text changes and remove infra folder

backend/tests/unit/middleware/csrf.test.js

@@ -1,21 +1,21 @@
 // Set CSRF_SECRET before requiring the middleware
-process.env.CSRF_SECRET = 'test-csrf-secret-that-is-at-least-32-chars-long';
+process.env.CSRF_SECRET = "test-csrf-secret";
 
 const mockTokensInstance = {
   secretSync: jest.fn().mockReturnValue(process.env.CSRF_SECRET),
-  create: jest.fn().mockReturnValue('mock-token-123'),
-  verify: jest.fn().mockReturnValue(true)
+  create: jest.fn().mockReturnValue("mock-token-123"),
+  verify: jest.fn().mockReturnValue(true),
 };
 
-jest.mock('csrf', () => {
+jest.mock("csrf", () => {
   return jest.fn().mockImplementation(() => mockTokensInstance);
 });
 
-jest.mock('cookie-parser', () => {
+jest.mock("cookie-parser", () => {
   return jest.fn().mockReturnValue((req, res, next) => next());
 });
 
-jest.mock('../../../utils/logger', () => ({
+jest.mock("../../../utils/logger", () => ({
   error: jest.fn(),
   info: jest.fn(),
   warn: jest.fn(),
@@ -26,18 +26,22 @@ jest.mock('../../../utils/logger', () => ({
   })),
 }));
 
-const { csrfProtection, generateCSRFToken, getCSRFToken } = require('../../../middleware/csrf');
+const {
+  csrfProtection,
+  generateCSRFToken,
+  getCSRFToken,
+} = require("../../../middleware/csrf");
 
-describe('CSRF Middleware', () => {
+describe("CSRF Middleware", () => {
   let req, res, next;
 
   beforeEach(() => {
     req = {
-      method: 'POST',
+      method: "POST",
       headers: {},
       body: {},
       query: {},
-      cookies: {}
+      cookies: {},
     };
     res = {
       status: jest.fn().mockReturnThis(),
@@ -45,16 +49,16 @@ describe('CSRF Middleware', () => {
       send: jest.fn(),
       cookie: jest.fn(),
       set: jest.fn(),
-      locals: {}
+      locals: {},
     };
     next = jest.fn();
     jest.clearAllMocks();
   });
 
-  describe('csrfProtection', () => {
-    describe('Safe methods', () => {
-      it('should skip CSRF protection for GET requests', () => {
-        req.method = 'GET';
+  describe("csrfProtection", () => {
+    describe("Safe methods", () => {
+      it("should skip CSRF protection for GET requests", () => {
+        req.method = "GET";
 
         csrfProtection(req, res, next);
 
@@ -62,8 +66,8 @@ describe('CSRF Middleware', () => {
         expect(res.status).not.toHaveBeenCalled();
       });
 
-      it('should skip CSRF protection for HEAD requests', () => {
-        req.method = 'HEAD';
+      it("should skip CSRF protection for HEAD requests", () => {
+        req.method = "HEAD";
 
         csrfProtection(req, res, next);
 
@@ -71,8 +75,8 @@ describe('CSRF Middleware', () => {
         expect(res.status).not.toHaveBeenCalled();
       });
 
-      it('should skip CSRF protection for OPTIONS requests', () => {
-        req.method = 'OPTIONS';
+      it("should skip CSRF protection for OPTIONS requests", () => {
+        req.method = "OPTIONS";
 
         csrfProtection(req, res, next);
 
@@ -81,389 +85,427 @@ describe('CSRF Middleware', () => {
       });
     });
 
-    describe('Token validation', () => {
+    describe("Token validation", () => {
       beforeEach(() => {
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+        req.cookies = { "csrf-token": "mock-token-123" };
       });
 
-      it('should validate token from x-csrf-token header', () => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
+      it("should validate token from x-csrf-token header", () => {
+        req.headers["x-csrf-token"] = "mock-token-123";
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
         expect(res.status).not.toHaveBeenCalled();
       });
 
-      it('should validate token from request body', () => {
-        req.body.csrfToken = 'mock-token-123';
+      it("should validate token from request body", () => {
+        req.body.csrfToken = "mock-token-123";
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
         expect(res.status).not.toHaveBeenCalled();
       });
 
-      it('should prefer header token over body token', () => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.body.csrfToken = 'different-token';
+      it("should prefer header token over body token", () => {
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.body.csrfToken = "different-token";
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
       });
-
     });
 
