TDD VERTICAL SLICE: OAuth2 Token Refresh

TRACER BULLET 1: END-TO-END TEST (Red)
Write test first, no implementation:

test('POST /auth/refresh returns new access token with valid refresh token', async () => {
  const refreshToken = 'old_refresh_token_expires_2026_08_31';
  const response = await client.post('/auth/refresh', { refreshToken });
  expect(response.status).toBe(200);
  expect(response.body.accessToken).toBeDefined();
  expect(response.body.expiresIn).toBe(3600);
});

Run test: FAILS (no POST /auth/refresh endpoint)

TRACER BULLET 2: MINIMAL IMPLEMENTATION (Green)
Write only enough code to pass test:

app.post('/auth/refresh', (req, res) => {
  res.json({ accessToken: 'dummy_token', expiresIn: 3600 });
});

Run test: PASSES (test is now green)

TRACER BULLET 3: ITERATE (Refactor)
Add next test for edge case:

test('POST /auth/refresh returns 401 with expired refresh token', async () => {
  const expiredToken = 'old_refresh_token_expires_2026_07_30';
  const response = await client.post('/auth/refresh', { refreshToken: expiredToken });
  expect(response.status).toBe(401);
  expect(response.body.error).toBe('Refresh token expired');
});

Run test: FAILS (token validation not implemented)

Add validation logic:

app.post('/auth/refresh', (req, res) => {
  const { refreshToken } = req.body;
  const decoded = jwt.verify(refreshToken, SECRET); // Throws if expired
  if (decoded.exp < Date.now() / 1000) {
    return res.status(401).json({ error: 'Refresh token expired' });
  }
  const newToken = jwt.sign({ userId: decoded.userId }, SECRET, { expiresIn: '1h' });
  res.json({ accessToken: newToken, expiresIn: 3600 });
});

Run test: PASSES

TRACER BULLET 4: NEXT VERTICAL SLICE
Don't build adjacent features yet (persistence layer, UI, etc.)
Instead, write next end-to-end test for next slice:

test('POST /auth/refresh increments token version (prevent replay attacks)', ...);
test('POST /auth/refresh logs revocation event to audit table', ...);

Each test spawns its own implementation. Build width (features) incrementally, not depth (layers).

WHY THIS WORKS
• Tests remain always-passing (no broken tests accruing)
• Each feature complete and tested before next starts
• No large refactors at the end (refactoring happens per-slice)
• Easy to show progress ("3 features passing" vs "infrastructure 80% done")

WHEN TO STOP SLICING
Stop when:
✓ All user-facing flows have passing tests
✓ Happy path + 2-3 error cases per feature
✓ No more than 20 lines per test function (if test >20 lines, feature too big)