@aurabase/aurabase-js 0.3.0 → 0.3.1

package/packages/aurabase/tests/auth.test.ts

@@ -1,947 +0,0 @@
-// ---------------------------------------------------------------------------
-// AuthService tests
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { AuraClient } from '../src/AuraClient'
-import { BaseAuthStore } from '@aurabase/core'
-import { FetchMock, expiredJwt, fakeTokenPair, fakeUser, validJwt } from './mocks'
-
-const BASE = 'http://localhost:8080'
-const PROJECT = 'test-project'
-const PREFIX = `${BASE}/v1/auth/${PROJECT}`
-
-let fetchMock: FetchMock
-let client: AuraClient
-
-beforeEach(() => {
-  fetchMock = new FetchMock()
-  fetchMock.init()
-  client = new AuraClient(BASE, PROJECT, {
-    auth: { persistSession: false },
-  })
-})
-
-afterEach(() => {
-  fetchMock.restore()
-  fetchMock.clearMocks()
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signUp', () => {
-  it('saves tokens on successful registration', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/register`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.signUp({ email: 'a@b.com', password: 'secret' })
-
-    expect(res.error).toBeNull()
-    expect(res.data).toBeDefined()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
-    expect(client.authStore.user?.email).toBe('test@example.com')
-  })
-
-  it('returns error on 400', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/register`,
-      replyCode: 400,
-      replyBody: { error: { code: 'invalid_request', message: 'Email taken' } },
-    })
-
-    const res = await client.auth.signUp({ email: 'a@b.com', password: 'x' })
-
-    expect(res.error).toBeDefined()
-    expect(res.error!.code).toBe('invalid_request')
-    expect(client.authStore.token).toBeNull()
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithPassword', () => {
-  it('saves tokens on success', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.user?.id).toBe('user-1')
-  })
-
-  it('detects MFA challenge', async () => {
-    const mfa = { mfa_required: true, mfa_token: 'mfa_tok_123' }
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 200,
-      replyBody: { data: mfa },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange((payload) => {
-      events.push(payload.event)
-    })
-
-    const res = await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
-
-    expect(res.data).toBeDefined()
-    expect((res.data as any).mfa_required).toBe(true)
-    // Token should NOT be saved for MFA challenge
-    expect(client.authStore.token).toBeNull()
-    expect(events).toContain('MFA_CHALLENGE')
-  })
-
-  it('MFA_CHALLENGE porte mfaToken + mfaSetupRequired', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 200,
-      replyBody: { data: { mfa_required: true, mfa_token: 'MT', mfa_setup_required: true } },
-    })
-
-    const payloads: any[] = []
-    client.auth.onAuthStateChange((p) => payloads.push(p))
-
-    await client.auth.signInWithPassword({ email: 'e', password: 'p' })
-
-    const c = payloads.find((p) => p.event === 'MFA_CHALLENGE')
-    expect(c).toBeDefined()
-    expect(c.mfaToken).toBe('MT')
-    expect(c.mfaSetupRequired).toBe(true)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signOut', () => {
-  it('clears store on signOut', async () => {
-    // Pre-populate the store
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/logout`,
-      replyCode: 200,
-      replyBody: { data: null },
-    })
-
-    const res = await client.auth.signOut()
-
-    expect(res.error).toBeNull()
-    // LOT 3 (I5) : `logout` backend (`services/aura-auth/src/handlers/auth.rs::logout`)
-    // renvoie réellement `ApiResponse::<()>::empty()` — `fetch.ts` honore maintenant ce
-    // `null` explicite (`'data' in body`) au lieu de retomber sur l'enveloppe entière.