-    describe('Missing tokens', () => {
-      it('should return 403 when no token provided', () => {
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+    describe("Missing tokens", () => {
+      it("should return 403 when no token provided", () => {
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should return 403 when no cookie token provided', () => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
+      it("should return 403 when no cookie token provided", () => {
+        req.headers["x-csrf-token"] = "mock-token-123";
         req.cookies = {};
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should return 403 when cookies object is missing', () => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
+      it("should return 403 when cookies object is missing", () => {
+        req.headers["x-csrf-token"] = "mock-token-123";
         req.cookies = undefined;
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should return 403 when both tokens are missing', () => {
+      it("should return 403 when both tokens are missing", () => {
         req.cookies = {};
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
     });
 
-    describe('Token mismatch', () => {
-      it('should return 403 when tokens do not match', () => {
-        req.headers['x-csrf-token'] = 'token-from-header';
-        req.cookies = { 'csrf-token': 'token-from-cookie' };
+    describe("Token mismatch", () => {
+      it("should return 403 when tokens do not match", () => {
+        req.headers["x-csrf-token"] = "token-from-header";
+        req.cookies = { "csrf-token": "token-from-cookie" };
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should return 403 when header token is empty but cookie exists', () => {
-        req.headers['x-csrf-token'] = '';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+      it("should return 403 when header token is empty but cookie exists", () => {
+        req.headers["x-csrf-token"] = "";
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should return 403 when cookie token is empty but header exists', () => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': '' };
+      it("should return 403 when cookie token is empty but header exists", () => {
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "" };
 
         csrfProtection(req, res, next);
 
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_MISMATCH'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_MISMATCH",
         });
         expect(next).not.toHaveBeenCalled();
       });
     });
 
-    describe('Token verification', () => {
+    describe("Token verification", () => {
       beforeEach(() => {
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "mock-token-123" };
       });
 
-      it('should return 403 when token verification fails', () => {
+      it("should return 403 when token verification fails", () => {
         mockTokensInstance.verify.mockReturnValue(false);
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
-          error: 'Invalid CSRF token',
-          code: 'CSRF_TOKEN_INVALID'
+          error: "Invalid CSRF token",
+          code: "CSRF_TOKEN_INVALID",
         });
         expect(next).not.toHaveBeenCalled();
       });
 
-      it('should call next when token verification succeeds', () => {
+      it("should call next when token verification succeeds", () => {
         mockTokensInstance.verify.mockReturnValue(true);
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
         expect(res.status).not.toHaveBeenCalled();
       });
     });
 
-    describe('Edge cases', () => {
-      it('should handle case-insensitive HTTP methods', () => {
-        req.method = 'post';
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+    describe("Edge cases", () => {
+      it("should handle case-insensitive HTTP methods", () => {
+        req.method = "post";
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
       });
 
-      it('should handle PUT requests', () => {
-        req.method = 'PUT';
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+      it("should handle PUT requests", () => {
+        req.method = "PUT";
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
       });
 
-      it('should handle DELETE requests', () => {
-        req.method = 'DELETE';
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+      it("should handle DELETE requests", () => {
+        req.method = "DELETE";
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
       });
 
-      it('should handle PATCH requests', () => {
-        req.method = 'PATCH';
-        req.headers['x-csrf-token'] = 'mock-token-123';
-        req.cookies = { 'csrf-token': 'mock-token-123' };
+      it("should handle PATCH requests", () => {
+        req.method = "PATCH";
+        req.headers["x-csrf-token"] = "mock-token-123";
+        req.cookies = { "csrf-token": "mock-token-123" };
 
         csrfProtection(req, res, next);
 
-        expect(mockTokensInstance.verify).toHaveBeenCalledWith(process.env.CSRF_SECRET, 'mock-token-123');
+        expect(mockTokensInstance.verify).toHaveBeenCalledWith(
+          process.env.CSRF_SECRET,
+          "mock-token-123",
+        );
         expect(next).toHaveBeenCalled();
       });
     });
   });
 
-  describe('generateCSRFToken', () => {
-    it('should generate token and set cookie with proper options', () => {
-      process.env.NODE_ENV = 'production';
+  describe("generateCSRFToken", () => {
+    it("should generate token and set cookie with proper options", () => {
+      process.env.NODE_ENV = "production";
 
       generateCSRFToken(req, res, next);
 
