@aurabase/aurabase-js 0.3.0

package/packages/aurabase/tests/auth.test.ts

@@ -0,0 +1,947 @@
+// ---------------------------------------------------------------------------
+// AuthService tests
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { AuraClient } from '../src/AuraClient'
+import { BaseAuthStore } from '@aurabase/core'
+import { FetchMock, expiredJwt, fakeTokenPair, fakeUser, validJwt } from './mocks'
+
+const BASE = 'http://localhost:8080'
+const PROJECT = 'test-project'
+const PREFIX = `${BASE}/v1/auth/${PROJECT}`
+
+let fetchMock: FetchMock
+let client: AuraClient
+
+beforeEach(() => {
+  fetchMock = new FetchMock()
+  fetchMock.init()
+  client = new AuraClient(BASE, PROJECT, {
+    auth: { persistSession: false },
+  })
+})
+
+afterEach(() => {
+  fetchMock.restore()
+  fetchMock.clearMocks()
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signUp', () => {
+  it('saves tokens on successful registration', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/register`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.signUp({ email: 'a@b.com', password: 'secret' })
+
+    expect(res.error).toBeNull()
+    expect(res.data).toBeDefined()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
+    expect(client.authStore.user?.email).toBe('test@example.com')
+  })
+
+  it('returns error on 400', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/register`,
+      replyCode: 400,
+      replyBody: { error: { code: 'invalid_request', message: 'Email taken' } },
+    })
+
+    const res = await client.auth.signUp({ email: 'a@b.com', password: 'x' })
+
+    expect(res.error).toBeDefined()
+    expect(res.error!.code).toBe('invalid_request')
+    expect(client.authStore.token).toBeNull()
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithPassword', () => {
+  it('saves tokens on success', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/login`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.user?.id).toBe('user-1')
+  })
+
+  it('detects MFA challenge', async () => {
+    const mfa = { mfa_required: true, mfa_token: 'mfa_tok_123' }
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/login`,
+      replyCode: 200,
+      replyBody: { data: mfa },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange((payload) => {
+      events.push(payload.event)
+    })
+
+    const res = await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
+
+    expect(res.data).toBeDefined()
+    expect((res.data as any).mfa_required).toBe(true)
+    // Token should NOT be saved for MFA challenge
+    expect(client.authStore.token).toBeNull()
+    expect(events).toContain('MFA_CHALLENGE')
+  })
+
+  it('MFA_CHALLENGE porte mfaToken + mfaSetupRequired', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/login`,
+      replyCode: 200,
+      replyBody: { data: { mfa_required: true, mfa_token: 'MT', mfa_setup_required: true } },
+    })
+
+    const payloads: any[] = []
+    client.auth.onAuthStateChange((p) => payloads.push(p))
+
+    await client.auth.signInWithPassword({ email: 'e', password: 'p' })
+
+    const c = payloads.find((p) => p.event === 'MFA_CHALLENGE')
+    expect(c).toBeDefined()
+    expect(c.mfaToken).toBe('MT')
+    expect(c.mfaSetupRequired).toBe(true)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signOut', () => {
+  it('clears store on signOut', async () => {
+    // Pre-populate the store
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/logout`,
+      replyCode: 200,
+      replyBody: { data: null },
+    })
+
+    const res = await client.auth.signOut()
+
+    expect(res.error).toBeNull()
+    // LOT 3 (I5) : `logout` backend (`services/aura-auth/src/handlers/auth.rs::logout`)
+    // renvoie réellement `ApiResponse::<()>::empty()` — `fetch.ts` honore maintenant ce
+    // `null` explicite (`'data' in body`) au lieu de retomber sur l'enveloppe entière.
