phase 7: income, payday. and budget handling routes simplified and compacted

api/tests/income.integration.test.ts

@@ -3,6 +3,7 @@ import request from "supertest";
 import { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
 import { resetUser } from "./helpers";
+import { randomUUID } from "node:crypto";
 
 // Ensure env BEFORE importing the server
 process.env.NODE_ENV = process.env.NODE_ENV || "test";
@@ -12,6 +13,7 @@ process.env.DATABASE_URL =
 
 const prisma = new PrismaClient();
 let app: FastifyInstance;
+const csrf = randomUUID().replace(/-/g, "");
 
 beforeAll(async () => {
   // dynamic import AFTER env is set
@@ -61,6 +63,8 @@ describe("POST /income integration", () => {
     const res = await request(app.server)
       .post("/income")
       .set("x-user-id", "demo-user-1")
+      .set("x-csrf-token", csrf)
+      .set("Cookie", `csrf=${csrf}`)
       .send({ amountCents: 5000 });
 
     expect(res.status).toBe(200);

api/tests/income.test.ts

@@ -4,8 +4,10 @@ import { describe, it, expect, beforeEach, afterAll, beforeAll } from "vitest";
 import appFactory from "./appFactory";
 import { prisma, resetUser, ensureUser, U, cid, pid, closePrisma } from "./helpers";
 import type { FastifyInstance } from "fastify";
+import { randomUUID } from "node:crypto";
 
 let app: FastifyInstance;
+const csrf = randomUUID().replace(/-/g, "");
 
 beforeAll(async () => {
   app = await appFactory();            // <-- await the app
@@ -51,6 +53,8 @@ describe("POST /income", () => {
     const res = await request(app.server)
       .post("/income")
       .set("x-user-id", U)
+      .set("x-csrf-token", csrf)
+      .set("Cookie", `csrf=${csrf}`)
       .send({ amountCents: 15000 });
 
     expect(res.statusCode).toBe(200);