From bde1d32b1499424d3c1a0643c1055db5571e4c88 Mon Sep 17 00:00:00 2001
From: "Torsten Schulz (local)" <tsschulz@gmx.net>
Date: Mon, 10 Nov 2025 13:08:50 +0100
Subject: [PATCH] Update dependencies in package.json and package-lock.json;
 add testing scripts for Vitest, and include new packages such as supertest
 and vitest. Refactor Navigation component to improve event handling and
 cleanup, ensuring better performance and user experience. Enhance error
 handling in various API endpoints for PDF uploads and CSV saves, ensuring
 robust error propagation. Update nodemailer transport configuration for
 consistency across API handlers.

---
 components/Navigation.vue                   |   23 +-
 package-lock.json                           | 1188 ++++++++++++++++++-
 package.json                                |    8 +-
 server/api/cms/satzung-upload.post.js       |    3 +
 server/api/cms/save-csv.post.js             |    3 +
 server/api/cms/upload-spielplan-pdf.post.js |    4 +
 server/api/cms/users/approve.post.js        |    2 +-
 server/api/contact.post.js                  |    2 +-
 tests/auth-endpoints.spec.ts                |  168 +++
 tests/cms-files-endpoints.spec.ts           |   96 ++
 tests/cms-users-endpoints.spec.ts           |  138 +++
 tests/members-endpoints.spec.ts             |  158 +++
 tests/public-endpoints.spec.ts              |  142 +++
 tests/setup.ts                              |  121 ++
 vitest.config.ts                            |   14 +
 15 files changed, 2055 insertions(+), 15 deletions(-)
 create mode 100644 tests/auth-endpoints.spec.ts
 create mode 100644 tests/cms-files-endpoints.spec.ts
 create mode 100644 tests/cms-users-endpoints.spec.ts
 create mode 100644 tests/members-endpoints.spec.ts
 create mode 100644 tests/public-endpoints.spec.ts
 create mode 100644 tests/setup.ts
 create mode 100644 vitest.config.ts

diff --git a/components/Navigation.vue b/components/Navigation.vue
index 569b2c7..10ebf01 100644
--- a/components/Navigation.vue
+++ b/components/Navigation.vue
@@ -485,7 +485,7 @@
 </template>
 
 <script setup>
-import { ref, onMounted, computed, watch } from 'vue'
+import { ref, onMounted, onUnmounted, computed } from 'vue'
 import { useRoute } from 'vue-router'
 import { Menu, X, ChevronDown } from 'lucide-vue-next'
 
@@ -520,9 +520,6 @@ const currentSubmenu = computed(() => {
   return null
 })
 
-// Manuelles Toggle für Click-Events
-const manualSubmenu = ref(null)
-
 const toggleMobileSubmenu = (menu) => {
   mobileSubmenu.value = mobileSubmenu.value === menu ? null : menu
 }
@@ -557,7 +554,7 @@ const loadMannschaften = async () => {
       }
       values.push(current.trim())
 
-      if (values.length < 10) return null
+      if (!values[0]) return null
 
       return {
         mannschaft: values[0].trim(),
@@ -583,17 +580,23 @@ const toggleCmsDropdown = () => {
   showCmsDropdown.value = !showCmsDropdown.value
 }
 
+const handleDocumentClick = (e) => {
+  if (!e.target.closest('.relative.inline-block')) {
+    showCmsDropdown.value = false
+  }
+}
+
 onMounted(() => {
   loadMannschaften()
   checkGalleryImages()
   authStore.checkAuth()
 
   // Close CMS dropdown when clicking outside
-  document.addEventListener('click', (e) => {
-    if (!e.target.closest('.relative.inline-block')) {
-      showCmsDropdown.value = false
-    }
-  })
+  document.addEventListener('click', handleDocumentClick)
+})
+
+onUnmounted(() => {
+  document.removeEventListener('click', handleDocumentClick)
 })
 