-    expect(res.data).toBeNull()
-    expect(client.authStore.token).toBeNull()
-    expect(client.authStore.refreshToken).toBeNull()
-    expect(client.authStore.user).toBeNull()
-  })
-
-  it('does not refresh before logout', async () => {
-    const tp = fakeTokenPair({ access_token: expiredJwt(), refresh_token: 'rt_old' })
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/logout`,
-      replyCode: 200,
-      replyBody: { data: null },
-    })
-
-    const res = await client.auth.signOut()
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls).toHaveLength(1)
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/logout`)
-    expect((fetchMock.calls[0].body as any).refresh_token).toBe('rt_old')
-  })
-
-  it('clears local store without network when no session exists', async () => {
-    const res = await client.auth.signOut()
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls).toHaveLength(0)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.refreshSession', () => {
-  it('updates store with new tokens', async () => {
-    const oldTp = fakeTokenPair()
-    client.authStore.save(oldTp.access_token, oldTp.refresh_token, oldTp.user)
-
-    const newTp = fakeTokenPair({
-      access_token: validJwt(),
-      refresh_token: 'rt_new',
-      user: fakeUser({ email: 'new@example.com' }),
-    })
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/refresh`,
-      replyCode: 200,
-      replyBody: { data: newTp },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange((p) => events.push(p.event))
-
-    const res = await client.auth.refreshSession()
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.refreshToken).toBe('rt_new')
-    expect(client.authStore.user?.email).toBe('new@example.com')
-    expect(events).toContain('TOKEN_REFRESHED')
-  })
-
-  it('returns a local error when no refresh token exists', async () => {
-    const res = await client.auth.refreshSession()
-
-    expect(res.data).toBeNull()
-    expect(res.error?.code).toBe('no_session')
-    expect(fetchMock.calls).toHaveLength(0)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.sessions', () => {
-  it('sends X-Refresh-Token when listing sessions', async () => {
-    const tp = fakeTokenPair({ refresh_token: 'rt_current' })
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/sessions`,
-      replyCode: 200,
-      replyBody: { data: [] },
-    })
-
-    const res = await client.auth.listSessions()
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].headers.get('x-refresh-token')).toBe('rt_current')
-  })
-
-  it('clears store after global revoke succeeds', async () => {
-    const tp = fakeTokenPair({ refresh_token: 'rt_global' })
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/logout`,
-      replyCode: 200,
-      replyBody: { data: null },
-    })
-
-    const res = await client.auth.revokeAllSessions()
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBeNull()
-    expect((fetchMock.calls[0].body as any).scope).toBe('global')
-    expect((fetchMock.calls[0].body as any).refresh_token).toBe('rt_global')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.getUser', () => {
-  it('returns user from /me endpoint', async () => {
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    const user = fakeUser({ email: 'me@example.com' })
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/user`,
-      replyCode: 200,
-      replyBody: { data: user },
-    })
-
-    const res = await client.auth.getUser()
-
-    expect(res.error).toBeNull()
-    expect(res.data?.email).toBe('me@example.com')
-  })
-
-  it('returns 401 when not authenticated', async () => {
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/user`,
-      replyCode: 401,
-      replyBody: { error: { code: 'unauthorized', message: 'Not authenticated' } },
-    })
-
-    const res = await client.auth.getUser()
-
-    expect(res.error).toBeDefined()
-    expect(res.error!.code).toBe('unauthorized')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.onAuthStateChange', () => {
-  it('fires callback on sign in and sign out', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/logout`,
-      replyCode: 200,
-      replyBody: { data: null },
-    })
-
-    const events: string[] = []
-    const { unsubscribe } = client.auth.onAuthStateChange((p) => {
-      events.push(p.event)
-    })
-
-    await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
-    await client.auth.signOut()
-
-    expect(events).toContain('SIGNED_IN')
-    expect(events).toContain('SIGNED_OUT')
-
-    unsubscribe()
-  })
-
-  it('unsubscribe stops further events', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const events: string[] = []
-    const { unsubscribe } = client.auth.onAuthStateChange((p) => {
-      events.push(p.event)
-    })
-
-    await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
-    expect(events.length).toBeGreaterThan(0)
-
-    const countBefore = events.length
-    unsubscribe()
-
-    // Manually trigger another change -- should not fire
-    client.authStore.clear()
-    expect(events.length).toBe(countBefore)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInAnonymously', () => {
-  it('saves anonymous session', async () => {
-    const tp = fakeTokenPair({
-      user: fakeUser({ is_anonymous: true, email: null }),
-    })
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/anonymous`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.signInAnonymously()
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.user?.is_anonymous).toBe(true)
-    expect(client.authStore.token).toBe(tp.access_token)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithMagicLink', () => {
-  it('sends POST /magic-link with email', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/magic-link`,
-      replyCode: 200,
-      replyBody: { data: { message: 'Magic link sent' } },
-    })
-
-    const res = await client.auth.signInWithMagicLink({ email: 'a@b.com' })
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/magic-link`)
-    expect(fetchMock.calls[0].method).toBe('POST')
-    expect((fetchMock.calls[0].body as any).email).toBe('a@b.com')
-  })
-
-  it('returns error on 400', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/magic-link`,
-      replyCode: 400,
-      replyBody: { error: { code: 'invalid_email', message: 'Invalid email' } },
-    })
-
-    const res = await client.auth.signInWithMagicLink({ email: 'bad' })
