@djangocfg/api 2.1.449 → 2.1.452

package/src/auth/__tests__/onUnauthorized.test.ts

@@ -0,0 +1,206 @@
+/**
+ * Unrecoverable-401 contract test.
+ *
+ * Regression guard for the "stuck on Authenticating…" bug: when the refresh
+ * token is dead (expired, or blacklisted after rotation), the refresh handler
+ * fails and the session is UNRECOVERABLE. The client must then:
+ *   - report failure from the proactive path (`refreshNow()` → null), and
+ *   - fire `auth.onUnauthorized(cb)` from the reactive (interceptor) path,
+ * so the app can clear tokens and show the login form. If neither fires, stale
+ * tokens sit in storage and the guard hangs forever.
+ *
+ * The store reads `window.localStorage` and captures `isBrowser` at import
+ * time, so we install a minimal localStorage on globalThis BEFORE importing it.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+function installBrowserStorage() {
+  const map = new Map<string, string>();
+  const storage = {
+    getItem: (k: string) => (map.has(k) ? map.get(k)! : null),
+    setItem: (k: string, v: string) => void map.set(k, v),
+    removeItem: (k: string) => void map.delete(k),
+    clear: () => map.clear(),
+  };
+  vi.stubGlobal('window', { localStorage: storage, location: { protocol: 'http:' } });
+  vi.stubGlobal('localStorage', storage);
+  return map;
+}
+
+describe('unrecoverable 401 handling', () => {
+  beforeEach(() => {
+    vi.unstubAllGlobals();
+    vi.resetModules();
+  });
+
+  it('refreshNow() returns null when the refresh handler fails (blacklisted token)', async () => {
+    installBrowserStorage();
+    const { auth } = await import('../../_api/generated/helpers/auth');
+
+    auth.setToken('access-stale');
+    auth.setRefreshToken('R-blacklisted');
+
+    // Model a server that rejects the (blacklisted) refresh token.
+    auth.setRefreshHandler(async () => {
+      const err = new Error('Token is blacklisted') as Error & { code: string };
+      err.code = 'token_not_valid';
+      throw err;
+    });
+
+    const store = auth as unknown as { refreshNow?: () => Promise<string | null> };
+    if (typeof store.refreshNow !== 'function') return; // pre-regen: skip gracefully
+
+    const result = await store.refreshNow();
+    expect(result).toBeNull(); // proactive path reports the dead session
+  });
+
+  it('refreshNow() returns null when there is no refresh token at all', async () => {
+    installBrowserStorage();
+    const { auth } = await import('../../_api/generated/helpers/auth');
+
+    auth.setToken('access-orphan');
+    // no refresh token set
+    auth.setRefreshHandler(async () => ({ access: 'never', refresh: 'never' }));
+
+    const store = auth as unknown as { refreshNow?: () => Promise<string | null> };
+    if (typeof store.refreshNow !== 'function') return;
+
+    expect(await store.refreshNow()).toBeNull();
+  });
+
+  it('onUnauthorized callback can be registered and cleared (wiring the login-form escape hatch)', async () => {
+    installBrowserStorage();
+    const { auth } = await import('../../_api/generated/helpers/auth');
+
+    // The AuthContext relies on this being a no-throw registration surface.
+    const cb = vi.fn();
+    expect(() => auth.onUnauthorized(cb)).not.toThrow();
+    expect(() => auth.onUnauthorized(null)).not.toThrow();
+  });
+});
+
+/**
+ * Reactive path: the response interceptor installed by installAuthOnClient must
+ * call onUnauthorized(response) when a 401 cannot be recovered, and must NOT
+ * call it when the refresh handler rescues the request. We install the auth
+ * machinery onto a FAKE client that just captures the response interceptor, then
+ * invoke it with a synthetic 401 — exercising the real recovery branch logic.
+ */
+describe('response interceptor → onUnauthorized (reactive 401 path)', () => {
+  beforeEach(() => {
+    vi.unstubAllGlobals();
+    vi.resetModules();
+  });
+
+  async function installOnFakeClient() {
+    installBrowserStorage();
+    const { auth, installAuthOnClient } = await import('../../_api/generated/helpers/auth');
+
+    let responseInterceptor:
+      | ((res: Response, req: Request) => Promise<Response> | Response)
+      | null = null;
+
+    const fakeClient = {
+      setConfig: () => {},
+      interceptors: {
+        request: { use: () => {} },
+        response: {
+          use: (fn: (res: Response, req: Request) => Promise<Response> | Response) => {
+            responseInterceptor = fn;
+          },
+        },
+        error: { use: () => {} },
+      },
+    };
+
+    installAuthOnClient(fakeClient as never);
+    return { auth, invoke: () => responseInterceptor! };
+  }
+
+  function res401(): Response {
+    return new Response(JSON.stringify({ detail: 'Token is blacklisted', code: 'token_not_valid' }), {
+      status: 401,
+      headers: { 'content-type': 'application/json' },
+    });
+  }
+  function req(url = 'http://localhost:8000/cfg/accounts/profile/'): Request {
+    return new Request(url, { method: 'GET' });
+  }
+
+  it('fires onUnauthorized when there is NO refresh handler / token', async () => {
+    const { auth, invoke } = await installOnFakeClient();
+    const onUnauth = vi.fn();
+    auth.onUnauthorized(onUnauth);
+    // No refresh token, no handler → tryRefresh returns null → onUnauthorized fires.
+
+    const out = await invoke()(res401(), req());
+    expect(onUnauth).toHaveBeenCalledTimes(1);
+    expect(out.status).toBe(401); // original 401 surfaced
+  });
+
+  it('fires onUnauthorized when the refresh handler FAILS (blacklisted token)', async () => {
+    const { auth, invoke } = await installOnFakeClient();
+    auth.setToken('access-stale');
+    auth.setRefreshToken('R-dead');
+    auth.setRefreshHandler(async () => {
+      throw new Error('Token is blacklisted');
+    });
+    const onUnauth = vi.fn();
+    auth.onUnauthorized(onUnauth);
+
+    const out = await invoke()(res401(), req());
+    expect(onUnauth).toHaveBeenCalledTimes(1);
+    expect(out.status).toBe(401);
+  });
+
+  it('does NOT fire onUnauthorized on a non-401 response', async () => {
+    const { auth, invoke } = await installOnFakeClient();
+    const onUnauth = vi.fn();
+    auth.onUnauthorized(onUnauth);
+
+    const ok = new Response('{}', { status: 200 });
+    const out = await invoke()(ok, req());
+    expect(onUnauth).not.toHaveBeenCalled();
+    expect(out.status).toBe(200);
+  });
+
+  it('does NOT fire onUnauthorized when refresh SUCCEEDS and retry is attempted', async () => {
+    const { auth, invoke } = await installOnFakeClient();
+    auth.setToken('access-stale');
+    auth.setRefreshToken('R-good');
+    auth.setRefreshHandler(async () => ({ access: 'access-fresh', refresh: 'R-rotated' }));
+    const onUnauth = vi.fn();
+    auth.onUnauthorized(onUnauth);
+
+    // The interceptor retries via global fetch after a successful refresh.
+    // Stub fetch to return 200 for the retry so onUnauthorized is not reached.
+    const fetchMock = vi.fn(async () => new Response('{}', { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+
+    const out = await invoke()(res401(), req());
+    expect(fetchMock).toHaveBeenCalledTimes(1); // retry happened
+    expect(onUnauth).not.toHaveBeenCalled(); // recovered → no logout
+    expect(out.status).toBe(200);
+    expect(auth.getToken()).toBe('access-fresh'); // rotated tokens persisted
+    expect(auth.getRefreshToken()).toBe('R-rotated');
+  });
+
+  it('fires onUnauthorized when the retry STILL returns 401', async () => {
+    const { auth, invoke } = await installOnFakeClient();
+    auth.setToken('access-stale');
+    auth.setRefreshToken('R-good');
+    auth.setRefreshHandler(async () => ({ access: 'access-fresh', refresh: 'R-rotated' }));
+    const onUnauth = vi.fn();
+    auth.onUnauthorized(onUnauth);
+
+    // Refresh succeeds but the retried request is still rejected (401).
+    const fetchMock = vi.fn(async () => new Response('{}', { status: 401 }));
+    vi.stubGlobal('fetch', fetchMock);
+
+    const out = await invoke()(res401(), req());
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(onUnauth).toHaveBeenCalledTimes(1); // dead even after refresh+retry
+    expect(out.status).toBe(401);
+  });
+});

package/src/auth/__tests__/path.test.ts

@@ -0,0 +1,67 @@
+/**
+ * Auth path normalization tests (auth/utils/path.ts).
+ *
+ * These gate whether the magic-link / OTP-in-URL auto-auth fires on the current
+ * page. A locale prefix (`/ru/auth`) or trailing slash must NOT stop `/auth`
+ * from matching — otherwise a localized magic link silently does nothing. And a
+ * 2-letter path segment that is actually a route (not a locale) must not be
+ * eaten (edge case documented below).
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { isAllowedAuthPath, normalizePath } from '../utils/path';
+
+describe('normalizePath', () => {
+  it.each([
+    ['/auth', '/auth'],
+    ['/auth/', '/auth'],
+    ['/ru/auth', '/auth'],
+    ['/en/auth/', '/auth'],
+    ['/ru/auth/callback', '/auth/callback'],
+    ['/', '/'],
+    ['', ''],
+    ['/dashboard', '/dashboard'],
+    ['/ru/', '/'],
+  ])('normalizes %j → %j', (input, expected) => {
+    expect(normalizePath(input)).toBe(expected);
+  });
+
+  it('returns empty string for null / undefined', () => {
+    expect(normalizePath(null)).toBe('');
+    expect(normalizePath(undefined)).toBe('');
+  });
+
+  it('strips only a leading 2-letter segment, not longer ones', () => {
+    // '/abc/auth' — 'abc' is 3 letters, not a locale, so it stays.
+    expect(normalizePath('/abc/auth')).toBe('/abc/auth');
+  });
+});
+
+describe('isAllowedAuthPath', () => {
+  it('matches the exact allowed path', () => {
+    expect(isAllowedAuthPath('/auth', ['/auth'])).toBe(true);
+  });
+  it('matches with a locale prefix', () => {
+    expect(isAllowedAuthPath('/ru/auth', ['/auth'])).toBe(true);
+  });
+  it('matches with a trailing slash', () => {
+    expect(isAllowedAuthPath('/auth/', ['/auth'])).toBe(true);
+  });
+  it('matches a nested path under an allowed root', () => {
+    expect(isAllowedAuthPath('/ru/auth/callback', ['/auth'])).toBe(true);
+  });
+  it('does NOT match an unrelated page', () => {
+    expect(isAllowedAuthPath('/dashboard/device', ['/auth'])).toBe(false);
+  });
+  it('does NOT match a path that merely starts with the same letters', () => {
+    // '/authentication' must not match allow-list entry '/auth'.
+    expect(isAllowedAuthPath('/authentication', ['/auth'])).toBe(false);
+  });
+  it('honors multiple allowed paths', () => {
+    expect(isAllowedAuthPath('/login', ['/auth', '/login'])).toBe(true);
+  });
+  it('returns false for null pathname', () => {
+    expect(isAllowedAuthPath(null, ['/auth'])).toBe(false);
+  });
+});

package/src/auth/__tests__/profileCache.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Profile cache tests (auth/hooks/useProfileCache.ts).
+ *
+ * The profile cache is a localStorage entry that lets the app render "logged in"
+ * UI without an API round-trip. It is DIRECTLY implicated in the stuck-auth bug:
+ * a cached profile left behind by a now-dead session made AuthContext skip the
+ * API and treat the user as authenticated. So the cache must expire on TTL,
+ * invalidate on version bump, and fail CLOSED on corruption (return null + clear)
+ * rather than surfacing garbage.
+ *
+ * The module reads `window.localStorage` / `Date.now()` at call time; we install
+ * a fake storage on globalThis before import and drive time via vi.setSystemTime.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+function installBrowserStorage() {
+  const map = new Map<string, string>();
+  const storage = {
+    getItem: (k: string) => (map.has(k) ? map.get(k)! : null),
+    setItem: (k: string, v: string) => void map.set(k, v),
+    removeItem: (k: string) => void map.delete(k),
+    clear: () => map.clear(),
+    key: (i: number) => Array.from(map.keys())[i] ?? null,
+    get length() { return map.size; },
+  };
+  // useBase64 checks `isDev` via env and uses window for btoa/atob; provide both.
+  vi.stubGlobal('window', { localStorage: storage });
+  vi.stubGlobal('localStorage', storage);
+  return map;
+}
+
+const CACHE_KEY = 'user_profile_cache';
+const NOW = 1_800_000_000_000;
+
+// Minimal User-shaped object; the cache is generic over its shape.
+const sampleUser = { id: 7, email: 'a@b.com', is_staff: false } as never;
+
+describe('profile cache', () => {
+  beforeEach(() => {
+    vi.unstubAllGlobals();
+    vi.resetModules();
+    vi.useFakeTimers();
+    vi.setSystemTime(NOW);
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('round-trips a profile set→get within TTL', async () => {
+    installBrowserStorage();
+    const { setCachedProfile, getCachedProfile } = await import('../hooks/useProfileCache');
+    setCachedProfile(sampleUser);
+    expect(getCachedProfile()).toEqual(sampleUser);
+  });
+
+  it('returns null when nothing is cached', async () => {
+    installBrowserStorage();
+    const { getCachedProfile } = await import('../hooks/useProfileCache');
+    expect(getCachedProfile()).toBeNull();
+  });
+
+  it('expires after TTL and clears the entry', async () => {
+    const map = installBrowserStorage();
+    const { setCachedProfile, getCachedProfile } = await import('../hooks/useProfileCache');
+    setCachedProfile(sampleUser, { ttl: 1000 });
+    expect(getCachedProfile()).toEqual(sampleUser);
+
+    vi.setSystemTime(NOW + 1001); // just past TTL
+    expect(getCachedProfile()).toBeNull();
+    expect(map.has(CACHE_KEY)).toBe(false); // expired cache is purged
+  });
+
+  it('keeps the profile right up to the TTL boundary', async () => {
+    installBrowserStorage();
+    const { setCachedProfile, getCachedProfile } = await import('../hooks/useProfileCache');
+    setCachedProfile(sampleUser, { ttl: 1000 });
+    vi.setSystemTime(NOW + 1000); // exactly TTL — age === ttl, not yet "> ttl"
+    expect(getCachedProfile()).toEqual(sampleUser);
+  });
+
+  it('invalidates on a cache-version mismatch (migration safety)', async () => {
+    const map = installBrowserStorage();
+    const { getCachedProfile } = await import('../hooks/useProfileCache');
+    const { encodeBase64 } = await import('../hooks/useBase64');
+    // Hand-write an entry from a FUTURE/old version.
+    const stale = { version: 999, data: sampleUser, timestamp: NOW, ttl: 10_000 };
+    map.set(CACHE_KEY, encodeBase64(JSON.stringify(stale)));
+    expect(getCachedProfile()).toBeNull();
+    expect(map.has(CACHE_KEY)).toBe(false);
+  });
+
+  it('fails closed on corrupt cache data (returns null + clears)', async () => {
+    const map = installBrowserStorage();
+    const { getCachedProfile } = await import('../hooks/useProfileCache');
+    map.set(CACHE_KEY, 'this-is-not-valid-encoded-json');
+    expect(getCachedProfile()).toBeNull();
+    expect(map.has(CACHE_KEY)).toBe(false);
+  });
+
+  it('clearProfileCache removes the entry', async () => {
+    const map = installBrowserStorage();
+    const { setCachedProfile, clearProfileCache } = await import('../hooks/useProfileCache');
+    setCachedProfile(sampleUser);
+    expect(map.has(CACHE_KEY)).toBe(true);
+    clearProfileCache();
+    expect(map.has(CACHE_KEY)).toBe(false);
+  });
+
+  it('hasValidCache reflects presence + freshness', async () => {
+    installBrowserStorage();
+    const { setCachedProfile, hasValidCache } = await import('../hooks/useProfileCache');
+    expect(hasValidCache()).toBe(false);
+    setCachedProfile(sampleUser, { ttl: 500 });
+    expect(hasValidCache()).toBe(true);
+    vi.setSystemTime(NOW + 501);
+    expect(hasValidCache()).toBe(false);
+  });
+
+  it('getCacheMetadata reports age / ttl / expiresIn', async () => {
+    installBrowserStorage();
+    const { setCachedProfile, getCacheMetadata } = await import('../hooks/useProfileCache');
+    expect(getCacheMetadata()).toEqual({ exists: false });
+
+    setCachedProfile(sampleUser, { ttl: 10_000 });
+    vi.setSystemTime(NOW + 3_000);
+    const meta = getCacheMetadata();
+    expect(meta).toMatchObject({ exists: true, age: 3_000, ttl: 10_000, expiresIn: 7_000 });
+  });
+
+  it('getCacheMetadata clamps expiresIn to 0 once expired', async () => {
+    installBrowserStorage();
+    const { setCachedProfile, getCacheMetadata } = await import('../hooks/useProfileCache');
+    setCachedProfile(sampleUser, { ttl: 1_000 });
+    vi.setSystemTime(NOW + 5_000);
+    expect(getCacheMetadata()?.expiresIn).toBe(0);
+  });
+});

package/src/auth/__tests__/sessionBootstrap.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Bootstrap dead-session detection (isSessionDeadOnBootstrap in AuthContext).
+ *
+ * This is the decision that, at app start, either shows the login form or lets
+ * the app try to use / refresh the persisted tokens. It reproduces the exact
+ * scenario the user hit: stale tokens in localStorage that can never recover,
+ * where the fix used to be "clear localStorage by hand". The session is DEAD
+ * only when the access token is unusable AND the refresh token can't save it.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { isSessionDeadOnBootstrap } from '../context/AuthContext';
+
+const NOW = 1_800_000_000_000;
+const expSeconds = (ms: number) => Math.floor(ms / 1000);
+
+function b64url(obj: unknown): string {
+  return Buffer.from(JSON.stringify(obj), 'utf8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+function jwt(payload: Record<string, unknown>): string {
+  return `${b64url({ alg: 'HS256' })}.${b64url(payload)}.sig`;
+}
+const live = () => jwt({ exp: expSeconds(NOW + 3_600_000) }); // +1h
+const dead = () => jwt({ exp: expSeconds(NOW - 3_600_000) }); // -1h
+
+describe('isSessionDeadOnBootstrap', () => {
+  it('ALIVE: live access + live refresh', () => {
+    expect(isSessionDeadOnBootstrap(live(), live(), NOW)).toBe(false);
+  });
+
+  it('ALIVE: live access even if refresh is dead (access still works)', () => {
+    expect(isSessionDeadOnBootstrap(live(), dead(), NOW)).toBe(false);
+  });
+
+  it('ALIVE: live access even with no refresh token', () => {
+    expect(isSessionDeadOnBootstrap(live(), null, NOW)).toBe(false);
+  });
+
+  it('ALIVE: dead access but LIVE refresh (refresh can rescue it)', () => {
+    expect(isSessionDeadOnBootstrap(dead(), live(), NOW)).toBe(false);
+  });
+
+  it('DEAD: dead access + dead refresh (the classic stuck state)', () => {
+    expect(isSessionDeadOnBootstrap(dead(), dead(), NOW)).toBe(true);
+  });
+
+  it('DEAD: dead access + no refresh token', () => {
+    expect(isSessionDeadOnBootstrap(dead(), null, NOW)).toBe(true);
+  });
+
+  it('DEAD: both tokens null (empty storage that still triggered init)', () => {
+    expect(isSessionDeadOnBootstrap(null, null, NOW)).toBe(true);
+  });
+
+  it('DEAD: garbage access + garbage refresh (corrupt storage — user cleared this by hand)', () => {
+    expect(isSessionDeadOnBootstrap('garbage', 'also-garbage', NOW)).toBe(true);
+  });
+
+  it('DEAD: garbage access + no refresh', () => {
+    expect(isSessionDeadOnBootstrap('xxxxx', null, NOW)).toBe(true);
+  });
+
+  it('ALIVE: garbage access but a LIVE refresh token still lets us recover', () => {
+    expect(isSessionDeadOnBootstrap('garbage', live(), NOW)).toBe(false);
+  });
+
+  it('DEAD: access expired exactly at now + refresh expired (inclusive boundary)', () => {
+    const atNow = jwt({ exp: expSeconds(NOW) });
+    expect(isSessionDeadOnBootstrap(atNow, atNow, NOW)).toBe(true);
+  });
+});
+
+/**
+ * `isAuthenticated` is now derived as `!isSessionDeadOnBootstrap(...)` (via the
+ * private isSessionAlive wrapper in AuthContext). These assertions read the same
+ * predicate from the guard's point of view — proving the fix is self-sufficient:
+ * a stale session reads as unauthenticated from LOCAL exp alone, with no server
+ * 401 required (the exact case a CSP-blocked / hung request used to swallow).
+ */
+describe('isAuthenticated gate (derived from session liveness, network-free)', () => {
+  const alive = (a: string | null, r: string | null) => !isSessionDeadOnBootstrap(a, r, NOW);
+
+  it('reports authenticated while the access token is still valid', () => {
+    expect(alive(live(), null)).toBe(true);
+  });
+
+  it('stays authenticated when access is expired but refresh can still renew', () => {
+    // Between access expiry and the silent refresh — NOT bounced to /auth.
+    expect(alive(dead(), live())).toBe(true);
+  });
+
+  it('reports UNAUTHENTICATED the instant both tokens are expired — no 401 needed', () => {
+    // This is the reporter's scenario: an expired session where the 401 that
+    // would normally trigger logout is swallowed by CSP / a hung request.
+    expect(alive(dead(), dead())).toBe(false);
+  });
+
+  it('reports UNAUTHENTICATED for a stale access with no refresh token', () => {
+    expect(alive(dead(), null)).toBe(false);
+  });
+
+  it('reports UNAUTHENTICATED for garbage tokens (would have read "present" before)', () => {
+    // The OLD isAuthenticated() returned true for any non-null token string.
+    expect(alive('stale-non-jwt', 'also-garbage')).toBe(false);
+  });
+});

package/src/auth/__tests__/useAuthForm.2fa.test.ts

@@ -7,38 +7,48 @@
  * branch relies on.
  */
 
+// @vitest-environment jsdom
 import { act, renderHook } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { useAuthForm } from '../hooks/useAuthForm';
 
-// Mock dependencies
-jest.mock('../context', () => ({
+// useAuthForm pulls in useAutoAuth → useCfgRouter → next/navigation, which
+// throws outside an app-router provider. Stub the navigation surface it uses.
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn(), prefetch: vi.fn(), back: vi.fn() }),
+  usePathname: () => '/auth',
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+// Mock dependencies (migrated from Jest → Vitest)
+vi.mock('../context', () => ({
   useAuth: () => ({
-    requestOTP: jest.fn().mockResolvedValue({ success: true }),
-    verifyOTP: jest.fn(),
-    getSavedEmail: jest.fn().mockReturnValue(null),
-    saveEmail: jest.fn(),
-    clearSavedEmail: jest.fn(),
-    getSavedPhone: jest.fn().mockReturnValue(null),
-    savePhone: jest.fn(),
-    clearSavedPhone: jest.fn(),
+    requestOTP: vi.fn().mockResolvedValue({ success: true }),
+    verifyOTP: vi.fn(),
+    getSavedEmail: vi.fn().mockReturnValue(null),
+    saveEmail: vi.fn(),
+    clearSavedEmail: vi.fn(),
+    getSavedPhone: vi.fn().mockReturnValue(null),
+    savePhone: vi.fn(),
+    clearSavedPhone: vi.fn(),
   }),
 }));
 
-jest.mock('../hooks/useTwoFactor', () => ({
+vi.mock('../hooks/useTwoFactor', () => ({
   useTwoFactor: () => ({
     isLoading: false,
     warning: null,
-    verifyTOTP: jest.fn(),
-    verifyBackupCode: jest.fn(),
+    verifyTOTP: vi.fn(),
+    verifyBackupCode: vi.fn(),
   }),
 }));
 
-jest.mock('../utils/logger', () => ({
+vi.mock('../utils/logger', () => ({
   authLogger: {
-    info: jest.fn(),
-    warn: jest.fn(),
-    error: jest.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
   },
 }));
 
@@ -49,7 +59,7 @@ describe('useAuthForm - 2FA', () => {
   };
 
   beforeEach(() => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
   });
 
   describe('step transitions', () => {