 const toggleSubmenu = (menu) => {
diff --git a/package-lock.json b/package-lock.json
index ef7ad6a..c7567f9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -25,7 +25,9 @@
         "autoprefixer": "^10.4.0",
         "lucide-vue-next": "^0.344.0",
         "postcss": "^8.4.0",
-        "tailwindcss": "^3.4.0"
+        "supertest": "^7.1.0",
+        "tailwindcss": "^3.4.0",
+        "vitest": "^2.1.4"
       }
     },
     "node_modules/@alloc/quick-lru": {
@@ -1303,6 +1305,19 @@
         "@tybys/wasm-util": "^0.10.1"
       }
     },
+    "node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -2398,6 +2413,16 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
+    "node_modules/@paralleldrive/cuid2": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.3.1.tgz",
+      "integrity": "sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "^1.1.5"
+      }
+    },
     "node_modules/@parcel/watcher": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
@@ -3453,6 +3478,106 @@
       "integrity": "sha512-g6eW7Zwnr2c5RADIoqziHoVs6b3W5QTQ4+qbpfjbkMJ9x+8Og211VW/oot2dj9dVwaK/UyC6Yo+02gV+wWQVNg==",
       "license": "MIT"
     },
+    "node_modules/@vitest/expect": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-2.1.9.tgz",
+      "integrity": "sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "2.1.9",
+        "@vitest/utils": "2.1.9",
+        "chai": "^5.1.2",
+        "tinyrainbow": "^1.2.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-2.1.9.tgz",
+      "integrity": "sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^1.2.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-2.1.9.tgz",
+      "integrity": "sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "2.1.9",
+        "pathe": "^1.1.2"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner/node_modules/pathe": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
+      "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-2.1.9.tgz",
+      "integrity": "sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "2.1.9",
+        "magic-string": "^0.30.12",
+        "pathe": "^1.1.2"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot/node_modules/pathe": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
+      "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@vitest/spy": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-2.1.9.tgz",
+      "integrity": "sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyspy": "^3.0.2"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-2.1.9.tgz",
+      "integrity": "sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "2.1.9",
+        "loupe": "^3.1.2",
+        "tinyrainbow": "^1.2.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@volar/language-core": {
       "version": "2.4.23",
       "resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.23.tgz",
@@ -3956,6 +4081,23 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/asap": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
+      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/ast-kit": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ast-kit/-/ast-kit-2.1.3.tgz",
@@ -4000,6 +4142,13 @@
       "integrity": "sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg==",
       "license": "MIT"
     },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/at-least-node": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
@@ -4425,6 +4574,23 @@
       ],
       "license": "CC-BY-4.0"
     },
+    "node_modules/chai": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-5.3.3.tgz",
+      "integrity": "sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "assertion-error": "^2.0.1",
+        "check-error": "^2.1.1",
+        "deep-eql": "^5.0.1",
+        "loupe": "^3.1.0",
+        "pathval": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -4442,6 +4608,16 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/check-error": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.1.tgz",
+      "integrity": "sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      }
+    },
     "node_modules/chokidar": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
@@ -4712,6 +4888,19 @@
       "integrity": "sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==",
       "license": "MIT"
     },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/commander": {
       "version": "11.1.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
@@ -4733,6 +4922,16 @@
       "integrity": "sha512-6gLRNt4ygsi5NyMVhceOCFv14CIdDFN7fQjX1U4+47qVE/+kjPoXMK65KWK+dWxmFzMTuKazoQ9sch6pM0p5oA==",
       "license": "MIT"
     },
+    "node_modules/component-emitter": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz",
+      "integrity": "sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/compress-commons": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
@@ -4856,6 +5055,13 @@
       "integrity": "sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg==",
       "license": "MIT"
     },
+    "node_modules/cookiejar": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+      "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/cookies": {
       "version": "0.9.1",
       "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.9.1.tgz",
@@ -5200,6 +5406,16 @@
         }
       }
     },
+    "node_modules/deep-eql": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz",
+      "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/deep-equal": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-1.0.1.tgz",
@@ -5259,6 +5475,16 @@
       "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
       "license": "MIT"
     },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/delegates": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
@@ -5319,6 +5545,17 @@
       "integrity": "sha512-YtoaOfsqjbZQKGIMRYDWKjUmSB4VJ/RElB+bXZawQAQYAo4xu08GKTMVlsZDTF6R2MbAgjcAQRPI5eIyRAT2OQ==",
       "license": "MIT"
     },
+    "node_modules/dezalgo": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/dezalgo/-/dezalgo-1.0.4.tgz",
+      "integrity": "sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "asap": "^2.0.0",
+        "wrappy": "1"
+      }
+    },
     "node_modules/didyoumean": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
@@ -5553,6 +5790,22 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/esbuild": {
       "version": "0.25.11",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.11.tgz",
@@ -5689,6 +5942,16 @@
         "url": "https://github.com/sindresorhus/execa?sponsor=1"
       }
     },
+    "node_modules/expect-type": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.2.2.tgz",
+      "integrity": "sha512-JhFGDVJ7tmDJItKhYgJCGLOWjuK9vPxiXoUFLwLDc99NlmklilbiQJwoctZtt13+xMw91MCk/REan6MWHqDjyA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/exsolve": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.7.tgz",
@@ -5726,6 +5989,13 @@
         "url": "https://github.com/sponsors/antfu"
       }
     },
+    "node_modules/fast-safe-stringify": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
+      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/fastq": {
       "version": "1.19.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
@@ -5801,6 +6071,64 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/form-data": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/form-data/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/form-data/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/formidable": {
+      "version": "3.5.4",
+      "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.4.tgz",
+      "integrity": "sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@paralleldrive/cuid2": "^2.2.2",
+        "dezalgo": "^1.0.4",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "funding": {
+        "url": "https://ko-fi.com/tunnckoCore/commissions"
+      }
+    },
     "node_modules/fraction.js": {
       "version": "4.3.7",
       "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
@@ -7241,6 +7569,13 @@
       "integrity": "sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==",
       "license": "MIT"
     },
+    "node_modules/loupe": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz",
+      "integrity": "sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lru-cache": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
@@ -8043,6 +8378,19 @@
         "node": ">= 6"
       }
     },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/ofetch": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/ofetch/-/ofetch-1.4.1.tgz",
@@ -8400,6 +8748,16 @@
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
       "license": "MIT"
     },
+    "node_modules/pathval": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.1.tgz",
+      "integrity": "sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.16"
+      }
+    },
     "node_modules/pdf-lib": {
       "version": "1.17.1",
       "resolved": "https://registry.npmjs.org/pdf-lib/-/pdf-lib-1.17.1.tgz",
@@ -9241,6 +9599,22 @@
       "integrity": "sha512-hHVTzba3wboROl0/aWRRG9dMytgH6ow//STBZh43l/wQgmMhYhOFi0EHWAPtoCz9IAUymsyP0TSBHkhgMEGNnQ==",
       "license": "MIT"
     },
+    "node_modules/qs": {
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
+      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/quansync": {
       "version": "0.2.11",
       "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
