Supertest suite covering auth boundaries, a 405 check and a SQL-injection probe all at once

API test suite for an Express orders service (JWT auth) using Vitest + Supertest. Covers functional CRUD, auth boundaries, and a SQL-injection probe. ```typescript import { describe, it, expect, beforeAll } from "vitest"; import request from "supertest"; import { app } from "../src/app"; let token: string; beforeAll(async () => { const res = await request(app).post("/auth/login") .send({ email: "test@acme.io", password: "secret" }); token = res.body.token; }); describe("POST /orders — functional", () => { it("creates an order and returns 201 + Location", async () => { const res = await request(app).post("/orders") .set("Authorization", `Bearer ${token}`) .send({ sku: "SKU-004521", qty: 2 }); expect(res.status).toBe(201); expect(res.headers.location).toMatch(/^\/orders\//); }); it("rejects an invalid body with 422", async () => { const res = await request(app).post("/orders") .set("Authorization", `Bearer ${token}`) .send({ sku: "SKU-004521", qty: -1 }); expect(res.status).toBe(422); }); }); describe("auth + security boundaries", () => { it("returns 401 without a token", async () => { const res = await request(app).get("/orders"); expect(res.status).toBe(401); }); it("treats SQL payloads in query params as literal data", async () => { const res = await request(app).get("/orders?status=open' OR '1'='1") .set("Authorization", `Bearer ${token}`); expect(res.status).toBe(400); // rejected by validation, not executed }); it("enforces method restrictions (405)", async () => { const res = await request(app).put("/orders").set("Authorization", `Bearer ${token}`); expect(res.status).toBe(405); }); }); ``` **Also generated:** a contract test asserting the response matches the OpenAPI schema (via `ajv`), rate-limit verification (101 requests → expect a 429), and a CORS preflight check. Fixtures seed a clean DB per file; the suite runs as a `npm run test:api` CI job with an HTML report uploaded.