1 files changed, 13 insertions, 3 deletions
diff --git a/internal/handlers/widget_test.go b/internal/handlers/widget_test.go
index a82a070..ed9d941 100644
--- a/internal/handlers/widget_test.go
+++ b/internal/handlers/widget_test.go
@@ -1,7 +1,6 @@
 package handlers_test
 
 import (
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -123,5 +122,16 @@ func TestHandleWidgetComplete_NonTodoist(t *testing.T) {
 	}
 }
 
-// Ensure json import is used (WidgetResponse roundtrip sanity check).
-var _ = json.Marshal
+func TestWidgetAuthMiddleware_EmptyToken(t *testing.T) {
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+	h := handlers.WidgetAuthMiddleware("", inner)
+
+	req := httptest.NewRequest("GET", "/api/widget", nil)
+	req.Header.Set("Authorization", "Bearer ")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401 with empty token, got %d", w.Code)
+	}
+}