@@ -9845,6 +10219,89 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/signal-exit": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
@@ -9968,6 +10425,13 @@
         "node": ">=20.16.0"
       }
     },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/standard-as-callback": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/standard-as-callback/-/standard-as-callback-2.1.0.tgz",
@@ -10198,6 +10662,40 @@
         "node": ">= 6"
       }
     },
+    "node_modules/superagent": {
+      "version": "10.2.3",
+      "resolved": "https://registry.npmjs.org/superagent/-/superagent-10.2.3.tgz",
+      "integrity": "sha512-y/hkYGeXAj7wUMjxRbB21g/l6aAEituGXM9Rwl4o20+SX3e8YOSV6BxFXl+dL3Uk0mjSL3kCbNkwURm8/gEDig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "component-emitter": "^1.3.1",
+        "cookiejar": "^2.1.4",
+        "debug": "^4.3.7",
+        "fast-safe-stringify": "^2.1.1",
+        "form-data": "^4.0.4",
+        "formidable": "^3.5.4",
+        "methods": "^1.1.2",
+        "mime": "2.6.0",
+        "qs": "^6.11.2"
+      },
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
+    "node_modules/superagent/node_modules/mime": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
+      "integrity": "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
     "node_modules/superjson": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/superjson/-/superjson-2.2.2.tgz",
@@ -10210,6 +10708,20 @@
         "node": ">=16"
       }
     },
+    "node_modules/supertest": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/supertest/-/supertest-7.1.4.tgz",
+      "integrity": "sha512-tjLPs7dVyqgItVFirHYqe2T+MfWc2VOBQ8QFKKbWTA3PU7liZR8zoSpAi/C1k1ilm9RsXIKYf197oap9wXGVYg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "methods": "^1.1.2",
+        "superagent": "^10.2.3"
+      },
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
     "node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -10604,6 +11116,13 @@
       "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
       "license": "MIT"
     },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tinyexec": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.1.tgz",
@@ -10626,6 +11145,36 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
+    "node_modules/tinypool": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.1.1.tgz",
+      "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-1.2.0.tgz",
+      "integrity": "sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tinyspy": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/tinyspy/-/tinyspy-3.0.2.tgz",
+      "integrity": "sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -11455,6 +12004,626 @@
         "vue": "^3.5.0"
       }
     },
+    "node_modules/vitest": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-2.1.9.tgz",
+      "integrity": "sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/expect": "2.1.9",
+        "@vitest/mocker": "2.1.9",
+        "@vitest/pretty-format": "^2.1.9",
+        "@vitest/runner": "2.1.9",
+        "@vitest/snapshot": "2.1.9",
+        "@vitest/spy": "2.1.9",
+        "@vitest/utils": "2.1.9",
+        "chai": "^5.1.2",
+        "debug": "^4.3.7",
+        "expect-type": "^1.1.0",
+        "magic-string": "^0.30.12",
+        "pathe": "^1.1.2",
+        "std-env": "^3.8.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^0.3.1",
+        "tinypool": "^1.0.1",
+        "tinyrainbow": "^1.2.0",
+        "vite": "^5.0.0",
+        "vite-node": "2.1.9",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@types/node": "^18.0.0 || >=20.0.0",
+        "@vitest/browser": "2.1.9",
+        "@vitest/ui": "2.1.9",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/android-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz",
+      "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/android-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz",
+      "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/android-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz",
+      "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz",
+      "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/darwin-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz",
+      "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz",
+      "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz",
+      "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz",
+      "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz",
+      "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz",
+      "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-loong64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz",
+      "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz",
+      "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz",
+      "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-s390x": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz",
+      "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/linux-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz",
+      "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/sunos-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz",
+      "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/win32-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz",
+      "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/win32-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz",
+      "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@esbuild/win32-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz",
+      "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/mocker": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-2.1.9.tgz",
+      "integrity": "sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "2.1.9",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.12"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/esbuild": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz",
+      "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.21.5",
+        "@esbuild/android-arm": "0.21.5",
+        "@esbuild/android-arm64": "0.21.5",
+        "@esbuild/android-x64": "0.21.5",
+        "@esbuild/darwin-arm64": "0.21.5",
+        "@esbuild/darwin-x64": "0.21.5",
+        "@esbuild/freebsd-arm64": "0.21.5",
+        "@esbuild/freebsd-x64": "0.21.5",
+        "@esbuild/linux-arm": "0.21.5",
+        "@esbuild/linux-arm64": "0.21.5",
+        "@esbuild/linux-ia32": "0.21.5",
+        "@esbuild/linux-loong64": "0.21.5",
+        "@esbuild/linux-mips64el": "0.21.5",
+        "@esbuild/linux-ppc64": "0.21.5",
+        "@esbuild/linux-riscv64": "0.21.5",
+        "@esbuild/linux-s390x": "0.21.5",
+        "@esbuild/linux-x64": "0.21.5",
+        "@esbuild/netbsd-x64": "0.21.5",
+        "@esbuild/openbsd-x64": "0.21.5",
+        "@esbuild/sunos-x64": "0.21.5",
+        "@esbuild/win32-arm64": "0.21.5",
+        "@esbuild/win32-ia32": "0.21.5",
+        "@esbuild/win32-x64": "0.21.5"
+      }
+    },
+    "node_modules/vitest/node_modules/pathe": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
+      "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vitest/node_modules/tinyexec": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
+      "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vitest/node_modules/vite": {
+      "version": "5.4.21",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.21.tgz",
+      "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.21.3",
+        "postcss": "^8.4.43",
+        "rollup": "^4.20.0"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^18.0.0 || >=20.0.0",
+        "less": "*",
+        "lightningcss": "^1.21.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "stylus": "*",
+        "sugarss": "*",
+        "terser": "^5.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/vite-node": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-2.1.9.tgz",
+      "integrity": "sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cac": "^6.7.14",
+        "debug": "^4.3.7",
+        "es-module-lexer": "^1.5.4",
+        "pathe": "^1.1.2",
+        "vite": "^5.0.0"
+      },
+      "bin": {
+        "vite-node": "vite-node.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/vscode-uri": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
@@ -11549,6 +12718,23 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
diff --git a/package.json b/package.json
index 199811a..c845b43 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,9 @@
     "generate": "nuxt generate",
     "preview": "nuxt preview --port 3100",
     "start": "nuxt start --port 3100",
-    "postinstall": "nuxt prepare"
+    "postinstall": "nuxt prepare",
+    "test": "vitest run",
+    "test:watch": "vitest watch"
   },
   "dependencies": {
     "@pinia/nuxt": "^0.11.2",
@@ -29,6 +31,8 @@
     "autoprefixer": "^10.4.0",
     "lucide-vue-next": "^0.344.0",
     "postcss": "^8.4.0",
-    "tailwindcss": "^3.4.0"
+    "tailwindcss": "^3.4.0",
+    "supertest": "^7.1.0",
+    "vitest": "^2.1.4"
   }
 }
diff --git a/server/api/cms/satzung-upload.post.js b/server/api/cms/satzung-upload.post.js
index 2fbb14a..7d4ea75 100644
--- a/server/api/cms/satzung-upload.post.js
+++ b/server/api/cms/satzung-upload.post.js
@@ -183,6 +183,9 @@ Satzungsänderungen können nur in einer Mitgliederversammlung mit einer Mehrhei
     
