test: cover uncovered functions to meet coverage thresholdsHEADmain

- Server: root health route and malformed-JSON error middleware
- Client: status polling and start error paths where the error body is
  not JSON

Function coverage rises from 68.42% to 89.47%, satisfying the 70% gate.

2 files changed, 84 insertions, 0 deletions

diff --git a/tests/client/App.test.tsx b/tests/client/App.test.tsx
index 960f383..8586b13 100644
--- a/tests/client/App.test.tsx
+++ b/tests/client/App.test.tsx
@@ -119,4 +119,59 @@ describe('App', () => {
       screen.getByRole('button', { name: /sign in with digi-id/i })
     ).toBeInTheDocument();
   });
+
+  it('surfaces a status polling error when the error body is not JSON', async () => {
+    fetchMock
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          sessionId: 'session-4',
+          qrCodeDataUrl: 'data:image/png;base64,qr',
+        }),
+      })
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 500,
+        json: async () => {
+          throw new Error('not json');
+        },
+      });
+
+    render(<App />);
+    fireEvent.click(
+      screen.getByRole('button', { name: /sign in with digi-id/i })
+    );
+
+    await waitFor(
+      () => {
+        expect(
+          screen.getByText(/status polling failed: error fetching status/i)
+        ).toBeInTheDocument();
+      },
+      { timeout: 4000 }
+    );
+  });
+
+  it('uses a fallback message when the start error body is not JSON', async () => {
+    fetchMock.mockResolvedValueOnce({
+      ok: false,
+      status: 503,
+      json: async () => {
+        throw new Error('not json');
+      },
+    });
+
+    render(<App />);
+    fireEvent.click(
+      screen.getByRole('button', { name: /sign in with digi-id/i })
+    );
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(
+          /failed to initiate digi-id: failed to start session\. server responded with status: 503/i
+        )
+      ).toBeInTheDocument();
+    });
+  });
 });
diff --git a/tests/server/main.test.ts b/tests/server/main.test.ts
index 0a5aee3..225a450 100644
--- a/tests/server/main.test.ts
+++ b/tests/server/main.test.ts
@@ -189,4 +189,33 @@ describe('server api', () => {
     expect(status.statusCode).toBe(404);
     expect(statusBody.status).toBe('not_found');
   });
+
+  it('serves a health message on the root route', async () => {
+    const app = createApp({
+      publicUrl: 'http://localhost:3001',
+      nodeEnv: 'test',
+    });
+
+    const response = await inject(app, { method: 'GET', url: '/' });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.body).toContain('DigiID Demo Backend Running!');
+  });
+
+  it('returns 500 when the request body is malformed JSON', async () => {
+    const app = createApp({
+      publicUrl: 'http://localhost:3001',
+      nodeEnv: 'test',
+    });
+
+    const response = await inject(app, {
+      method: 'POST',
+      url: '/api/digiid/callback',
+      headers: { 'content-type': 'application/json' },
+      payload: '{"address": ',
+    });
+
+    expect(response.statusCode).toBe(500);
+    expect(response.json().error).toBe('Internal server error');
+  });
 });