+    expect(res.data).toBeNull()
+    expect(client.authStore.token).toBeNull()
+    expect(client.authStore.refreshToken).toBeNull()
+    expect(client.authStore.user).toBeNull()
+  })
+
+  it('does not refresh before logout', async () => {
+    const tp = fakeTokenPair({ access_token: expiredJwt(), refresh_token: 'rt_old' })
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/logout`,
+      replyCode: 200,
+      replyBody: { data: null },
+    })
+
+    const res = await client.auth.signOut()
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls).toHaveLength(1)
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/logout`)
+    expect((fetchMock.calls[0].body as any).refresh_token).toBe('rt_old')
+  })
+
+  it('clears local store without network when no session exists', async () => {
+    const res = await client.auth.signOut()
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls).toHaveLength(0)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.refreshSession', () => {
+  it('updates store with new tokens', async () => {
+    const oldTp = fakeTokenPair()
+    client.authStore.save(oldTp.access_token, oldTp.refresh_token, oldTp.user)
+
+    const newTp = fakeTokenPair({
+      access_token: validJwt(),
+      refresh_token: 'rt_new',
+      user: fakeUser({ email: 'new@example.com' }),
+    })
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/refresh`,
+      replyCode: 200,
+      replyBody: { data: newTp },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange((p) => events.push(p.event))
+
+    const res = await client.auth.refreshSession()
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.refreshToken).toBe('rt_new')
+    expect(client.authStore.user?.email).toBe('new@example.com')
+    expect(events).toContain('TOKEN_REFRESHED')
+  })
+
+  it('returns a local error when no refresh token exists', async () => {
+    const res = await client.auth.refreshSession()
+
+    expect(res.data).toBeNull()
+    expect(res.error?.code).toBe('no_session')
+    expect(fetchMock.calls).toHaveLength(0)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.sessions', () => {
+  it('sends X-Refresh-Token when listing sessions', async () => {
+    const tp = fakeTokenPair({ refresh_token: 'rt_current' })
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/sessions`,
+      replyCode: 200,
+      replyBody: { data: [] },
+    })
+
+    const res = await client.auth.listSessions()
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].headers.get('x-refresh-token')).toBe('rt_current')
+  })
+
+  it('clears store after global revoke succeeds', async () => {
+    const tp = fakeTokenPair({ refresh_token: 'rt_global' })
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/logout`,
+      replyCode: 200,
+      replyBody: { data: null },
+    })
+
+    const res = await client.auth.revokeAllSessions()
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBeNull()
+    expect((fetchMock.calls[0].body as any).scope).toBe('global')
+    expect((fetchMock.calls[0].body as any).refresh_token).toBe('rt_global')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.getUser', () => {
+  it('returns user from /me endpoint', async () => {
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    const user = fakeUser({ email: 'me@example.com' })
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/user`,
+      replyCode: 200,
+      replyBody: { data: user },
+    })
+
+    const res = await client.auth.getUser()
+
+    expect(res.error).toBeNull()
+    expect(res.data?.email).toBe('me@example.com')
+  })
+
+  it('returns 401 when not authenticated', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/user`,
+      replyCode: 401,
+      replyBody: { error: { code: 'unauthorized', message: 'Not authenticated' } },
+    })
+
+    const res = await client.auth.getUser()
+
+    expect(res.error).toBeDefined()
+    expect(res.error!.code).toBe('unauthorized')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.onAuthStateChange', () => {
+  it('fires callback on sign in and sign out', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/login`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/logout`,
+      replyCode: 200,
+      replyBody: { data: null },
+    })
+
+    const events: string[] = []
+    const { unsubscribe } = client.auth.onAuthStateChange((p) => {
+      events.push(p.event)
+    })
+
+    await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
+    await client.auth.signOut()
+
+    expect(events).toContain('SIGNED_IN')
+    expect(events).toContain('SIGNED_OUT')
+
+    unsubscribe()
+  })
+
+  it('unsubscribe stops further events', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/login`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const events: string[] = []
+    const { unsubscribe } = client.auth.onAuthStateChange((p) => {
+      events.push(p.event)
+    })
+
+    await client.auth.signInWithPassword({ email: 'a@b.com', password: 'pass' })
+    expect(events.length).toBeGreaterThan(0)
+
+    const countBefore = events.length
+    unsubscribe()
+
+    // Manually trigger another change -- should not fire
+    client.authStore.clear()
+    expect(events.length).toBe(countBefore)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInAnonymously', () => {
+  it('saves anonymous session', async () => {
+    const tp = fakeTokenPair({
+      user: fakeUser({ is_anonymous: true, email: null }),
+    })
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/anonymous`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.signInAnonymously()
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.user?.is_anonymous).toBe(true)
+    expect(client.authStore.token).toBe(tp.access_token)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithMagicLink', () => {
+  it('sends POST /magic-link with email', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/magic-link`,
+      replyCode: 200,
+      replyBody: { data: { message: 'Magic link sent' } },
+    })
+
+    const res = await client.auth.signInWithMagicLink({ email: 'a@b.com' })
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/magic-link`)
+    expect(fetchMock.calls[0].method).toBe('POST')
+    expect((fetchMock.calls[0].body as any).email).toBe('a@b.com')
+  })
+
+  it('returns error on 400', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/magic-link`,
+      replyCode: 400,
+      replyBody: { error: { code: 'invalid_email', message: 'Invalid email' } },
+    })