   } catch (error) {
     console.error('PDF Upload Error:', error)
+    if (error.statusCode) {
+      throw error
+    }
     throw createError({
       statusCode: 500,
       statusMessage: error.message || 'Fehler beim Verarbeiten der PDF-Datei'
diff --git a/server/api/cms/save-csv.post.js b/server/api/cms/save-csv.post.js
index d8ee9f6..d1c5236 100644
--- a/server/api/cms/save-csv.post.js
+++ b/server/api/cms/save-csv.post.js
@@ -44,6 +44,9 @@ export default defineEventHandler(async (event) => {
     
   } catch (error) {
     console.error('Fehler beim Speichern der CSV-Datei:', error)
+    if (error.statusCode) {
+      throw error
+    }
     throw createError({
       statusCode: 500,
       statusMessage: 'Fehler beim Speichern der Datei'
diff --git a/server/api/cms/upload-spielplan-pdf.post.js b/server/api/cms/upload-spielplan-pdf.post.js
index 4f3a59e..5b797bb 100644
--- a/server/api/cms/upload-spielplan-pdf.post.js
+++ b/server/api/cms/upload-spielplan-pdf.post.js
@@ -80,6 +80,10 @@ export default defineEventHandler(async (event) => {
   } catch (error) {
     console.error('Fehler beim PDF-Upload:', error)
     
+    if (error.statusCode) {
+      throw error
+    }
+    
     if (error.code === 'LIMIT_FILE_SIZE') {
       throw createError({
         statusCode: 413,
diff --git a/server/api/cms/users/approve.post.js b/server/api/cms/users/approve.post.js
index b7c6723..a2037e5 100644
--- a/server/api/cms/users/approve.post.js
+++ b/server/api/cms/users/approve.post.js
@@ -35,7 +35,7 @@ export default defineEventHandler(async (event) => {
 
     // Send approval email
     try {
-      const transporter = nodemailer.createTransporter({
+      const transporter = nodemailer.createTransport({
         host: process.env.SMTP_HOST || 'smtp.gmail.com',
         port: process.env.SMTP_PORT || 587,
         secure: false,
diff --git a/server/api/contact.post.js b/server/api/contact.post.js
index f6d630e..f404e57 100644
--- a/server/api/contact.post.js
+++ b/server/api/contact.post.js
@@ -22,7 +22,7 @@ export default defineEventHandler(async (event) => {
     }
 
