Only “Alice” is rendered.

Only “Loading...” is rendered.

Both “Loading...” and “Alice” are rendered.

Nothing is rendered.

Nothing is logged.

"Effect runs" is logged once.

It crashes.

"Effect runs" is logged everytime count changes.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

It is safe because email and password are both checked in a single query.

It is secure as long as HTTPS is used.

It is vulnerable because user-controlled values are used directly in the query, allowing operators like $ne.

It correctly uses bcrypt under the hood.

Only “Alice” is rendered.

Only “Loading...” is rendered.

Both “Loading...” and “Alice” are rendered.

Nothing is rendered.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

It only checks the status code and ignores the body.

It checks that the route responds with status 201 and a body containing name:"Alice".

It cannot run unless the server is listening on a physical port.

It is a unit test that doesn’t touch the real API.