-
-    expect(res.error).toBeDefined()
-    expect(res.error!.code).toBe('invalid_email')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithOAuth', () => {
-  it('renvoie { url } et envoie redirect_uri (pas redirect_to)', async () => {
-    const { data, error } = await client.auth.signInWithOAuth('github', {
-      redirectTo: 'http://app/cb',
-    })
-    // No fetch call should be made — OAuth start is a redirect
-    expect(fetchMock.calls.length).toBe(0)
-    expect(error).toBeNull()
-    expect(data?.url).toContain('/oauth/github/start')
-    expect(data?.url).toContain('redirect_uri=')
-    expect(data?.url).not.toContain('redirect_to=')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithEmailOtp', () => {
-  it('sends POST /email-otp/send with email', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/email-otp/send`,
-      replyCode: 200,
-      replyBody: { data: { message: 'OTP sent' } },
-    })
-
-    const res = await client.auth.signInWithEmailOtp('otp@example.com')
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/email-otp/send`)
-    expect((fetchMock.calls[0].body as any).email).toBe('otp@example.com')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.verifyEmailOtp', () => {
-  it('saves tokens on success', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/email-otp/verify`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.verifyEmailOtp('otp@example.com', '123456')
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect((fetchMock.calls[0].body as any).email).toBe('otp@example.com')
-    expect((fetchMock.calls[0].body as any).code).toBe('123456')
-  })
-
-  it('returns error on invalid code', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/email-otp/verify`,
-      replyCode: 400,
-      replyBody: { error: { code: 'invalid_otp', message: 'Code invalide' } },
-    })
-
-    const res = await client.auth.verifyEmailOtp('otp@example.com', '000000')
-
-    expect(res.error).toBeDefined()
-    expect(res.error!.code).toBe('invalid_otp')
-    expect(client.authStore.token).toBeNull()
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithSmsOtp', () => {
-  it('sends POST /sms/send with phone', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/sms/send`,
-      replyCode: 200,
-      replyBody: { data: { message: 'SMS sent' } },
-    })
-
-    const res = await client.auth.signInWithSmsOtp('+33612345678')
-
-    expect(res.error).toBeNull()
-    expect((fetchMock.calls[0].body as any).phone).toBe('+33612345678')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.verifySmsOtp', () => {
-  it('saves tokens on success', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/sms/verify`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.verifySmsOtp('+33612345678', '654321')
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect((fetchMock.calls[0].body as any).phone).toBe('+33612345678')
-    expect((fetchMock.calls[0].body as any).code).toBe('654321')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.verifyEmail', () => {
-  it('saves tokens after email verification', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/verify-email`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.verifyEmail('verify-token-123')
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect((fetchMock.calls[0].body as any).token).toBe('verify-token-123')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.resendVerificationEmail', () => {
-  it('sends POST /resend-verification', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/resend-verification`,
-      replyCode: 200,
-      replyBody: { data: { message: 'Email sent' } },
-    })
-
-    const res = await client.auth.resendVerificationEmail('a@b.com')
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/resend-verification`)
-    expect((fetchMock.calls[0].body as any).email).toBe('a@b.com')
-  })
-
-  it('returns a local error when email is missing', async () => {
-    const res = await client.auth.resendVerificationEmail()
-
-    expect(res.data).toBeNull()
-    expect(res.error?.code).toBe('missing_email')
-    expect(fetchMock.calls).toHaveLength(0)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.updateUser', () => {
-  it('sends PUT /user with body and updates store', async () => {
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    const updatedUser = fakeUser({ email: 'updated@example.com' })
-    fetchMock.on({
-      method: 'PUT',
-      url: `${PREFIX}/user`,
-      replyCode: 200,
-      replyBody: { data: updatedUser },
-    })
-
-    const res = await client.auth.updateUser({ email: 'updated@example.com' })
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.user?.email).toBe('updated@example.com')
-    expect(fetchMock.calls[0].method).toBe('PUT')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.resetPasswordForEmail', () => {
-  it('sends POST /forgot-password with email', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/forgot-password`,
-      replyCode: 200,
-      replyBody: { data: { message: 'Email sent' } },
-    })
-
-    const res = await client.auth.resetPasswordForEmail({ email: 'reset@example.com' })
-
-    expect(res.error).toBeNull()
-    expect((fetchMock.calls[0].body as any).email).toBe('reset@example.com')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.updatePassword', () => {
-  it('sends PUT /user with password fields', async () => {
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    const updatedUser = fakeUser()
-    fetchMock.on({
-      method: 'PUT',
-      url: `${PREFIX}/user`,
-      replyCode: 200,
-      replyBody: { data: updatedUser },
-    })
-
-    const res = await client.auth.updatePassword('newpass123', 'oldpass')
-
-    expect(res.error).toBeNull()
-    expect((fetchMock.calls[0].body as any).password).toBe('newpass123')
-    expect((fetchMock.calls[0].body as any).current_password).toBe('oldpass')
-  })
-
-  it('réussi → clear store + SIGNED_OUT (le backend révoque toutes les sessions)', async () => {
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    fetchMock.on({
-      method: 'PUT',
-      url: `${PREFIX}/user`,
-      replyCode: 200,
-      replyBody: { data: fakeUser() },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange(({ event }) => {
-      if (event !== 'INITIAL_SESSION') events.push(event)
-    })
-
-    const res = await client.auth.updatePassword('New123!', 'Old123!')