     // SMTP-Konfiguration (hier können Sie Ihre SMTP-Daten eintragen)
-    const transporter = nodemailer.createTransporter({
+    const transporter = nodemailer.createTransport({
       host: process.env.SMTP_HOST || 'smtp.gmail.com',
       port: process.env.SMTP_PORT || 587,
       secure: false, // true für 465, false für andere Ports
diff --git a/tests/auth-endpoints.spec.ts b/tests/auth-endpoints.spec.ts
new file mode 100644
index 0000000..8f53b75
--- /dev/null
+++ b/tests/auth-endpoints.spec.ts
@@ -0,0 +1,168 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEvent, mockSuccessReadBody } from './setup'
+
+vi.mock('../server/utils/auth.js', () => {
+  return {
+    readUsers: vi.fn(),
+    writeUsers: vi.fn(),
+    verifyPassword: vi.fn(),
+    generateToken: vi.fn(),
+    createSession: vi.fn(),
+    hashPassword: vi.fn(),
+    verifyToken: vi.fn(),
+    deleteSession: vi.fn(),
+    getUserFromToken: vi.fn(),
+    readSessions: vi.fn(),
+    writeSessions: vi.fn()
+  }
+})
+
+vi.mock('nodemailer', () => {
+  const sendMail = vi.fn().mockResolvedValue(true)
+  const createTransport = vi.fn(() => ({ sendMail }))
+  return {
+    default: { createTransport },
+    createTransport
+  }
+})
+
+const authUtils = await import('../server/utils/auth.js')
+const nodemailer = await import('nodemailer')
+
+import loginHandler from '../server/api/auth/login.post.js'
+import logoutHandler from '../server/api/auth/logout.post.js'
+import registerHandler from '../server/api/auth/register.post.js'
+import resetPasswordHandler from '../server/api/auth/reset-password.post.js'
+import statusHandler from '../server/api/auth/status.get.js'
+
+describe('Auth API Endpoints', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('POST /api/auth/login', () => {
+    it('wirft 400 bei fehlenden Feldern', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({})
+
+      await expect(loginHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('wirft 401 bei unbekanntem Benutzer', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ email: 'test@example.com', password: 'password' })
+      authUtils.readUsers.mockResolvedValue([])
+
+      await expect(loginHandler(event)).rejects.toMatchObject({ statusCode: 401 })
+    })
+
+    it('gibt Token und Cookie bei Erfolg zurück', async () => {
+      const event = createEvent()
+      const user = { id: '1', email: 'test@example.com', password: 'hash', role: 'mitglied', active: true, lastLogin: null }
+      mockSuccessReadBody({ email: user.email, password: 'plain' })
+      authUtils.readUsers.mockResolvedValue([user])
+      authUtils.verifyPassword.mockResolvedValue(true)
+      authUtils.generateToken.mockReturnValue('jwt-token')
+      authUtils.createSession.mockResolvedValue({})
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await loginHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(response.token).toBe('jwt-token')
+      expect(response.user).toMatchObject({ id: '1', email: user.email })
+      expect(authUtils.createSession).toHaveBeenCalledWith('1', 'jwt-token')
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+    })
+  })
+
+  describe('POST /api/auth/logout', () => {
+    it('löscht Session und Cookie, wenn Token vorhanden ist', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.deleteSession.mockResolvedValue()
+
+      const response = await logoutHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(authUtils.deleteSession).toHaveBeenCalledWith('token')
+    })
+
+    it('wirft 500 bei Fehlern', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.deleteSession.mockRejectedValue(new Error('boom'))
+
+      await expect(logoutHandler(event)).rejects.toMatchObject({ statusCode: 500 })
+    })
+  })
+
+  describe('POST /api/auth/register', () => {
+    it('prüft Pflichtfelder', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({})
+
+      await expect(registerHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('verhindert doppelte Benutzer', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ name: 'Max', email: 'max@example.com', password: '12345678' })
+      authUtils.readUsers.mockResolvedValue([{ email: 'max@example.com' }])
+
+      await expect(registerHandler(event)).rejects.toMatchObject({ statusCode: 409 })
+    })
+
+    it('legt Benutzer an und versendet E-Mails', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ name: 'Max', email: 'max@example.com', password: '12345678', phone: '123' })
+      authUtils.readUsers.mockResolvedValue([])
+      authUtils.hashPassword.mockResolvedValue('hashed')
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await registerHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+      expect(nodemailer.default.createTransport).toHaveBeenCalled()
+    })
+  })
+
+  describe('POST /api/auth/reset-password', () => {
+    it('prüft Pflichtfelder', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({})
+
+      const response = await resetPasswordHandler(event)
+      expect(response.success).toBe(true)
+    })
+
+    it('aktualisiert Passwort bei vorhandenem Benutzer', async () => {
+      const event = createEvent()
+      const user = { id: '1', email: 'user@example.com', name: 'User', password: 'hash' }
+      mockSuccessReadBody({ email: user.email })
+      authUtils.readUsers.mockResolvedValue([user])
+      authUtils.hashPassword.mockResolvedValue('new-hash')
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await resetPasswordHandler(event)
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+    })
+  })
+
+  describe('GET /api/auth/status', () => {
+    it('liefert loggedOut, wenn kein Cookie gesetzt ist', async () => {
+      const event = createEvent()
+      const response = await statusHandler(event)
+      expect(response.isLoggedIn).toBe(false)
+    })
+
+    it('liefert Benutzerinformationen bei gültigem Token', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.getUserFromToken.mockResolvedValue({ id: '1', email: 'user@example.com', name: 'User', role: 'mitglied' })
+
+      const response = await statusHandler(event)
+      expect(response.isLoggedIn).toBe(true)
+      expect(response.user).toMatchObject({ id: '1' })
+    })
+  })
+})
diff --git a/tests/cms-files-endpoints.spec.ts b/tests/cms-files-endpoints.spec.ts
new file mode 100644
index 0000000..a1fc1b3
--- /dev/null
+++ b/tests/cms-files-endpoints.spec.ts
@@ -0,0 +1,96 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEvent, mockSuccessReadBody } from './setup'
+import fs from 'fs/promises'
+
+vi.mock('multer', () => {
+  const single = vi.fn((field) => (req, _res, cb) => {
+    if (req.__mockMulterError) {
+      cb(req.__mockMulterError)
+      return
+    }
+    req.file = req.__mockFile || null
+    req.body = req.body || {}
+    cb(null)
+  })
+
+  const multerFn = vi.fn(() => ({ single }))
+  const diskStorage = vi.fn(() => ({}))
+  multerFn.diskStorage = diskStorage
+
+  return {
+    default: multerFn,
+    diskStorage
+  }
+})
+
+vi.mock('child_process', () => ({
+  exec: vi.fn()
+}))
+
+vi.mock('util', () => ({
+  promisify: () => () => Promise.resolve({ stdout: 'PDF Inhalt', stderr: '' })
+}))
+
+import saveCsvHandler from '../server/api/cms/save-csv.post.js'
+import uploadSpielplanHandler from '../server/api/cms/upload-spielplan-pdf.post.js'