+
+    const res = await client.auth.signInWithMagicLink({ email: 'bad' })
+
+    expect(res.error).toBeDefined()
+    expect(res.error!.code).toBe('invalid_email')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithOAuth', () => {
+  it('renvoie { url } et envoie redirect_uri (pas redirect_to)', async () => {
+    const { data, error } = await client.auth.signInWithOAuth('github', {
+      redirectTo: 'http://app/cb',
+    })
+    // No fetch call should be made — OAuth start is a redirect
+    expect(fetchMock.calls.length).toBe(0)
+    expect(error).toBeNull()
+    expect(data?.url).toContain('/oauth/github/start')
+    expect(data?.url).toContain('redirect_uri=')
+    expect(data?.url).not.toContain('redirect_to=')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithEmailOtp', () => {
+  it('sends POST /email-otp/send with email', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/email-otp/send`,
+      replyCode: 200,
+      replyBody: { data: { message: 'OTP sent' } },
+    })
+
+    const res = await client.auth.signInWithEmailOtp('otp@example.com')
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/email-otp/send`)
+    expect((fetchMock.calls[0].body as any).email).toBe('otp@example.com')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.verifyEmailOtp', () => {
+  it('saves tokens on success', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/email-otp/verify`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.verifyEmailOtp('otp@example.com', '123456')
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect((fetchMock.calls[0].body as any).email).toBe('otp@example.com')
+    expect((fetchMock.calls[0].body as any).code).toBe('123456')
+  })
+
+  it('returns error on invalid code', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/email-otp/verify`,
+      replyCode: 400,
+      replyBody: { error: { code: 'invalid_otp', message: 'Code invalide' } },
+    })
+
+    const res = await client.auth.verifyEmailOtp('otp@example.com', '000000')
+
+    expect(res.error).toBeDefined()
+    expect(res.error!.code).toBe('invalid_otp')
+    expect(client.authStore.token).toBeNull()
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithSmsOtp', () => {
+  it('sends POST /sms/send with phone', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/sms/send`,
+      replyCode: 200,
+      replyBody: { data: { message: 'SMS sent' } },
+    })
+
+    const res = await client.auth.signInWithSmsOtp('+33612345678')
+
+    expect(res.error).toBeNull()
+    expect((fetchMock.calls[0].body as any).phone).toBe('+33612345678')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.verifySmsOtp', () => {
+  it('saves tokens on success', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/sms/verify`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.verifySmsOtp('+33612345678', '654321')
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect((fetchMock.calls[0].body as any).phone).toBe('+33612345678')
+    expect((fetchMock.calls[0].body as any).code).toBe('654321')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.verifyEmail', () => {
+  it('saves tokens after email verification', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/verify-email`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.verifyEmail('verify-token-123')
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect((fetchMock.calls[0].body as any).token).toBe('verify-token-123')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.resendVerificationEmail', () => {
+  it('sends POST /resend-verification', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/resend-verification`,
+      replyCode: 200,
+      replyBody: { data: { message: 'Email sent' } },
+    })
+
+    const res = await client.auth.resendVerificationEmail('a@b.com')
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/resend-verification`)
+    expect((fetchMock.calls[0].body as any).email).toBe('a@b.com')
+  })
+
+  it('returns a local error when email is missing', async () => {
+    const res = await client.auth.resendVerificationEmail()
+
+    expect(res.data).toBeNull()
+    expect(res.error?.code).toBe('missing_email')
+    expect(fetchMock.calls).toHaveLength(0)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.updateUser', () => {
+  it('sends PUT /user with body and updates store', async () => {
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    const updatedUser = fakeUser({ email: 'updated@example.com' })
+    fetchMock.on({
+      method: 'PUT',
+      url: `${PREFIX}/user`,
+      replyCode: 200,
+      replyBody: { data: updatedUser },
+    })
+
+    const res = await client.auth.updateUser({ email: 'updated@example.com' })
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.user?.email).toBe('updated@example.com')
+    expect(fetchMock.calls[0].method).toBe('PUT')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.resetPasswordForEmail', () => {
+  it('sends POST /forgot-password with email', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/forgot-password`,
+      replyCode: 200,
+      replyBody: { data: { message: 'Email sent' } },
+    })
+
+    const res = await client.auth.resetPasswordForEmail({ email: 'reset@example.com' })
+
+    expect(res.error).toBeNull()
+    expect((fetchMock.calls[0].body as any).email).toBe('reset@example.com')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.updatePassword', () => {
+  it('sends PUT /user with password fields', async () => {
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    const updatedUser = fakeUser()
+    fetchMock.on({
+      method: 'PUT',
+      url: `${PREFIX}/user`,
+      replyCode: 200,
+      replyBody: { data: updatedUser },
+    })
+
+    const res = await client.auth.updatePassword('newpass123', 'oldpass')
+
+    expect(res.error).toBeNull()
+    expect((fetchMock.calls[0].body as any).password).toBe('newpass123')
+    expect((fetchMock.calls[0].body as any).current_password).toBe('oldpass')
+  })
+
+  it('réussi → clear store + SIGNED_OUT (le backend révoque toutes les sessions)', async () => {
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    fetchMock.on({
+      method: 'PUT',
+      url: `${PREFIX}/user`,
+      replyCode: 200,
+      replyBody: { data: fakeUser() },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange(({ event }) => {
+      if (event !== 'INITIAL_SESSION') events.push(event)
+    })
+
+    const res = await client.auth.updatePassword('New123!', 'Old123!')
