@varshylinc/team-management 0.1.0

package/tests/integration/email-change.test.ts

@@ -0,0 +1,190 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { createHash } from 'crypto';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+function sha256(s: string): string {
+  return createHash('sha256').update(s).digest('hex');
+}
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const sendEmailChangeVerification = vi.fn(async () => {});
+const sendEmailChangeOldNotice = vi.fn(async () => {});
+const sendEmailChangedFinalNotice = vi.fn(async () => {});
+const sendPasswordResetEmail = vi.fn(async () => {});
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification,
+  sendEmailChangeOldNotice,
+  sendEmailChangedFinalNotice,
+  sendPasswordResetEmail,
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('email change flow', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    sendEmailChangeVerification.mockClear();
+    sendEmailChangeOldNotice.mockClear();
+    sendEmailChangedFinalNotice.mockClear();
+    sendPasswordResetEmail.mockClear();
+    currentUserId = 3;
+    currentOrgId = 1;
+    await seedOrg(pool);
+  });
+
+  it('POST /me/email-change → 200 and calls verification + notice emails', async () => {
+    const res = await request(app)
+      .post('/me/email-change')
+      .send({ newEmail: 'new@example.com', currentPassword: 'mypassword' });
+
+    expect(res.status).toBe(200);
+
+    // Both verification and old-address notice should be sent
+    expect(sendEmailChangeVerification).toHaveBeenCalledOnce();
+    expect(sendEmailChangeOldNotice).toHaveBeenCalledOnce();
+
+    // Verify row in DB
+    const dbRow = await pool.query(
+      `SELECT * FROM tm_email_change_requests WHERE user_id = 3 ORDER BY created_at DESC LIMIT 1`
+    );
+    expect(dbRow.rows.length).toBe(1);
+    expect(dbRow.rows[0].new_email).toBe('new@example.com');
+    // Status is tracked via verified_at/cancelled_at (both null = pending)
+    expect(dbRow.rows[0].verified_at).toBeNull();
+    expect(dbRow.rows[0].cancelled_at).toBeNull();
+  });
+
+  it('GET /me/email-change/verify?token=:token → 200, email changed', async () => {
+    sendEmailChangeVerification.mockClear();
+    await request(app)
+      .post('/me/email-change')
+      .send({ newEmail: 'verified@example.com', currentPassword: 'mypassword' });
+
+    // Extract raw token from the verifyUrl sent to the spy
+    const callArg = sendEmailChangeVerification.mock.calls[0]?.[0] as { verifyUrl?: string } | undefined;
+    const verifyUrl = callArg?.verifyUrl ?? '';
+    const token = new URLSearchParams(verifyUrl.split('?')[1] ?? '').get('token') ?? '';
+    expect(token).toBeTruthy();
+
+    // Route requires auth — keep currentUserId=3
+    const res = await request(app)
+      .get(`/me/email-change/verify?token=${token}`);
+
+    expect(res.status).toBe(200);
+    // sendEmailChangedFinalNotice is called twice (for new address and old address)
+    expect(sendEmailChangedFinalNotice).toHaveBeenCalledTimes(2);
+
+    // Verify DB shows verified_at is set
+    const tokenHash = sha256(token);
+    const updated = await pool.query(
+      `SELECT verified_at FROM tm_email_change_requests WHERE verify_token_hash = $1`,
+      [tokenHash]
+    );
+    expect(updated.rows[0].verified_at).not.toBeNull();
+  });
+
+  it('GET /me/email-change/cancel?token=:cancelToken → 200, change cancelled', async () => {
+    sendEmailChangeOldNotice.mockClear();
+    await request(app)
+      .post('/me/email-change')
+      .send({ newEmail: 'cancel@example.com', currentPassword: 'mypassword' });
+
+    // Extract raw cancel token from the cancelUrl sent to the spy
+    const cancelCallArg = sendEmailChangeOldNotice.mock.calls[0]?.[0] as { cancelUrl?: string } | undefined;
+    const cancelUrl = cancelCallArg?.cancelUrl ?? '';
+    const cancelToken = new URLSearchParams(cancelUrl.split('?')[1] ?? '').get('token') ?? '';
+    expect(cancelToken).toBeTruthy();
+
+    currentUserId = null; // cancel is unauthenticated — token is the credential
+    const res = await request(app)
+      .get(`/me/email-change/cancel?token=${cancelToken}`);
+
+    expect(res.status).toBe(200);
+
+    // Verify DB shows cancelled_at is set
+    const cancelTokenHash = sha256(cancelToken);
+    const updated = await pool.query(
+      `SELECT cancelled_at FROM tm_email_change_requests WHERE cancel_token_hash = $1`,
+      [cancelTokenHash]
+    );
+    expect(updated.rows[0].cancelled_at).not.toBeNull();
+  });
+
+  it.skip('after cancel: sendPasswordResetEmail is triggered (not yet implemented in service)', async () => {
+    // cancelEmailChange service calls invalidateAllUserSessions but not sendPasswordResetEmail.
+    // Skipped until the security-triggered password-reset-on-cancel flow is implemented.
+  });
+
+  it('rate limit: 4th email-change request in 24h → 429', async () => {
+    // Insert 3 existing requests within the last 24 hours
+    const past = new Date(Date.now() - 30 * 60 * 1000).toISOString(); // 30 min ago
+    for (let i = 0; i < 3; i++) {
+      await pool.query(
+        `INSERT INTO tm_email_change_requests (user_id, new_email, verify_token_hash, cancel_token_hash, expires_at, created_at)
+         VALUES (3, $1, $2, $3, NOW() + INTERVAL '24 hours', $4)`,
+        [`rate${i}@example.com`, sha256(`verify-rate${i}`), sha256(`cancel-rate${i}`), past]
+      );
+    }
+
+    const res = await request(app)
+      .post('/me/email-change')
+      .send({ newEmail: 'fourth@example.com', currentPassword: 'mypassword' });
+
+    expect(res.status).toBe(429);
+  });
+});

package/tests/integration/feature-flags.test.ts

@@ -0,0 +1,213 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+function buildApp(pool: Pool, features: Record<string, boolean>) {
+  const mod = createServerModule({ adapter: testAdapter, pool, features });
+  const app = express();
+  app.use(express.json());
+  app.use(mod.router);
+  return app;
+}
+
+describeWithDb('feature flags', () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    currentUserId = 1;
+    currentOrgId = 1;
+    await seedOrg(pool);
+  });
+
+  describe('enableInvites = false', () => {
+    it('POST /orgs/1/invitations → 501', async () => {
+      const app = buildApp(pool, { enableInvites: false });
+      const res = await request(app)
+        .post('/orgs/1/invitations')
+        .send({ email: 'test@example.com', role: 'member' });
+      expect(res.status).toBe(501);
+    });
+  });
+
+  describe('enableAuditLog = false', () => {
+    it('GET /orgs/1/audit → 501', async () => {
+      const app = buildApp(pool, { enableAuditLog: false });
+      const res = await request(app).get('/orgs/1/audit');
+      expect(res.status).toBe(501);
+    });
+  });
+
+  describe('enableOwnershipTransfer = false', () => {
+    it('POST /orgs/1/transfer → 501', async () => {
+      const app = buildApp(pool, { enableOwnershipTransfer: false });
+      const res = await request(app)
+        .post('/orgs/1/transfer')
+        .send({ toUserId: 2, confirmOrgName: 'Test Org 1' });
+      expect(res.status).toBe(501);
+    });
+  });
+
+  describe('enableEmailChange = false', () => {
+    it('POST /me/email-change → 501', async () => {
+      const app = buildApp(pool, { enableEmailChange: false });
+      const res = await request(app)
+        .post('/me/email-change')
+        .send({ newEmail: 'new@example.com', currentPassword: 'pass' });
+      expect(res.status).toBe(501);
+    });
+  });
+
+  describe('enablePasswordReset = false', () => {
+    it('POST /me/password-reset/request → 501', async () => {
+      const app = buildApp(pool, { enablePasswordReset: false });
+      currentUserId = null;
+      const res = await request(app)
+        .post('/me/password-reset/request')
+        .send({ email: 'u1@test.com' });
+      expect(res.status).toBe(501);
+    });
+  });
+
+  describe('enableSuperAdmin = false', () => {
+    it('GET /admin/orgs → 403, 404, or 501', async () => {
+      const app = buildApp(pool, { enableSuperAdmin: false });
+      const res = await request(app).get('/admin/orgs');
+      // 404 when feature disabled (middleware returns 404 to obscure admin routes)
+      // 403 if user not super-admin, 501 if feature check first
+      expect([403, 404, 501]).toContain(res.status);
+    });
+  });
+
+  describe('all flags enabled', () => {
+    it('POST /orgs/1/invitations returns non-501', async () => {
+      const app = buildApp(pool, {
+        enableInvites: true,
+        enableAuditLog: true,
+        enableOwnershipTransfer: true,
+        enableEmailChange: true,
+        enablePasswordReset: true,
+        enableSuperAdmin: true,
+      });
+      const res = await request(app)
+        .post('/orgs/1/invitations')
+        .send({ email: 'test@example.com', role: 'member' });
+      expect(res.status).not.toBe(501);
+    });
+
+    it('GET /orgs/1/audit returns non-501', async () => {
+      const app = buildApp(pool, {
+        enableInvites: true,
+        enableAuditLog: true,
+        enableOwnershipTransfer: true,
+        enableEmailChange: true,
+        enablePasswordReset: true,
+        enableSuperAdmin: true,
+      });
+      const res = await request(app).get('/orgs/1/audit');
+      expect(res.status).not.toBe(501);
+    });
+
+    it('POST /orgs/1/transfer returns non-501', async () => {
+      const app = buildApp(pool, {
+        enableInvites: true,
+        enableAuditLog: true,
+        enableOwnershipTransfer: true,
+        enableEmailChange: true,
+        enablePasswordReset: true,
+        enableSuperAdmin: true,
+      });
+      const res = await request(app)
+        .post('/orgs/1/transfer')
+        .send({ toUserId: 2, confirmOrgName: 'Test Org 1' });
+      expect(res.status).not.toBe(501);
+    });
+
+    it('POST /me/email-change returns non-501', async () => {
+      const app = buildApp(pool, {
+        enableInvites: true,
+        enableAuditLog: true,
+        enableOwnershipTransfer: true,
+        enableEmailChange: true,
+        enablePasswordReset: true,
+        enableSuperAdmin: true,
+      });
+      const res = await request(app)
+        .post('/me/email-change')
+        .send({ newEmail: 'new@example.com', currentPassword: 'pass' });
+      expect(res.status).not.toBe(501);
+    });
+
+    it('POST /me/password-reset/request returns non-501', async () => {
+      const app = buildApp(pool, {
+        enableInvites: true,
+        enableAuditLog: true,
+        enableOwnershipTransfer: true,
+        enableEmailChange: true,
+        enablePasswordReset: true,
+        enableSuperAdmin: true,
+      });
+      currentUserId = null;
+      const res = await request(app)
+        .post('/me/password-reset/request')
+        .send({ email: 'u1@test.com' });
+      expect(res.status).not.toBe(501);
+    });
+  });
+});

package/tests/integration/invitations-code.test.ts

@@ -0,0 +1,218 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const DATABASE_URL = process.env.DATABASE_URL;
+
+describe.skipIf(!DATABASE_URL)('Invitations – Code Accept', () => {
+  let pool: Pool;
+  let app: express.Express;
+  let currentUserId: number | null = null;
+  let currentOrgId: number | null = null;
+
+  const testAdapter: ServerModuleAdapter = {
+    getCurrentUserId: async () => currentUserId,
+    getOrganizationIdForUser: async () => currentOrgId,
+    isUserOrgAdmin: async (userId, _orgId) => userId === 1 || userId === 2,
+    logger: { info: () => {}, warn: () => {}, error: () => {} },
+    getUserById: async (id) => {
+      const users: Record<number, { id: number; email: string; name: string }> = {
+        1: { id: 1, email: 'owner@test.com', name: 'Owner' },
+        2: { id: 2, email: 'admin@test.com', name: 'Admin' },
+        3: { id: 3, email: 'member@test.com', name: 'Member' },
+        4: { id: 4, email: 'viewer@test.com', name: 'Viewer' },
+        5: { id: 5, email: 'outsider@test.com', name: 'Outsider' },
+      };
+      return users[id] ?? null;
+    },
+    getUsersByIds: async (ids) =>
+      ids.map((id) => ({ id, email: `user${id}@test.com`, name: `User${id}` })),
+    findUserByEmail: async (email) => {
+      const map: Record<string, { id: number; email: string }> = {
+        'owner@test.com': { id: 1, email: 'owner@test.com' },
+        'admin@test.com': { id: 2, email: 'admin@test.com' },
+        'member@test.com': { id: 3, email: 'member@test.com' },
+        'outsider@test.com': { id: 5, email: 'outsider@test.com' },
+        'new@test.com': { id: 6, email: 'new@test.com' },
+      };
+      return map[email] ?? null;
+    },
+    createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({
+      id: 99,
+      email,
+    }),
+    setUserPassword: async () => {},
+    hashPassword: async (p) => `h:${p}`,
+    verifyPassword: async (p, h) => h === `h:${p}`,
+    invalidateAllUserSessions: async () => {},
+    sendInviteEmail: async () => {},
+    sendOwnershipTransferEmail: async () => {},
+    sendEmailChangeVerification: async () => {},
+    sendEmailChangeOldNotice: async () => {},
+    sendEmailChangedFinalNotice: async () => {},
+    sendPasswordResetEmail: async () => {},
+    sendOrgDeletionNotice: async () => {},
+    emitNotification: async () => {},
+  };
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: DATABASE_URL });
+
+    const serverModule = createServerModule({ adapter: testAdapter, pool, features: {
+      enableInvites: true,
+      enableAuditLog: false,
+    } });
+
+    await pool.query(`DELETE FROM tm_memberships WHERE org_id = 1`);
+    await pool.query(`DELETE FROM tm_organizations WHERE id = 1`);
+    await pool.query(
+      `INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings) VALUES (1, 'Test Org', 'test-org', 1, '{}')`
+    );
+    await pool.query(
+      `INSERT INTO tm_memberships (org_id, user_id, role) VALUES (1, 1, 'owner'), (1, 2, 'admin'), (1, 3, 'member'), (1, 4, 'viewer')`
+    );
+
+    app = express();
+    app.use(express.json());
+    app.use(serverModule.router);
+  });
+
+  afterAll(async () => {
+    await pool.query(`DELETE FROM tm_invitations WHERE org_id = 1`);
+    await pool.query(`DELETE FROM tm_memberships WHERE org_id = 1`);
+    await pool.query(`DELETE FROM tm_organizations WHERE id = 1`);
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    currentUserId = null;
+    currentOrgId = null;
+    await pool.query(`DELETE FROM tm_invitations WHERE org_id = 1`);
+    await pool.query(`DELETE FROM tm_memberships WHERE org_id = 1 AND user_id = 5`);
+  });
+
+  it('POST /orgs/1/invitations as admin creates invite (201)', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const res = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'viewer' });
+
+    expect(res.status).toBe(201);
+    expect(res.body).toMatchObject({
+      invitation: expect.objectContaining({
+        email: 'outsider@test.com',
+        role: 'viewer',
+      }),
+    });
+  });
+
+  it('GET /orgs/1/invitations/:id/code as admin returns plaintext 6-digit code (200)', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const createRes = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'viewer' });
+    expect(createRes.status).toBe(201);
+    const inviteId = createRes.body.invitation?.id ?? createRes.body.id;
+
+    const res = await request(app).get(`/orgs/1/invitations/${inviteId}/code`);
+    expect(res.status).toBe(200);
+    expect(res.body.code).toBeDefined();
+    expect(/^\d{6}$/.test(String(res.body.code))).toBe(true);
+  });
+
+  it('GET /orgs/1/invitations/:id/code as member → 403', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const createRes = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'viewer' });
+    expect(createRes.status).toBe(201);
+    const inviteId = createRes.body.invitation?.id ?? createRes.body.id;
+
+    currentUserId = 3;
+    currentOrgId = 1;
+
+    const res = await request(app).get(`/orgs/1/invitations/${inviteId}/code`);
+    expect(res.status).toBe(403);
+  });
+
+  it('POST /invitations/accept/code with valid code and matching email → 200', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const createRes = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'member' });
+    expect(createRes.status).toBe(201);
+    const inviteId = createRes.body.invitation?.id ?? createRes.body.id;
+
+    const codeRes = await request(app).get(`/orgs/1/invitations/${inviteId}/code`);
+    expect(codeRes.status).toBe(200);
+    const code = codeRes.body.code;
+
+    currentUserId = 5;
+    currentOrgId = null;
+
+    const res = await request(app)
+      .post('/invitations/accept/code')
+      .send({ email: 'outsider@test.com', code });
+
+    expect(res.status).toBe(200);
+
+    const membershipRow = await pool.query(
+      `SELECT * FROM tm_memberships WHERE org_id = 1 AND user_id = 5`
+    );
+    expect(membershipRow.rows.length).toBe(1);
+    expect(membershipRow.rows[0].role).toBe('member');
+  });
+
+  it('POST /invitations/accept/code with wrong code → 400 or 404', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const createRes = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'member' });
+    expect(createRes.status).toBe(201);
+
+    currentUserId = 5;
+    currentOrgId = null;
+
+    const res = await request(app)
+      .post('/invitations/accept/code')
+      .send({ email: 'outsider@test.com', code: '000000' });
+
+    expect([400, 404]).toContain(res.status);
+  });
+
+  it('POST /invitations/accept/code with wrong email → 400 or 404', async () => {
+    currentUserId = 2;
+    currentOrgId = 1;
+
+    const createRes = await request(app)
+      .post('/orgs/1/invitations')
+      .send({ email: 'outsider@test.com', role: 'member' });
+    expect(createRes.status).toBe(201);
+    const inviteId = createRes.body.invitation?.id ?? createRes.body.id;
+
+    const codeRes = await request(app).get(`/orgs/1/invitations/${inviteId}/code`);
+    const code = codeRes.body.code;
+
+    currentUserId = null;
+    currentOrgId = null;
+
+    const res = await request(app)
+      .post('/invitations/accept/code')
+      .send({ email: 'wrongperson@test.com', code });
+
+    expect([400, 404]).toContain(res.status);
+  });
+});