+import satzungUploadHandler from '../server/api/cms/satzung-upload.post.js'
+
+describe('CMS File Endpoints', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks()
+    vi.clearAllMocks()
+  })
+
+  describe('POST /api/cms/save-csv', () => {
+    it('validiert Eingaben', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({})
+
+      await expect(saveCsvHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('speichert erlaubte Datei', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ filename: 'mannschaften.csv', content: 'data' })
+      vi.spyOn(fs, 'mkdir').mockResolvedValue(undefined)
+      vi.spyOn(fs, 'writeFile').mockResolvedValue(undefined)
+
+      const response = await saveCsvHandler(event)
+      expect(response.success).toBe(true)
+      expect(fs.writeFile).toHaveBeenCalled()
+    })
+  })
+
+  describe('POST /api/cms/upload-spielplan-pdf', () => {
+    it('erfordert Authorization Header', async () => {
+      const event = createEvent({ method: 'POST' })
+      event.node.req.__mockFile = { filename: 'file.pdf', originalname: 'orig.pdf', path: 'tmp', mimetype: 'application/pdf' }
+      event.node.req.body = { type: 'gesamt' }
+
+      await expect(uploadSpielplanHandler(event)).rejects.toMatchObject({ statusCode: 401 })
+    })
+
+    it('lädt PDF hoch und gibt Erfolg zurück', async () => {
+      const event = createEvent({ method: 'POST', headers: { authorization: 'Bearer token' } })
+      event.node.req.__mockFile = { filename: 'spielplan_gesamt.pdf', originalname: 'orig.pdf', path: 'tmp', mimetype: 'application/pdf' }
+      event.node.req.body = { type: 'gesamt' }
+
+      const response = await uploadSpielplanHandler(event)
+      expect(response.success).toBe(true)
+      expect(response.filename).toBeDefined()
+    })
+  })
+
+  describe('POST /api/cms/satzung-upload', () => {
+    it('verarbeitet hochgeladene Satzung', async () => {
+      const event = createEvent({ method: 'POST' })
+      event.node.req.__mockFile = { path: 'public/documents/satzung.pdf', filename: 'satzung.pdf', originalname: 'satzung.pdf', mimetype: 'application/pdf' }
+      vi.spyOn(fs, 'readFile').mockResolvedValueOnce(JSON.stringify({ seiten: {}, vorstand: { vorsitzender: { email: '' }, schriftfuehrer: { email: '' } } }))
+      vi.spyOn(fs, 'writeFile').mockResolvedValue(undefined)
+
+      const response = await satzungUploadHandler(event)
+      expect(response.success).toBe(true)
+      expect(fs.writeFile).toHaveBeenCalled()
+    })
+  })
+})
diff --git a/tests/cms-users-endpoints.spec.ts b/tests/cms-users-endpoints.spec.ts
new file mode 100644
index 0000000..a6c7eda
--- /dev/null
+++ b/tests/cms-users-endpoints.spec.ts
@@ -0,0 +1,138 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEvent, mockSuccessReadBody } from './setup'
+
+vi.mock('../server/utils/auth.js', () => ({
+  getUserFromToken: vi.fn(),
+  readUsers: vi.fn(),
+  writeUsers: vi.fn()
+}))
+
+vi.mock('nodemailer', () => {
+  const sendMail = vi.fn().mockResolvedValue(true)
+  const createTransport = vi.fn(() => ({ sendMail }))
+  return {
+    default: { createTransport },
+    createTransport
+  }
+})
+
+const authUtils = await import('../server/utils/auth.js')
+const nodemailer = await import('nodemailer')
+
+import usersListHandler from '../server/api/cms/users/list.get.js'
+import usersApproveHandler from '../server/api/cms/users/approve.post.js'
+import usersDeactivateHandler from '../server/api/cms/users/deactivate.post.js'
+import usersRejectHandler from '../server/api/cms/users/reject.post.js'
+import usersUpdateRoleHandler from '../server/api/cms/users/update-role.post.js'
+
+describe('CMS User Management Endpoints', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  const adminEvent = () => {
+    const event = createEvent({ cookies: { auth_token: 'token' } })
+    authUtils.getUserFromToken.mockResolvedValue({ id: 'admin', role: 'admin' })
+    return event
+  }
+
+  describe('GET /api/cms/users/list', () => {
+    it('verweigert Zugriff für Nicht-Admins', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.getUserFromToken.mockResolvedValue({ id: 'user', role: 'mitglied' })
+
+      await expect(usersListHandler(event)).rejects.toMatchObject({ statusCode: 403 })
+    })
+
+    it('liefert Benutzerliste ohne Passwörter', async () => {
+      const event = adminEvent()
+      authUtils.readUsers.mockResolvedValue([{ id: '1', email: 'a@b.de', name: 'Anna', role: 'mitglied', phone: '1', active: true, created: 'now', lastLogin: null, password: 'secret' }])
+
+      const response = await usersListHandler(event)
+      expect(response.users[0]).not.toHaveProperty('password')
+      expect(response.users).toHaveLength(1)
+    })
+  })
+
+  describe('POST /api/cms/users/approve', () => {
+    it('erfordert administrative Rolle', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.getUserFromToken.mockResolvedValue({ id: 'user', role: 'mitglied' })
+      mockSuccessReadBody({ userId: '1' })
+
+      await expect(usersApproveHandler(event)).rejects.toMatchObject({ statusCode: 403 })
+    })
+
+    it('meldet 404 bei unbekanntem Benutzer', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '1' })
+      authUtils.readUsers.mockResolvedValue([])
+
+      await expect(usersApproveHandler(event)).rejects.toMatchObject({ statusCode: 404 })
+    })
+
+    it('aktiviert Benutzer und sendet Mail', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '1', role: 'vorstand' })
+      authUtils.readUsers.mockResolvedValue([{ id: '1', email: 'user@test.de', name: 'Udo', active: false }])
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await usersApproveHandler(event)
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+      expect(nodemailer.default.createTransport).toHaveBeenCalled()
+    })
+  })
+
+  describe('POST /api/cms/users/deactivate', () => {
+    it('verhindert Selbst-Deaktivierung', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: 'admin' })
+      await expect(usersDeactivateHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('deaktiviert Benutzer', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '1' })
+      authUtils.readUsers.mockResolvedValue([{ id: '1', active: true }])
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await usersDeactivateHandler(event)
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+    })
+  })
+
+  describe('POST /api/cms/users/reject', () => {
+    it('löscht Benutzer aus der Liste', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '2' })
+      authUtils.readUsers.mockResolvedValue([{ id: '1' }, { id: '2' }])
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await usersRejectHandler(event)
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalledWith([{ id: '1' }])
+    })
+  })
+
+  describe('POST /api/cms/users/update-role', () => {
+    it('validiert Rolle', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '1', role: 'invalid' })
+
+      await expect(usersUpdateRoleHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('aktualisiert Rolle', async () => {
+      const event = adminEvent()
+      mockSuccessReadBody({ userId: '1', role: 'vorstand' })
+      authUtils.readUsers.mockResolvedValue([{ id: '1', role: 'mitglied' }])
+      authUtils.writeUsers.mockResolvedValue(true)
+
+      const response = await usersUpdateRoleHandler(event)