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBeNull()
+    expect(client.authStore.refreshToken).toBeNull()
+    expect(events).toContain('SIGNED_OUT')
+  })
+
+  it('échec → ne déconnecte pas', async () => {
+    const tp = fakeTokenPair()
+    client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+
+    fetchMock.on({
+      method: 'PUT',
+      url: `${PREFIX}/user`,
+      replyCode: 400,
+      replyBody: { error: { code: 'invalid_password', message: 'Wrong current password' } },
+    })
+
+    const res = await client.auth.updatePassword('New123!', 'WrongOld')
+
+    expect(res.error).toBeDefined()
+    expect(client.authStore.token).toBe(tp.access_token)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.mfaEnroll', () => {
+  it('returns qr_code and secret', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/mfa/setup`,
+      replyCode: 200,
+      replyBody: { data: { qr_code: 'data:image/png;base64,abc', secret: 'JBSWY3DPEHPK3PXP' } },
+    })
+
+    const res = await client.auth.mfaEnroll()
+
+    expect(res.error).toBeNull()
+    expect((res.data as any).qr_code).toContain('data:image')
+    expect((res.data as any).secret).toBe('JBSWY3DPEHPK3PXP')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.mfaVerifySetup', () => {
+  it('returns recovery_codes', async () => {
+    const codes = ['AAAA-BBBB', 'CCCC-DDDD', 'EEEE-FFFF']
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/mfa/setup/verify`,
+      replyCode: 200,
+      replyBody: { data: { recovery_codes: codes } },
+    })
+
+    const res = await client.auth.mfaVerifySetup('123456')
+
+    expect(res.error).toBeNull()
+    expect((res.data as any).recovery_codes).toEqual(codes)
+    expect((fetchMock.calls[0].body as any).code).toBe('123456')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.mfaVerify', () => {
+  it('saves tokens after MFA verification', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/mfa/verify-login`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.mfaVerify({ mfa_token: 'mfa_tok', code: '654321' })
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.user?.id).toBe('user-1')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.mfaUnenroll', () => {
+  it('sends POST /mfa/disable with password', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/mfa/disable`,
+      replyCode: 200,
+      replyBody: { data: { message: 'MFA disabled' } },
+    })
+
+    const res = await client.auth.mfaUnenroll('mypassword')
+
+    expect(res.error).toBeNull()
+    expect((fetchMock.calls[0].body as any).password).toBe('mypassword')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.listIdentities', () => {
+  it('returns identity list', async () => {
+    const identities = [{ id: 'id-1', provider: 'google', provider_id: 'g123' }]
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/user/identities`,
+      replyCode: 200,
+      replyBody: { data: identities },
+    })
+
+    const res = await client.auth.listIdentities()
+
+    expect(res.error).toBeNull()
+    expect(res.data).toHaveLength(1)
+    expect(fetchMock.calls[0].method).toBe('GET')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.linkIdentity', () => {
+  it('sends POST to link provider', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/user/identities/link/github`,
+      replyCode: 200,
+      replyBody: { data: { url: 'https://github.com/login/oauth', provider: 'github' } },
+    })
+
+    const res = await client.auth.linkIdentity('github')
+
+    expect(res.error).toBeNull()
+    expect((res.data as any).provider).toBe('github')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.unlinkIdentity', () => {
+  it('sends DELETE to unlink identity', async () => {
+    fetchMock.on({
+      method: 'DELETE',
+      url: `${PREFIX}/user/identities/id-42`,
+      replyCode: 200,
+      replyBody: { data: { message: 'Unlinked' } },
+    })
+
+    const res = await client.auth.unlinkIdentity('id-42')
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('DELETE')
+    expect(fetchMock.calls[0].url).toContain('id-42')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.confirmEmailChange', () => {
+  it('sends POST with token', async () => {
+    const user = fakeUser({ email: 'newemail@example.com' })
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/user/confirm-email-change`,
+      replyCode: 200,
+      replyBody: { data: user },
+    })
+
+    const res = await client.auth.confirmEmailChange('change-token-abc')
+
+    expect(res.error).toBeNull()
