Fixing password flow

src/server/server.test.ts

@@ -15,13 +15,15 @@ const { mockDb, mockDbQueryBuilder } = vi.hoisted(() => {
     builder.where = vi.fn(() => builder);
     builder.limit = vi.fn(() => Promise.resolve(returnValue));
     builder.values = vi.fn(() => Promise.resolve());
+    builder.set = vi.fn(() => builder);
     return builder;
   };
 
   const mockDb = {
     select: vi.fn(),
     delete: vi.fn(),
     insert: vi.fn(),
+    update: vi.fn(),
   };
 
   return { mockDb, mockDbQueryBuilder };
@@ -31,7 +33,10 @@ const { mockDb, mockDbQueryBuilder } = vi.hoisted(() => {
 
 vi.mock('@/lib/auth', () => ({
   auth: {
-    api: { getSession: vi.fn() },
+    api: {
+      getSession: vi.fn(),
+      setPassword: vi.fn(),
+    },
     handler: vi.fn(),
   },
 }));
@@ -41,6 +46,7 @@ vi.mock('@/db', () => ({ db: mockDb }));
 vi.mock('@/db/schema', () => ({
   authSession: { token: 'token', id: 'id', userId: 'userId' },
   authAuditLog: {},
+  users: { email: 'email' },
 }));
 
 vi.mock('@/lib/logger', () => ({
@@ -97,13 +103,14 @@ describe('server Route Handlers', () => {
   // ─── POST /api/auth/password/set ───────────────────────────────────────────
 
   describe('pOST /api/auth/password/set', () => {
-    it('should proxy to auth.handler with path rewritten to /api/auth/set-password', async () => {
-      (auth.handler as any).mockResolvedValue(
-        new Response(JSON.stringify({ status: true }), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
+    it('should call auth.api.setPassword, fetch session, and update user status to verified', async () => {
+      (auth.api.setPassword as any).mockResolvedValue(undefined);
+      (auth.api.getSession as any).mockResolvedValue({
+        user: { email: 'test@example.com' },
+      });
+
+      const mockUpdateBuilder = mockDbQueryBuilder([]);
+      mockDb.update.mockReturnValue(mockUpdateBuilder);
 
       const res = await server.request('/api/auth/password/set', {
         method: 'POST',
@@ -112,11 +119,44 @@ describe('server Route Handlers', () => {
       });
 
       expect(res.status).toBe(200);
-      expect(auth.handler).toHaveBeenCalledOnce();
+      expect(await res.json()).toEqual({ success: true });
+      expect(auth.api.setPassword).toHaveBeenCalledWith({
+        body: { newPassword: 'hunter2' },
+        headers: expect.any(Headers),
+      });
+      expect(auth.api.getSession).toHaveBeenCalledWith({
+        headers: expect.any(Headers),
+      });
+      expect(mockDb.update).toHaveBeenCalled();
+      expect(mockUpdateBuilder.set).toHaveBeenCalledWith(
+        expect.objectContaining({ status: 'verified' })
+      );
+    });
 
-      const proxiedRequest: Request = (auth.handler as any).mock.calls[0][0];
-      expect(new URL(proxiedRequest.url).pathname).toBe('/api/auth/set-password');
-      expect(proxiedRequest.headers.get('Authorization')).toBe('Bearer test-token');
+    it('should return 400 when JSON body is malformed', async () => {
+      const res = await server.request('/api/auth/password/set', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer test-token' },
+        body: 'invalid-json-body',
+      });
+
+      expect(res.status).toBe(400);
+      const json = await res.json();
+      expect(json.message).toBeDefined();
+    });
+
+    it('should return 400 when auth.api.setPassword throws an error', async () => {
+      (auth.api.setPassword as any).mockRejectedValue(new Error('Invalid password strength'));
+
+      const res = await server.request('/api/auth/password/set', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer test-token' },
+        body: JSON.stringify({ newPassword: '123' }),
+      });
+
+      expect(res.status).toBe(400);
+      const json = await res.json();
+      expect(json.message).toBe('Invalid password strength');
     });
   });
 

src/server/server.ts

@@ -91,7 +91,39 @@ export function createServer() {
     return auth.handler(new Request(url, c.req.raw));
   }
 
-  app.post('/api/auth/password/set', (c) => proxyToAuth(c, '/api/auth/set-password'));
+  app.post('/api/auth/password/set', async (c) => {
+    try {
+      const { newPassword } = await c.req.json();
+      await auth.api.setPassword({
+        body: { newPassword },
+        headers: c.req.raw.headers,
+      });
+
+      const session = await auth.api.getSession({
+        headers: c.req.raw.headers,
+      });
+
+      if (session?.user?.email) {
+        await db
+          .update(schema.users)
+          .set({ status: 'verified', updatedAt: new Date() })
+          .where(eq(schema.users.email, session.user.email));
+        logger.info(`User status updated to verified for email: ${session.user.email}`);
+      } else {
+        logger.warn(
+          'Password set succeeded, but session or user email is missing. Skipped updating user status to verified.'
+        );
+      }
+
+      return c.json({ success: true });
+    } catch (err) {
+      logger.error('Failed to set password:', err);
+      return c.json(
+        { message: err instanceof Error ? err.message : 'Failed to set password' },
+        400
+      );
+    }
+  });
 
   // POST /api/auth/forget-password
   app.post('/api/auth/forget-password', (c) => proxyToAuth(c, '/api/auth/request-password-reset'));