While using Sinon.JS makes our tests neater, they still depend on the details of the Express middleware API and how we're using it. This might be appropriate for our middleware module as we want to ensure that it fulfills a particular contract (especially calling next and setting request.user). For most middleware, though, especially our routes, this approach would couple our tests too closely to our implementation.

It would be better to test the actual behavior of each route by making HTTP requests to it and examining the responses, rather than checking for specific low-level interactions with the request and response objects. This gives us more flexibility to change our implementation and refactor our code, without needing to change the tests. Thus, our tests can support this process (by catching regressions) rather than hindering it (by having to be updated to match our implementation).

On other platforms, testing a whole application can be quite a heavyweight...