chore: implement unit test

src/apps/v1/auth/auth_controller_test.rs

@@ -0,0 +1,601 @@
+use crate::{
+	apps::v1::auth::auth_router, create_mock_app_state, create_test_user,
+	encode_refresh_token, AuthOtpSchema, OtpManager, ResourceEnum,
+};
+use axum::{http::StatusCode, Extension};
+use axum_test::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn test_login_should_fail_with_invalid_user() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "nonexistent@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	println!("🧪 Response Body: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_with_wrong_password() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("user@example.com", "User Satu", true);
+	user.password = crate::hash_password("correctpassword").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "user@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Wrong password: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_user_not_active() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("inactive@example.com", "Inactive User", false);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "inactive@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Not active user: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("active@example.com", "Active User", true);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "active@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert!(json["data"]["token"]["access_token"].is_string());
+	assert!(json["data"]["user"]["email"] == "active@example.com");
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test@test.com",
+			"password": ""
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_email_not_valid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test",
+			"password": "test123"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "validuser@example.com",
+			"password": "Validpass1!",
+			"fullname": "Valid User",
+			"student_type": "regular",
+			"phone_number": "0812345678",
+						"reffered_by": "Facebook",
+						"refferal_code": "KFNB"
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_already_taken() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("duplicate@example.com", "User Exists", false);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"fullname": "User Exists",
+		"email": "duplicate@example.com",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"fullname": "Invalid Email",
+		"email": "invalid-email",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({
+		"fullname": "No Password",
+		"email": "nopass@example.com",
+		"password": "",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "user@example.com"
+	});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "OTP resent successfully");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_email_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email cannot be empty, Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_with_invalid_email_format() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({ "email": "not-an-email" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_otp_store_fails() {
+	let mut state = create_mock_app_state().await;
+	state.surrealdb_mem = surrealdb::Surreal::new::<surrealdb::engine::local::Mem>(())
+		.await
+		.expect("failed to create mock surrealdb_mem");
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = serde_json::json!({ "email": "fail-store@example.com" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Specify a namespace to use") || body.contains("Failed store otp"),
+		"Expected namespace setup error or store failure, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let mut user = create_test_user("forgot@example.com", "Forgot User", true);
+	user.password = crate::hash_password("secret").unwrap();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	user_repo.query_create_user(user).await.unwrap();
+	let payload = json!({ "email": "forgot@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(
+		body.contains("Reset Password request send"),
+		"Unexpected response: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "notfound@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("User not found"),
+		"Expected 'User not found', got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Email not valid") || body.contains("User not found"),
+		"Expected email error, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_refresh_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let valid_token = encode_refresh_token("refreshme@example.com".into()).unwrap();
+	let payload = json!({
+		"refresh_token": valid_token
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.json::<serde_json::Value>();
+	assert!(body["data"]["access_token"].is_string());
+	assert!(body["data"]["refresh_token"].is_string());
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_invalid_token() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"refresh_token": "invalid.token.value"
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	assert!(body.contains("Invalid refresh token"));
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_verify_email_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("verify@example.com", "Verify User", false);
+	let otp = OtpManager::generate_otp();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let auth_repo = crate::apps::v1::auth::AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": otp
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Email verified successfully"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_wrong_otp() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("wrongotp@example.com", "Wrong OTP", false);
+	let otp = OtpManager::generate_otp();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let auth_repo = crate::apps::v1::auth::AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 999_999
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("Failed to verify OTP"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_if_otp_expired() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("expired@example.com", "Expired OTP", false);
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	use chrono::{Duration, Utc};
+	let expired_otp = crate::apps::v1::auth::AuthOtpSchema {
+		otp: 123456,
+		expires_at: Utc::now() - Duration::minutes(1),
+	};
+	let _: Option<AuthOtpSchema> = state
+		.surrealdb_mem
+		.create((ResourceEnum::OtpCache.to_string(), user.email.clone()))
+		.content(expired_otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 123456
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("OTP expired"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let res = server.post("/v1/auth/verify-email").json(&json!({})).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_new_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let email = "resetme@example.com";
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user(email, "Reset User", true);
+	user.password = crate::hash_password("oldpass123!").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Success update password user"));
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_token_is_empty() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let payload = json!({
+		"token": "",
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Invalid or missing token"),
+		"Gagal deteksi token kosong: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_password_is_weak() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let email = "weakpass@example.com";
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "123"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Password must have at least")
+			|| body.contains("Password must include"),
+		"Pesan error nggak sesuai: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let token =
+		crate::encode_reset_password_token("ghost@example.com".into()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Validpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}