+      expect(response.success).toBe(true)
+      expect(authUtils.writeUsers).toHaveBeenCalled()
+    })
+  })
+})
diff --git a/tests/members-endpoints.spec.ts b/tests/members-endpoints.spec.ts
new file mode 100644
index 0000000..aefd63b
--- /dev/null
+++ b/tests/members-endpoints.spec.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEvent, mockSuccessReadBody } from './setup'
+
+vi.mock('../server/utils/auth.js', () => ({
+  verifyToken: vi.fn(),
+  getUserById: vi.fn(),
+  readUsers: vi.fn(),
+  readMembers: vi.fn(),
+  writeUsers: vi.fn(),
+  readSessions: vi.fn(),
+  writeSessions: vi.fn()
+}))
+
+vi.mock('../server/utils/members.js', () => ({
+  readMembers: vi.fn(),
+  writeMembers: vi.fn(),
+  saveMember: vi.fn(),
+  deleteMember: vi.fn(),
+  normalizeDate: vi.fn((value) => value)
+}))
+
+const authUtils = await import('../server/utils/auth.js')
+const memberUtils = await import('../server/utils/members.js')
+
+import membersGetHandler from '../server/api/members.get.js'
+import membersPostHandler from '../server/api/members.post.js'
+import membersDeleteHandler from '../server/api/members.delete.js'
+import membersBulkHandler from '../server/api/members/bulk.post.js'
+
+describe('Members API Endpoints', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('GET /api/members', () => {
+    it('verlangt Authentifizierung', async () => {
+      const event = createEvent()
+      await expect(membersGetHandler(event)).rejects.toMatchObject({ statusCode: 401 })
+    })
+
+    it('gibt zusammengeführte Mitglieder zurück', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      authUtils.verifyToken.mockReturnValue({ id: '1' })
+      memberUtils.readMembers.mockResolvedValue([
+        { id: 'm1', firstName: 'Anna', lastName: 'Muster', email: 'anna@club.de' }
+      ])
+      authUtils.readUsers.mockResolvedValue([
+        { id: 'u1', name: 'Ben Nutzer', email: 'ben@club.de', role: 'mitglied', active: true }
+      ])
+
+      const response = await membersGetHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(response.members).toHaveLength(2)
+    })
+  })
+
+  describe('POST /api/members', () => {
+    const baseBody = {
+      firstName: 'Lisa',
+      lastName: 'Beispiel',
+      geburtsdatum: '2000-01-01',
+      email: 'lisa@example.com'
+    }
+
+    it('verweigert Zugriff ohne Token', async () => {
+      const event = createEvent()
+      mockSuccessReadBody(baseBody)
+      await expect(membersPostHandler(event)).rejects.toMatchObject({ statusCode: 401 })
+    })
+
+    it('verlangt Admin- oder Vorstand-Rolle', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody(baseBody)
+      authUtils.verifyToken.mockReturnValue({ id: '2' })
+      authUtils.getUserById.mockResolvedValue({ id: '2', role: 'mitglied' })
+
+      await expect(membersPostHandler(event)).rejects.toMatchObject({ statusCode: 403 })
+    })
+
+    it('gibt 409 bei Duplikaten zurück', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody(baseBody)
+      authUtils.verifyToken.mockReturnValue({ id: '2' })
+      authUtils.getUserById.mockResolvedValue({ id: '2', role: 'admin' })
+      memberUtils.saveMember.mockRejectedValue(new Error('existiert bereits'))
+
+      await expect(membersPostHandler(event)).rejects.toMatchObject({ statusCode: 409 })
+    })
+
+    it('speichert Mitglied erfolgreich', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody(baseBody)
+      authUtils.verifyToken.mockReturnValue({ id: '2' })
+      authUtils.getUserById.mockResolvedValue({ id: '2', role: 'admin' })
+      memberUtils.saveMember.mockResolvedValue(true)
+
+      const response = await membersPostHandler(event)
+      expect(response.success).toBe(true)
+      expect(memberUtils.saveMember).toHaveBeenCalled()
+    })
+  })
+
+  describe('DELETE /api/members', () => {
+    it('validiert die ID', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody({})
+      authUtils.verifyToken.mockReturnValue({ id: '1' })
+      authUtils.getUserById.mockResolvedValue({ id: '1', role: 'admin' })
+
+      await expect(membersDeleteHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('löscht Mitglied erfolgreich', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody({ id: 'm1' })
+      authUtils.verifyToken.mockReturnValue({ id: '1' })
+      authUtils.getUserById.mockResolvedValue({ id: '1', role: 'vorstand' })
+      memberUtils.deleteMember.mockResolvedValue(true)
+
+      const response = await membersDeleteHandler(event)
+      expect(response.success).toBe(true)
+      expect(memberUtils.deleteMember).toHaveBeenCalledWith('m1')
+    })
+  })
+
+  describe('POST /api/members/bulk', () => {
+    const importBody = {
+      members: [
+        { firstName: 'Paul', lastName: 'Team', geburtsdatum: '2001-02-03' }
+      ]
+    }
+
+    it('validiert members-Array', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody({ members: [] })
+      authUtils.verifyToken.mockReturnValue({ id: '1' })
+      authUtils.getUserById.mockResolvedValue({ id: '1', role: 'admin' })
+
+      await expect(membersBulkHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('importiert Mitglieder und schreibt Datei', async () => {
+      const event = createEvent({ cookies: { auth_token: 'token' } })
+      mockSuccessReadBody(importBody)
+      authUtils.verifyToken.mockReturnValue({ id: '1' })
+      authUtils.getUserById.mockResolvedValue({ id: '1', role: 'admin' })
+      memberUtils.readMembers.mockResolvedValue([])
+      memberUtils.writeMembers.mockResolvedValue(true)
+
+      const response = await membersBulkHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(response.summary.imported).toBe(1)
+      expect(memberUtils.writeMembers).toHaveBeenCalled()
+    })
+  })
+})
diff --git a/tests/public-endpoints.spec.ts b/tests/public-endpoints.spec.ts
new file mode 100644
index 0000000..4eea5da
--- /dev/null
+++ b/tests/public-endpoints.spec.ts
@@ -0,0 +1,142 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEvent, mockSuccessReadBody } from './setup'
+import fsPromises from 'fs/promises'
+import { promises as fs } from 'fs'
+
+vi.mock('nodemailer', () => {
+  const sendMail = vi.fn().mockResolvedValue(true)
+  const createTransport = vi.fn(() => ({ sendMail }))
+  return {
+    default: { createTransport },
+    createTransport
+  }
+})
+
+vi.mock('../server/utils/news.js', () => ({
+  readNews: vi.fn()
+}))
+
+const nodemailer = await import('nodemailer')
+const newsUtils = await import('../server/utils/news.js')
+
+import contactHandler from '../server/api/contact.post.js'
+import galerieHandler from '../server/api/galerie.get.js'
+import newsPublicHandler from '../server/api/news-public.get.js'
+import termineHandler from '../server/api/termine.get.js'
+import spielplaeneHandler from '../server/api/spielplaene.get.js'
+
+describe('Öffentliche API-Endpunkte', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks()
+    vi.clearAllMocks()
+  })
+
+  describe('POST /api/contact', () => {
+    it('validiert Pflichtfelder', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({})
+
+      await expect(contactHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('validiert E-Mail-Adresse', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ name: 'Max', email: 'invalid', subject: 'Hi', message: 'Test' })
