Test Server Logic with Vitest

Generate a vitest.config.ts for our Next.js 15.5 project. Requirements:

1. Default environment: 'node' (API routes, helpers, middleware)
2. Override: any file under __tests__/components/ or matching *.component.test.ts
   should use @vitest-environment jsdom
3. Path aliases matching our tsconfig: @ -> src/, @/lib -> src/lib/, etc.
4. Exclude node_modules and .next from test discovery
5. Coverage provider: v8, thresholds: 80% statements, 70% branches
6. Setup file: src/test/setup.ts that mocks next/headers (cookies, headers)
   and @azure/msal-node (acquireTokenByClientCredential returns a dummy token)
7. Global timeout: 10 seconds per test (our Azure SQL mocks should never hit network)

The project uses mssql for database, @azure/msal-node for auth, next-auth v5,
and Zod v3 for validation. All API route handlers use our custom response helpers
(listResponse, errorResponse, successResponse) from src/lib/api/responses.ts.

Write Vitest tests for src/app/api/facilities/route.ts. The route:

- GET: calls withPermission('viewer') then queries facilities from Azure SQL,
  returns listResponse({ data, total, page, pageSize })
- POST: calls withPermission('operator'), validates body with FacilityCreateSchema
  (Zod), inserts into DB, returns successResponse({ id })
- Both use getServerSession from next-auth to get the user

Mock these dependencies:
- src/lib/db/connection.ts — mock getPool() to return a fake mssql pool
  where pool.request().query() returns controlled data
- next-auth — mock getServerSession to return { user: { role: 'viewer' } }
  or { user: { role: 'operator' } } depending on the test
- Do NOT mock withPermission itself — test that it actually blocks unauthorized roles

Test cases:
1. GET returns facilities with correct pagination metadata
2. GET with viewer role succeeds (viewer can read)
3. POST with operator role succeeds
4. POST with viewer role returns 403
5. POST with invalid body returns 400 with Zod error details
6. GET with no session returns 401

it('POST with viewer role returns 403', async () => {
  vi.mocked(getServerSession).mockResolvedValue({
    user: { id: '1', role: 'viewer', name: 'Test User' },
    expires: new Date(Date.now() + 3600000).toISOString(),
  });

  const req = new NextRequest('http://localhost/api/facilities', {
    method: 'POST',
    body: JSON.stringify({ name: 'Test Facility', code: 'TST' }),
    headers: { 'Content-Type': 'application/json' },
  });

  const res = await POST(req);
  expect(res.status).toBe(403);
  const body = await res.json();
  expect(body.error).toContain('permission');
});

import { FacilityCreateSchema } from '../schemas/facility';

it('rejects facility without required code field', () => {
  const result = FacilityCreateSchema.safeParse({ name: 'Test' });
  expect(result.success).toBe(false);
  expect(result.error?.issues[0].path).toContain('code');
});

it('rejects code longer than 10 characters', () => {
  const result = FacilityCreateSchema.safeParse({
    name: 'Test',
    code: 'TOOLONGCODE1',
  });
  expect(result.success).toBe(false);
});

import { formatSafeError } from '../errors';

it('strips stack traces from error messages', () => {
  const err = new Error('Connection refused');
  err.stack = 'Error: Connection refused\n    at Pool.connect (mssql/lib/pool.js:42)';
  const safe = formatSafeError(err);
  expect(safe).not.toContain('mssql/lib');
  expect(safe).toContain('Connection refused');
});

it('replaces unknown errors with generic message', () => {
  const safe = formatSafeError('something weird happened');
  expect(safe).toBe('An unexpected error occurred');
});