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBeNull()
-    expect(client.authStore.refreshToken).toBeNull()
-    expect(events).toContain('SIGNED_OUT')
-  })
-
-  it('échec → ne déconnecte pas', async () => {
-    const tp = fakeTokenPair()
-    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-
-    fetchMock.on({
-      method: 'PUT',
-      url: `${PREFIX}/user`,
-      replyCode: 400,
-      replyBody: { error: { code: 'invalid_password', message: 'Wrong current password' } },
-    })
-
-    const res = await client.auth.updatePassword('New123!', 'WrongOld')
-
-    expect(res.error).toBeDefined()
-    expect(client.authStore.token).toBe(tp.access_token)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.mfaEnroll', () => {
-  it('returns qr_code and secret', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/mfa/setup`,
-      replyCode: 200,
-      replyBody: { data: { qr_code: 'data:image/png;base64,abc', secret: 'JBSWY3DPEHPK3PXP' } },
-    })
-
-    const res = await client.auth.mfaEnroll()
-
-    expect(res.error).toBeNull()
-    expect((res.data as any).qr_code).toContain('data:image')
-    expect((res.data as any).secret).toBe('JBSWY3DPEHPK3PXP')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.mfaVerifySetup', () => {
-  it('returns recovery_codes', async () => {
-    const codes = ['AAAA-BBBB', 'CCCC-DDDD', 'EEEE-FFFF']
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/mfa/setup/verify`,
-      replyCode: 200,
-      replyBody: { data: { recovery_codes: codes } },
-    })
-
-    const res = await client.auth.mfaVerifySetup('123456')
-
-    expect(res.error).toBeNull()
-    expect((res.data as any).recovery_codes).toEqual(codes)
-    expect((fetchMock.calls[0].body as any).code).toBe('123456')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.mfaVerify', () => {
-  it('saves tokens after MFA verification', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/mfa/verify-login`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.mfaVerify({ mfa_token: 'mfa_tok', code: '654321' })
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.user?.id).toBe('user-1')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.mfaUnenroll', () => {
-  it('sends POST /mfa/disable with password', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/mfa/disable`,
-      replyCode: 200,
-      replyBody: { data: { message: 'MFA disabled' } },
-    })
-
-    const res = await client.auth.mfaUnenroll('mypassword')
-
-    expect(res.error).toBeNull()
-    expect((fetchMock.calls[0].body as any).password).toBe('mypassword')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.listIdentities', () => {
-  it('returns identity list', async () => {
-    const identities = [{ id: 'id-1', provider: 'google', provider_id: 'g123' }]
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/user/identities`,
-      replyCode: 200,
-      replyBody: { data: identities },
-    })
-
-    const res = await client.auth.listIdentities()
-
-    expect(res.error).toBeNull()
-    expect(res.data).toHaveLength(1)
-    expect(fetchMock.calls[0].method).toBe('GET')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.linkIdentity', () => {
-  it('sends POST to link provider', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/user/identities/link/github`,
-      replyCode: 200,
-      replyBody: { data: { url: 'https://github.com/login/oauth', provider: 'github' } },
-    })
-
-    const res = await client.auth.linkIdentity('github')
-
-    expect(res.error).toBeNull()
-    expect((res.data as any).provider).toBe('github')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.unlinkIdentity', () => {
-  it('sends DELETE to unlink identity', async () => {
-    fetchMock.on({
-      method: 'DELETE',
-      url: `${PREFIX}/user/identities/id-42`,
-      replyCode: 200,
-      replyBody: { data: { message: 'Unlinked' } },
-    })
-
-    const res = await client.auth.unlinkIdentity('id-42')
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('DELETE')
-    expect(fetchMock.calls[0].url).toContain('id-42')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.confirmEmailChange', () => {
-  it('sends POST with token', async () => {
-    const user = fakeUser({ email: 'newemail@example.com' })
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/user/confirm-email-change`,
-      replyCode: 200,
-      replyBody: { data: user },
-    })
-
-    const res = await client.auth.confirmEmailChange('change-token-abc')
-
-    expect(res.error).toBeNull()
-    expect((fetchMock.calls[0].body as any).token).toBe('change-token-abc')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.signInWithIdToken', () => {