+
+      await expect(contactHandler(event)).rejects.toMatchObject({ statusCode: 400 })
+    })
+
+    it('sendet E-Mail bei gültigen Daten', async () => {
+      const event = createEvent()
+      mockSuccessReadBody({ name: 'Max', email: 'max@example.com', subject: 'Frage', message: 'Hallo' })
+
+      const response = await contactHandler(event)
+
+      expect(response.success).toBe(true)
+      expect(nodemailer.default.createTransport).toHaveBeenCalled()
+    })
+  })
+
+  describe('GET /api/galerie', () => {
+    it('liefert leeres Array, wenn Verzeichnis fehlt', async () => {
+      vi.spyOn(fs, 'access').mockRejectedValue(new Error('not found'))
+
+      const result = await galerieHandler(createEvent())
+      expect(result).toEqual([])
+    })
+
+    it('filtert nur Bilddateien', async () => {
+      vi.spyOn(fs, 'access').mockResolvedValue(undefined)
+      vi.spyOn(fs, 'readdir').mockResolvedValue(['foto-1.jpg', 'readme.md'])
+
+      const result = await galerieHandler(createEvent())
+      expect(result).toHaveLength(1)
+      expect(result[0].filename).toBe('foto-1.jpg')
+    })
+  })
+
+  describe('GET /api/news-public', () => {
+    it('filtert nicht öffentliche News', async () => {
+      const now = new Date()
+      newsUtils.readNews.mockResolvedValue([
+        { id: 1, isPublic: true, isHidden: false, created: now.toISOString(), title: 'ok' },
+        { id: 2, isPublic: false, isHidden: false, created: now.toISOString() },
+        { id: 3, isPublic: true, isHidden: true, created: now.toISOString() }
+      ])
+
+      const response = await newsPublicHandler(createEvent())
+      expect(response.success).toBe(true)
+      expect(response.news).toHaveLength(1)
+      expect(response.news[0].id).toBe(1)
+    })
+
+    it('begrenzt Ergebnis auf drei Einträge', async () => {
+      const now = Date.now()
+      newsUtils.readNews.mockResolvedValue(
+        Array.from({ length: 5 }).map((_, index) => ({
+          id: index + 1,
+          isPublic: true,
+          isHidden: false,
+          created: new Date(now - index * 1000).toISOString()
+        }))
+      )
+
+      const response = await newsPublicHandler(createEvent())
+      expect(response.news).toHaveLength(3)
+      expect(response.news[0].id).toBe(1)
+    })
+  })
+
+  describe('GET /api/termine', () => {
+    it('parst CSV-Dateien', async () => {
+      const csv = 'Datum,Uhrzeit,Titel,Beschreibung,Kategorie\n2025-01-01,19:00,Training,Beschreibung,Sport'
+      vi.spyOn(fsPromises, 'readFile').mockResolvedValue(csv)
+
+      const response = await termineHandler(createEvent())
+      expect(response.success).toBe(true)
+      expect(response.termine[0]).toMatchObject({ titel: 'Training', kategorie: 'Sport' })
+    })
+
+    it('gibt leeres Array bei Fehlern zurück', async () => {
+      vi.spyOn(fsPromises, 'readFile').mockRejectedValue(new Error('kaputt'))
+      const response = await termineHandler(createEvent())
+      expect(response.termine).toEqual([])
+    })
+  })
+
+  describe('GET /api/spielplaene', () => {
+    it('filtert nur erlaubte Dateitypen', async () => {
+      vi.spyOn(fs, 'access').mockResolvedValue(undefined)
+      vi.spyOn(fs, 'readdir').mockResolvedValue(['plan.pdf', 'notizen.txt'])
+
+      const result = await spielplaeneHandler(createEvent())
+      expect(result).toEqual(['plan.pdf'])
+    })
+
+    it('gibt leeres Array zurück, wenn Verzeichnis fehlt', async () => {
+      vi.spyOn(fs, 'access').mockRejectedValue(new Error('not found'))
+      const result = await spielplaeneHandler(createEvent())
+      expect(result).toEqual([])
+    })
+  })
+})
diff --git a/tests/setup.ts b/tests/setup.ts
new file mode 100644
index 0000000..aeb1454
--- /dev/null
+++ b/tests/setup.ts
@@ -0,0 +1,121 @@
+import { vi } from 'vitest'
+
+type CookieStore = Record<string, { value: string; options?: Record<string, any> }>
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __testCookies__: WeakMap<any, CookieStore>
+}
+
+if (!global.__testCookies__) {
+  global.__testCookies__ = new WeakMap()
+}
+
+const getCookieStore = (event: any): CookieStore => {
+  if (!global.__testCookies__.has(event)) {
+    global.__testCookies__.set(event, {})
+  }
+  return global.__testCookies__.get(event) as CookieStore
+}
+
+global.readBody = vi.fn(async (event: any) => event.__body ?? null)
+global.getQuery = (event: any) => event.__query ?? {}
+global.getHeader = (event: any, name: string) => {
+  const headers = event.node?.req?.headers || {}
+  const key = Object.keys(headers).find(h => h.toLowerCase() === name.toLowerCase())
+  return key ? headers[key] : undefined
+}
+
+global.setCookie = (event: any, name: string, value: string, options = {}) => {
+  const store = getCookieStore(event)
+  store[name] = { value, options }
+}
+
+global.getCookie = (event: any, name: string) => {
+  const store = getCookieStore(event)
+  return store[name]?.value ?? null
+}
+
+global.deleteCookie = (event: any, name: string) => {
+  const store = getCookieStore(event)
+  if (store[name]) {
+    delete store[name]
+  }
+}
+
+global.createError = ({ statusCode = 500, statusMessage, message }: any) => {
+  const error = new Error(statusMessage || message || 'Unbekannter Fehler')
+  error.name = 'H3Error'
+  // @ts-ignore
+  error.statusCode = statusCode
+  // @ts-ignore
+  error.statusMessage = statusMessage || message || 'Fehler'
+  return error
+}
+
+global.useRuntimeConfig = () => ({
+  encryptionKey: 'test-encryption-key',
+  smtp: {
+    host: 'localhost',
+    port: 1025,
+    user: 'test',
+    pass: 'pass'
+  },
+  membership: {
+    adminEmails: ['admin@test.local']
+  }
+})
+
+global.defineEventHandler = (handler: any) => handler
+
+export const createEvent = (overrides: Record<string, any> = {}) => {
+  const event = {
+    context: {},
+    node: {
+      req: {
+        headers: overrides.headers || {},
+        method: overrides.method || 'GET'
+      },
+      res: {
+        setHeader: vi.fn(),
+        getHeader: vi.fn(),
+        end: vi.fn(),
+        statusCode: 200
+      }
+    },
+    __body: overrides.body,
+    __query: overrides.query,
+    ...overrides
+  }
+
+  if (overrides.cookies) {
+    const store = getCookieStore(event)
+    Object.entries(overrides.cookies).forEach(([key, value]) => {
+      store[key] = { value: value as string }
+    })
+  }
+
+  return event
+}
+
+export const resetEventMocks = () => {
+  (global.readBody as any).mockClear()
+  global.__testCookies__ = new WeakMap()
+}
+
+export const expectError = async (fn: () => Promise<any>, statusCode: number) => {
+  try {
+    await fn()
+    throw new Error('Erwarteter Fehler wurde nicht ausgelöst')
+  } catch (error: any) {
+    expect(error.statusCode).toBe(statusCode)
+  }
+}
+
+export const mockSuccessReadBody = (payload: any) => {
+  (global.readBody as any).mockResolvedValue(payload)
+}
+
+beforeEach(() => {
+  resetEventMocks()
+})
diff --git a/vitest.config.ts b/vitest.config.ts
new file mode 100644
index 0000000..1d5013f
--- /dev/null
+++ b/vitest.config.ts
@@ -0,0 +1,14 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    setupFiles: ['./tests/setup.ts'],
+    coverage: {
+      provider: 'istanbul',
+      reporter: ['text', 'lcov'],
+      reportsDirectory: './coverage'
+    }
+  }
+})