+    expect((fetchMock.calls[0].body as any).token).toBe('change-token-abc')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.signInWithIdToken', () => {
+  it('saves tokens on native mobile sign-in', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/token`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const res = await client.auth.signInWithIdToken('google', 'google-id-token-abc')
+
+    expect(res.error).toBeNull()
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect((fetchMock.calls[0].body as any).provider).toBe('google')
+    expect((fetchMock.calls[0].body as any).id_token).toBe('google-id-token-abc')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.getSettings', () => {
+  it('sends GET /settings and returns the public settings', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/settings`,
+      replyCode: 200,
+      replyBody: {
+        data: {
+          disable_signup: false,
+          external: { google: true, github: false },
+          mailer_autoconfirm: true,
+          mfa_enabled: false,
+        },
+      },
+    })
+
+    const res = await client.auth.getSettings()
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('GET')
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/settings`)
+    expect(res.data?.disable_signup).toBe(false)
+    expect(res.data?.external).toEqual({ google: true, github: false })
+    expect(res.data?.mailer_autoconfirm).toBe(true)
+    expect(res.data?.mfa_enabled).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.getAnonKey', () => {
+  it('sends GET /anon-key and returns the anon key', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/anon-key`,
+      replyCode: 200,
+      replyBody: { data: { anon_key: 'anon-key-abc123' } },
+    })
+
+    const res = await client.auth.getAnonKey()
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('GET')
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/anon-key`)
+    expect(res.data?.anon_key).toBe('anon-key-abc123')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.resetPassword', () => {
+  it('sends POST /reset-password with token+password and saves tokens (SIGNED_IN)', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/reset-password`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange((p) => events.push(p.event))
+
+    const res = await client.auth.resetPassword('recovery-token-xyz', 'newSecret123')
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('POST')
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/reset-password`)
+    expect((fetchMock.calls[0].body as any).token).toBe('recovery-token-xyz')
+    expect((fetchMock.calls[0].body as any).password).toBe('newSecret123')
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
+    await Promise.resolve()
+    expect(events).toContain('SIGNED_IN')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.promoteAnonymous', () => {
+  it('sends POST /anonymous/promote with email+password and saves tokens (USER_UPDATED)', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/anonymous/promote`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange((p) => events.push(p.event))
+
+    const res = await client.auth.promoteAnonymous({ email: 'promo@example.com', password: 'secret123' })
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('POST')
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/anonymous/promote`)
+    expect((fetchMock.calls[0].body as any).email).toBe('promo@example.com')
+    expect((fetchMock.calls[0].body as any).password).toBe('secret123')
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
+    await Promise.resolve()
+    expect(events).toContain('USER_UPDATED')
+  })
+})
+
+// ---------------------------------------------------------------------------
+describe('AuthService.verifyMagicLink', () => {
+  it('sends POST /magic-link/verify with token and saves tokens (SIGNED_IN)', async () => {
+    const tp = fakeTokenPair()
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/magic-link/verify`,
+      replyCode: 200,
+      replyBody: { data: tp },
+    })
+
+    const events: string[] = []
+    client.auth.onAuthStateChange((p) => events.push(p.event))
+
+    const res = await client.auth.verifyMagicLink('magic-token-789')
+
+    expect(res.error).toBeNull()
+    expect(fetchMock.calls[0].method).toBe('POST')
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/magic-link/verify`)
+    expect((fetchMock.calls[0].body as any).token).toBe('magic-token-789')
+    expect(client.authStore.token).toBe(tp.access_token)
+    expect(client.authStore.refreshToken).toBe(tp.refresh_token)
+    await Promise.resolve()
+    expect(events).toContain('SIGNED_IN')
+  })
+})