-  it('saves tokens on native mobile sign-in', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/token`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const res = await client.auth.signInWithIdToken('google', 'google-id-token-abc')
-
-    expect(res.error).toBeNull()
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect((fetchMock.calls[0].body as any).provider).toBe('google')
-    expect((fetchMock.calls[0].body as any).id_token).toBe('google-id-token-abc')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.getSettings', () => {
-  it('sends GET /settings and returns the public settings', async () => {
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/settings`,
-      replyCode: 200,
-      replyBody: {
-        data: {
-          disable_signup: false,
-          external: { google: true, github: false },
-          mailer_autoconfirm: true,
-          mfa_enabled: false,
-        },
-      },
-    })
-
-    const res = await client.auth.getSettings()
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('GET')
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/settings`)
-    expect(res.data?.disable_signup).toBe(false)
-    expect(res.data?.external).toEqual({ google: true, github: false })
-    expect(res.data?.mailer_autoconfirm).toBe(true)
-    expect(res.data?.mfa_enabled).toBe(false)
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.getAnonKey', () => {
-  it('sends GET /anon-key and returns the anon key', async () => {
-    fetchMock.on({
-      method: 'GET',
-      url: `${PREFIX}/anon-key`,
-      replyCode: 200,
-      replyBody: { data: { anon_key: 'anon-key-abc123' } },
-    })
-
-    const res = await client.auth.getAnonKey()
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('GET')
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/anon-key`)
-    expect(res.data?.anon_key).toBe('anon-key-abc123')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.resetPassword', () => {
-  it('sends POST /reset-password with token+password and saves tokens (SIGNED_IN)', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/reset-password`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange((p) => events.push(p.event))
-
-    const res = await client.auth.resetPassword('recovery-token-xyz', 'newSecret123')
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('POST')
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/reset-password`)
-    expect((fetchMock.calls[0].body as any).token).toBe('recovery-token-xyz')
-    expect((fetchMock.calls[0].body as any).password).toBe('newSecret123')
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
-    await Promise.resolve()
-    expect(events).toContain('SIGNED_IN')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.promoteAnonymous', () => {
-  it('sends POST /anonymous/promote with email+password and saves tokens (USER_UPDATED)', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/anonymous/promote`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange((p) => events.push(p.event))
-
-    const res = await client.auth.promoteAnonymous({ email: 'promo@example.com', password: 'secret123' })
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('POST')
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/anonymous/promote`)
-    expect((fetchMock.calls[0].body as any).email).toBe('promo@example.com')
-    expect((fetchMock.calls[0].body as any).password).toBe('secret123')
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
-    await Promise.resolve()
-    expect(events).toContain('USER_UPDATED')
-  })
-})
-
-// ---------------------------------------------------------------------------
-describe('AuthService.verifyMagicLink', () => {
-  it('sends POST /magic-link/verify with token and saves tokens (SIGNED_IN)', async () => {
-    const tp = fakeTokenPair()
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/magic-link/verify`,
-      replyCode: 200,
-      replyBody: { data: tp },
-    })
-
-    const events: string[] = []
-    client.auth.onAuthStateChange((p) => events.push(p.event))
-
-    const res = await client.auth.verifyMagicLink('magic-token-789')
-
-    expect(res.error).toBeNull()
-    expect(fetchMock.calls[0].method).toBe('POST')
-    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/magic-link/verify`)
-    expect((fetchMock.calls[0].body as any).token).toBe('magic-token-789')
-    expect(client.authStore.token).toBe(tp.access_token)
-    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
-    await Promise.resolve()
-    expect(events).toContain('SIGNED_IN')
-  })
-})