src/apps/v1/auth/auth_dto.rs

@@ -6,10 +6,7 @@ use utoipa::ToSchema;
 use validator::Validate;
 
 lazy_static! {
-	static ref PASSWORD_REGEX: Regex = Regex::new(
-		r"^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$"
-	)
-	.unwrap();
+	static ref PASSWORD_REGEX: Regex = Regex::new(r"^[A-Za-z\d@$!%*?&]{8,}$").unwrap();
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema, Validate)]
@@ -106,10 +103,7 @@ pub struct AuthRefreshTokenRequestDto {
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema, Validate)]
 pub struct AuthNewPasswordRequestDto {
 	pub token: String,
-	#[validate(length(
-		min = 8,
-		message = "Password must have at least 8 characters"
-	))]
+	#[validate(length(min = 1, message = "Token cannot be empty"))]
 	#[validate(regex(
 		path = "PASSWORD_REGEX",
 		message = "Password must include uppercase, lowercase, number, and special character"

src/apps/v1/auth/auth_repository.rs

@@ -4,7 +4,7 @@ use anyhow::{anyhow, bail, Result};
 use chrono::{Duration, Utc};
 
 pub struct AuthRepository<'a> {
-	state: &'a AppState,
+	pub state: &'a AppState,
 }
 
 impl<'a> AuthRepository<'a> {
@@ -13,6 +13,9 @@ impl<'a> AuthRepository<'a> {
 	}
 
 	pub async fn query_store_user(&self, user: UsersSchema) -> Result<String> {
+		if user.email.trim().is_empty() {
+			bail!("Email is required");
+		}
 		let table = ResourceEnum::UsersCache.to_string();
 		let user_id = user.email.clone();
 		let id = make_thing(&table, &user_id);
@@ -43,7 +46,7 @@ impl<'a> AuthRepository<'a> {
 	}
 
 	pub async fn query_delete_stored_user(&self, email: String) -> Result<String> {
-		let record: Option<String> = self
+		let record: Option<UsersSchema> = self
 			.state
 			.surrealdb_mem
 			.delete((ResourceEnum::UsersCache.to_string(), email))

src/apps/v1/auth/auth_repository_test.rs

@@ -0,0 +1,166 @@
+#[cfg(test)]
+mod auth_repository_test {
+	use crate::{
+		create_mock_app_state, make_thing, AuthOtpSchema, AuthRepository, ResourceEnum,
+		UsersSchema,
+	};
+	use chrono::{Duration, Utc};
+	use surrealdb::Uuid;
+
+	fn create_mock_user(email: &str) -> UsersSchema {
+		UsersSchema {
+			id: make_thing("app_users", &Uuid::new_v4().to_string()),
+			email: email.to_string(),
+			fullname: "Test User".to_string(),
+			password: "password".to_string(),
+			is_deleted: false,
+			avatar: None,
+			phone_number: "081234567890".to_string(),
+			referral_code: None,
+			referred_by: None,
+			identity_number: None,
+			is_active: true,
+			student_type: "general".to_string(),
+			religion: None,
+			gender: None,
+			birthdate: None,
+			is_profile_completed: false,
+			role: make_thing("roles", "user"),
+			created_at: None,
+			updated_at: None,
+		}
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_user() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("store_user@example.com");
+		let store = repo.query_store_user(user.clone()).await;
+		assert!(store.is_ok());
+		let fetched = repo.query_get_stored_user(user.email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap().email, user.email);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_user() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("delete_user@example.com");
+		assert!(repo.query_store_user(user.clone()).await.is_ok());
+		let deleted = repo.query_delete_stored_user(user.email.clone()).await;
+		assert!(deleted.is_ok());
+		let result = repo.query_get_stored_user(user.email.clone()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_user@example.com".to_string();
+		let otp = 123456;
+		let stored = repo.query_store_otp(email.clone(), otp).await;
+		assert!(stored.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap(), otp);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_del@example.com".to_string();
+		let otp = 654321;
+		repo.query_store_otp(email.clone(), otp).await.unwrap();
+		let deleted = repo.query_delete_stored_otp(email.clone()).await;
+		assert!(deleted.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_expired_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com".to_string();
+		let otp = 789012;
+		let table = ResourceEnum::OtpCache.to_string();
+		let expires_at = Utc::now() - Duration::seconds(1);
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((table.clone(), email.as_str()))
+			.content(AuthOtpSchema { otp, expires_at })
+			.await
+			.unwrap();
+		let result = repo.query_get_stored_otp(email.clone()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_user_with_empty_email_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("");
+		let result = repo.query_store_user(user).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_non_existent_stored_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_get_stored_user("not_found@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_delete_non_existent_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_delete_stored_user("ghost@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_expired_otp_should_fail() {
+		use chrono::Duration;
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com";
+		let expired_time = chrono::Utc::now() - Duration::seconds(10);
+		let otp = 123456;
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((ResourceEnum::OtpCache.to_string(), email))
+			.content(AuthOtpSchema {
+				otp,
+				expires_at: expired_time,
+			})
+			.await
+			.unwrap();
+
+		let result = repo.query_get_stored_otp(email.into()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_valid_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "valid_otp@example.com";
+		let otp = 654321;
+		let store_result = repo.query_store_otp(email.into(), otp).await;
+		assert!(store_result.is_ok());
+		let get_result = repo.query_get_stored_otp(email.into()).await;
+		assert_eq!(get_result.unwrap(), otp);
+	}
+}

