Auth regression tests for CI: what to assert and why

Most teams I have worked with have one auth test in their suite. It looks like this: test ( ' valid token verifies ' , () => { const token = signSync ({ sub : ' user-1 ' , aud : ' api://backend ' }, secret ); const result = verify ( token , options ); expect ( result . valid ). toBe ( true ); }); That test is fine. It is also a smoke test, not a regression suite. It catches the case where verification is completely broken. It does not catch the case where verification accepts tokens that should