Tracking module has no tests: click, pixel, and stats endpoints are uncovered

[nanaf6203-bit]

Tracking module has no tests: click, pixel, and stats endpoints are uncovered

Labels / Complexity: testing · Medium Complexity — Medium

Problem

src/tracking/ (3 files, 0 *.spec.ts) implements the click-redirect, email-open pixel, and stats endpoints — including the open-redirect (#53) and unauthenticated-stats (#54) defects. There are no tests for any endpoint, so nothing pins redirect behavior, pixel responses, or stats aggregation before the security fixes land.

Why this is architecturally hard

1. Tests must pin the security contract. With Implemented the Proper Configuration Management #53 and Implement Comprehensive Logging and Monitoring #54, tests should assert that external redirects are rejected and stats require auth — turning the fixes into a regression guard.
2. The endpoints are HTTP-shaped. Redirects, pixel headers, and stats bodies are best covered with an HTTP-level test (the test/e2e/ harness) rather than unit mocks.

Acceptance criteria

• Tests cover the click redirect (valid and rejected targets), the pixel response (headers and body), and stats aggregation.
• Tests run in CI via npm test.
• The PR reports the module's coverage change (npm run test:cov).

Out of scope

The security fixes themselves (#53, #54).

Getting started

• src/tracking/tracking.controller.ts — the endpoints
• test/e2e/ — the HTTP-level harness

Commands: npm test, npm run test:cov.

Good first files to read: src/tracking/tracking.controller.ts, test/e2e/analytics-date-range.spec.ts.