From bf18fbbb9a491ad7a555b23409c1098761f154d8 Mon Sep 17 00:00:00 2001
From: Anso <dev@saelix.com>
Date: Mon, 22 Jun 2026 20:55:32 -0400
Subject: [PATCH] test(audit-log): assert PAID_REQUIRED code on
 Community-blocked stats and export (#1417)

The /stats and /export routes run the paid-license guard before the
permission guard, so a Community admin's rejection comes from the paid
gate. The existing tests only checked the 403 status, which a permission
gate would also produce, so they did not prove which gate fired.

Assert res.body.code === 'PAID_REQUIRED' on both so each test pins the
rejection to the paid gate, matching the assertion already used in the
secrets suite.
---
 backend/src/__tests__/audit-log.test.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/backend/src/__tests__/audit-log.test.ts b/backend/src/__tests__/audit-log.test.ts
index e3baa3ca..2b9128d3 100644
--- a/backend/src/__tests__/audit-log.test.ts
+++ b/backend/src/__tests__/audit-log.test.ts
@@ -655,6 +655,7 @@ describe('GET /api/audit-log/stats', () => {
       .get('/api/audit-log/stats')
       .set('Authorization', `Bearer ${adminToken()}`);
     expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
   });
 
   it('returns the four-tile stat structure for admin', async () => {
@@ -682,6 +683,7 @@ describe('GET /api/audit-log/export', () => {
       .get('/api/audit-log/export?format=json')
       .set('Authorization', `Bearer ${adminToken()}`);
     expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
   });
 
   it('exports JSON with correct Content-Type', async () => {