src/apps/v1/auth/auth_service.rs

@@ -72,9 +72,20 @@ impl AuthService {
 				let response = ResponseSuccessDto {
 					data: AuthLoginResponsetDto {
 						user: UsersItemDto {
+							id: user.id.id.to_raw(),
 							fullname: user.fullname.clone(),
 							email: user.email.clone(),
-							is_active: user.is_active,
+							is_active: user.is_active.clone(),
+							avatar: user.avatar.clone(),
+							phone_number: user.phone_number.clone(),
+							referral_code: user.referral_code.clone(),
+							referred_by: user.referred_by.clone(),
+							identity_number: user.identity_number.clone(),
+							student_type: user.student_type.clone(),
+							religion: user.religion.clone(),
+							gender: user.gender.clone(),
+							birthdate: user.birthdate.clone(),
+							is_profile_completed: user.is_profile_completed.clone(),
 						},
 						token: TokenDto {
 							access_token,
@@ -97,6 +108,10 @@ impl AuthService {
 		payload: AuthRegisterRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
+
 		let user_repo = UsersRepository::new(state);
 		let auth_repo = AuthRepository::new(state);
 
@@ -188,6 +203,9 @@ impl AuthService {
 		payload: AuthResendOtpRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let repository = AuthRepository::new(state);
 		let otp = generate_otp::OtpManager::generate_otp();
 		let message = format!("Your OTP code is {}", otp);
@@ -203,6 +221,9 @@ impl AuthService {
 	pub async fn mutation_refresh_token(
 		payload: AuthRefreshTokenRequestDto,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let email = match decode_refresh_token(&payload.refresh_token) {
 			Ok(token) => token.claims.sub,
 			Err(_) => {
@@ -244,6 +265,9 @@ impl AuthService {
 		payload: AuthResendOtpRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
 		if user_repo
 			.query_user_by_email(payload.email.clone())
@@ -278,6 +302,9 @@ impl AuthService {
 		payload: AuthVerifyEmailRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
 		let auth_repo = AuthRepository::new(state);
 		let email = payload.email.clone();
@@ -314,9 +341,25 @@ impl AuthService {
 		payload: AuthNewPasswordRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
-		let email = extract_email_token(payload.token).unwrap();
-		let password = hash_password(&payload.password).unwrap();
+		let email = match extract_email_token(payload.token.clone()) {
+			Some(email) => email,
+			None => {
+				return common_response(StatusCode::BAD_REQUEST, "Invalid or missing token");
+			}
+		};
+		let password = match hash_password(&payload.password) {
+			Ok(p) => p,
+			Err(_) => {
+				return common_response(
+					StatusCode::INTERNAL_SERVER_ERROR,
+					"Failed to hash password",
+				);
+			}
+		};
 		match user_repo
 			.query_update_password_user(email, UsersSetNewPasswordSchema { password })
 			.await

src/apps/v1/auth/mod.rs

@@ -7,6 +7,11 @@ pub mod auth_repository;
 pub mod auth_schema;
 pub mod auth_service;
 
+#[cfg(test)]
+pub mod auth_controller_test;
+#[cfg(test)]
+pub mod auth_repository_test;
+
 pub use auth_dto::*;
 pub use auth_repository::*;
 pub use auth_schema::*;