Access to Protected Resources

[devin-ai-integration]

Add Authentication Tests for Unauthorized Access to Protected Resources

Summary

This PR adds authentication tests to verify that protected endpoints properly reject unauthenticated requests with 401 responses. Previously, the JWT test suite only tested token creation and decoding functions, but didn't test the actual HTTP authentication flow.

Changes:

• Modified setUp() to use create_app() and create a Flask test client for HTTP request testing
• Added test_protected_endpoints_without_token() - verifies requests without Authorization header are rejected with 401 and error message "Authorization token is required"
• Added test_protected_endpoints_with_invalid_token() - verifies requests with malformed tokens are rejected with 401 and error message containing "Invalid token"
• Tests cover representative protected endpoints from auth, invoices, and reports routes

All tests pass locally using all three execution methods (run_tests.py, direct execution, unittest discover).

Review & Testing Checklist for Human

• Run all three test execution methods to confirm they work correctly:
  • python3 tests/run_tests.py
  • python3 tests/test_jwt.py
  • python3 -m unittest discover tests -v
• Verify error messages match production behavior - The tests check for exact error messages defined in app.py JWT error handlers. Confirm these are the correct messages users should see.
• Consider endpoint coverage - Tests only check 3 of ~10 protected endpoints. This tests the auth mechanism (not each endpoint), but consider if additional endpoints should be tested.

Test Plan

1. Run the backend tests using any of the three methods above
2. Verify all 9 tests pass (7 original + 2 new)
3. Optionally: Manually test a protected endpoint without auth to confirm 401 behavior matches test expectations

Notes

• The setUp() method now creates the full Flask application using create_app() instead of a minimal Flask app. This provides more realistic testing but means all tests now run with complete app initialization (database, blueprints, error handlers). All existing tests continue to pass with this change.
• Session link: https://app.devin.ai/sessions/d59e2b68ccd346aeb706c62e7e5c423a
• Requested by: @JRWu

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud