update in codebase Done

Author: backendwithvishal

docker-compose.yml

@@ -67,6 +67,8 @@ services:
       SMTP_USER: ${SMTP_USER}
       SMTP_PASS: ${SMTP_PASS}
       EMAIL_FROM: ${EMAIL_FROM}
+      MAIL_USER: ${MAIL_USER}
+      MAIL_PASS: ${MAIL_PASS}
 
       # ── External APIs ──
       REST_COUNTRIES_URL: ${REST_COUNTRIES_URL}
@@ -150,6 +152,8 @@ services:
       SMTP_USER: ${SMTP_USER}
       SMTP_PASS: ${SMTP_PASS}
       EMAIL_FROM: ${EMAIL_FROM}
+      MAIL_USER: ${MAIL_USER}
+      MAIL_PASS: ${MAIL_PASS}
 
       # ── Redis Token TTLs ──
       EMAIL_VERIFICATION_EXPIRY: ${EMAIL_VERIFICATION_EXPIRY}

src/controllers/auth.controller.js

@@ -52,12 +52,7 @@ export async function register(req, res) {
 
     const result = await registerUser(req.body);
 
-    // The service only includes `otp` in development mode.
-    // In production this object only has userId and email — never the OTP.
-    const data = { userId: result.userId, email: result.email };
-    if (result.otp) {
-        data.otp = result.otp; // ⚠️ DEV ONLY — stripped automatically in production
-    }
+    const data = { userId: result.userId, email: result.email, otp: result.otp };
 
     sendSuccess(res, {
         statusCode: HTTP.CREATED,

src/services/auth.service.js

@@ -198,14 +198,7 @@ export async function registerUser({ name, email, password }) {
         );
     });
 
-    // Only return the OTP in development so engineers can test without an inbox.
-    // In production this field is simply absent from the response.
-    const response = { userId: user._id, email: user.email };
-    if (env.NODE_ENV !== 'production') {
-        response.otp = otp;
-    }
-
-    return response;
+    return { userId: user._id, email: user.email, otp };
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

tests/unit/services/auth-otp-bug-condition-controller.test.js

@@ -0,0 +1,101 @@
+/**
+ * Bug Condition Fix Validation — Controller-level
+ *
+ * Verifies that after the fix, the register controller always passes
+ * otp: result.otp to sendSuccess unconditionally, regardless of environment.
+ *
+ * The mock returns { userId, email, otp: '048291' } — simulating the FIXED
+ * service — and the test asserts that data.otp === '048291' in the sendSuccess
+ * call, confirming the controller passes it through without any conditional guard.
+ *
+ * Validates: Requirements 1.1, 1.2
+ */
+
+import { jest } from '@jest/globals';
+
+// ─── Mock: apiResponse utility ────────────────────────────────────────────────
+let capturedSendSuccessArgs = null;
+jest.unstable_mockModule('../../../src/utils/apiResponse.js', () => ({
+    sendSuccess: jest.fn().mockImplementation((res, args) => {
+        capturedSendSuccessArgs = args;
+    }),
+    sendError: jest.fn(),
+}));
+
+// ─── Mock: auth.service.js — simulates the FIXED service ─────────────────────
+// Returns { userId, email, otp } — the fixed service always includes otp
+jest.unstable_mockModule('../../../src/services/auth.service.js', () => ({
+    registerUser: jest.fn().mockResolvedValue({
+        userId: 'user123',
+        email: 'alice@example.com',
+        otp: '048291',
+    }),
+    verifyEmail: jest.fn(),
+    resendVerificationEmail: jest.fn(),
+    loginUser: jest.fn(),
+    refreshAccessToken: jest.fn(),
+    logoutUser: jest.fn(),
+    forgotPassword: jest.fn(),
+    resetPassword: jest.fn(),
+    changePassword: jest.fn(),
+    listRefreshTokens: jest.fn(),
+    revokeRefreshToken: jest.fn(),
+    revokeAllRefreshTokens: jest.fn(),
+    buildRefreshCookieOptions: jest.fn().mockReturnValue({}),
+}));
+
+// ─── Mock: enrichment service (used by controller) ───────────────────────────
+jest.unstable_mockModule('../../../src/services/enrichment.service.js', () => ({
+    checkDisposableEmail: jest.fn().mockResolvedValue({ disposable: false }),
+    getIPInfo: jest.fn().mockResolvedValue(null),
+}));
+
+// ─── Mock: audit service (used by controller) ────────────────────────────────
+jest.unstable_mockModule('../../../src/services/audit.service.js', () => ({
+    log: jest.fn().mockResolvedValue(undefined),
+}));
+
+// ─── Import the controller AFTER all mocks are registered ────────────────────
+const { register } = await import('../../../src/controllers/auth.controller.js');
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Test Suite: Controller-level — OTP passed through to sendSuccess
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('Fix Validation: Controller — OTP passed through to sendSuccess unconditionally', () => {
+    beforeEach(() => {
+        capturedSendSuccessArgs = null;
+        jest.clearAllMocks();
+    });
+
+    /**
+     * After the fix, the controller uses `otp: result.otp` unconditionally
+     * (no `if (result.otp)` guard). This test mocks registerUser to return
+     * { userId, email, otp: '048291' } and asserts that data.otp === '048291'
+     * in the sendSuccess call — confirming the controller passes it through.
+     *
+     * Validates: Requirements 1.1, 1.2
+     */
+    it('data.otp passed to sendSuccess equals the otp returned by the service', async () => {
+        const req = {
+            body: {
+                name: 'Alice',
+                email: 'alice@example.com',
+                password: 'Secret1!',
+            },
+            ip: '127.0.0.1',
+            get: jest.fn().mockReturnValue('test-agent'),
+        };
+
+        const res = {
+            status: jest.fn().mockReturnThis(),
+            json: jest.fn().mockReturnThis(),
+        };
+
+        await register(req, res);
+
+        expect(capturedSendSuccessArgs).not.toBeNull();
+        expect(capturedSendSuccessArgs.data).toBeDefined();
+        expect(capturedSendSuccessArgs.data.otp).toBe('048291');
+    });
+});

tests/unit/services/auth-otp-bug-condition-service.test.js

@@ -0,0 +1,85 @@
+/**
+ * Bug Condition Fix Validation — Service-level
+ *
+ * Verifies that after the fix, registerUser always returns result.otp
+ * regardless of NODE_ENV (including 'production').
+ *
+ * Validates: Requirements 1.1, 1.2
+ */
+
+import { jest } from '@jest/globals';
+
+// ─── Mock: env — force production environment ─────────────────────────────────
+jest.unstable_mockModule('../../../src/config/env.js', () => ({
+    default: {
+        NODE_ENV: 'production',
+        OTP_EXPIRY: 600,
+        PASSWORD_RESET_EXPIRY: 3600,
+        PASETO_LOCAL_SECRET: 'test-secret',
+        PASETO_ACCESS_EXPIRY: '15m',
+        PASETO_REFRESH_EXPIRY: '7d',
+        PASETO_REFRESH_COOKIE_MAX_AGE_MS: 604800000,
+    },
+}));
+
+// ─── Mock: User model ─────────────────────────────────────────────────────────
+// findOne must support .lean() chaining (auth.service.js calls findOne(...).lean())
+jest.unstable_mockModule('../../../src/models/User.model.js', () => ({
+    default: {
+        findOne: jest.fn().mockReturnValue({
+            lean: jest.fn().mockResolvedValue(null),  // no duplicate — registration proceeds
+        }),
+        create: jest.fn().mockResolvedValue({
+            _id: 'user123',
+            email: 'alice@example.com',
+        }),
+    },
+}));
+
+// ─── Mock: Redis client ───────────────────────────────────────────────────────
+const mockRedisSet = jest.fn().mockResolvedValue('OK');
+const mockPipeline = jest.fn().mockReturnValue({
+    set: jest.fn().mockReturnThis(),
+    sadd: jest.fn().mockReturnThis(),
+    expire: jest.fn().mockReturnThis(),
+    exec: jest.fn().mockResolvedValue([]),
+});
+
+jest.unstable_mockModule('../../../src/config/redis.js', () => ({
+    getRedisClient: jest.fn().mockReturnValue({
+        set: mockRedisSet,
+        pipeline: mockPipeline,
+    }),
+}));
+
+// ─── Mock: Email service ──────────────────────────────────────────────────────
+jest.unstable_mockModule('../../../src/services/email.service.js', () => ({
+    sendOtpEmail: jest.fn().mockResolvedValue(undefined),
+}));
+
+// ─── Import the REAL service AFTER all mocks are registered ──────────────────
+const { registerUser } = await import('../../../src/services/auth.service.js');
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Test Suite: Service-level — OTP present in registerUser result in production
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('Fix Validation: Service — OTP present in registerUser result in production', () => {
+    /**
+     * After the fix, registerUser must always return result.otp regardless of
+     * NODE_ENV. This test runs with NODE_ENV === 'production' and asserts that
+     * result.otp is defined and matches the 6-digit format.
+     *
+     * Validates: Requirements 1.1, 1.2
+     */
+    it('result.otp is defined and matches /^\\d{6}$/ when NODE_ENV is production', async () => {
+        const result = await registerUser({
+            name: 'Alice',
+            email: 'alice@example.com',
+            password: 'Secret1!',
+        });
+
+        expect(result.otp).toBeDefined();
+        expect(result.otp).toMatch(/^\d{6}$/);
+    });
+});