-      expect(mockTokensInstance.create).toHaveBeenCalledWith(process.env.CSRF_SECRET);
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(mockTokensInstance.create).toHaveBeenCalledWith(
+        process.env.CSRF_SECRET,
+      );
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: true,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
       expect(next).toHaveBeenCalled();
     });
 
-    it('should set secure flag to false in dev environment', () => {
-      process.env.NODE_ENV = 'dev';
+    it("should set secure flag to false in dev environment", () => {
+      process.env.NODE_ENV = "dev";
 
       generateCSRFToken(req, res, next);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: false,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should set secure flag to true in non-dev environment', () => {
-      process.env.NODE_ENV = 'production';
+    it("should set secure flag to true in non-dev environment", () => {
+      process.env.NODE_ENV = "production";
 
       generateCSRFToken(req, res, next);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: true,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should set token in response header', () => {
+    it("should set token in response header", () => {
       generateCSRFToken(req, res, next);
 
-      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'mock-token-123');
+      expect(res.set).toHaveBeenCalledWith("X-CSRF-Token", "mock-token-123");
     });
 
-    it('should make token available in res.locals', () => {
+    it("should make token available in res.locals", () => {
       generateCSRFToken(req, res, next);
 
-      expect(res.locals.csrfToken).toBe('mock-token-123');
+      expect(res.locals.csrfToken).toBe("mock-token-123");
     });
 
-    it('should call next after setting up token', () => {
+    it("should call next after setting up token", () => {
       generateCSRFToken(req, res, next);
 
       expect(next).toHaveBeenCalled();
     });
 
-    it('should handle test environment', () => {
-      process.env.NODE_ENV = 'test';
+    it("should handle test environment", () => {
+      process.env.NODE_ENV = "test";
 
       generateCSRFToken(req, res, next);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: false,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should handle undefined NODE_ENV', () => {
+    it("should handle undefined NODE_ENV", () => {
       delete process.env.NODE_ENV;
 
       generateCSRFToken(req, res, next);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: false,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
   });
 
-  describe('getCSRFToken', () => {
-    it('should generate token and return it in response', () => {
-      process.env.NODE_ENV = 'production';
+  describe("getCSRFToken", () => {
+    it("should generate token and return it in response", () => {
+      process.env.NODE_ENV = "production";
 
       getCSRFToken(req, res);
 
-      expect(mockTokensInstance.create).toHaveBeenCalledWith(process.env.CSRF_SECRET);
+      expect(mockTokensInstance.create).toHaveBeenCalledWith(
+        process.env.CSRF_SECRET,
+      );
       expect(res.status).toHaveBeenCalledWith(204);
       expect(res.send).toHaveBeenCalled();
     });
 
-    it('should set token in cookie with proper options', () => {
-      process.env.NODE_ENV = 'production';
+    it("should set token in cookie with proper options", () => {
+      process.env.NODE_ENV = "production";
 
       getCSRFToken(req, res);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: true,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should set secure flag to false in dev environment', () => {
-      process.env.NODE_ENV = 'dev';
+    it("should set secure flag to false in dev environment", () => {
+      process.env.NODE_ENV = "dev";
 
       getCSRFToken(req, res);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: false,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should set secure flag to true in production environment', () => {
-      process.env.NODE_ENV = 'production';
+    it("should set secure flag to true in production environment", () => {
+      process.env.NODE_ENV = "production";
 
       getCSRFToken(req, res);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: true,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should handle test environment', () => {
-      process.env.NODE_ENV = 'test';
+    it("should handle test environment", () => {
+      process.env.NODE_ENV = "test";
 
       getCSRFToken(req, res);
 
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'mock-token-123', {
+      expect(res.cookie).toHaveBeenCalledWith("csrf-token", "mock-token-123", {
         httpOnly: true,
         secure: false,
-        sameSite: 'strict',
-        maxAge: 60 * 60 * 1000
+        sameSite: "strict",
+        maxAge: 60 * 60 * 1000,
       });
     });
 
-    it('should generate new token each time', () => {
+    it("should generate new token each time", () => {
       mockTokensInstance.create
-        .mockReturnValueOnce('token-1')
-        .mockReturnValueOnce('token-2');
+        .mockReturnValueOnce("token-1")
+        .mockReturnValueOnce("token-2");
 
       getCSRFToken(req, res);
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-1', expect.any(Object));
-      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-1');
+      expect(res.cookie).toHaveBeenCalledWith(
+        "csrf-token",
+        "token-1",
+        expect.any(Object),
+      );
+      expect(res.set).toHaveBeenCalledWith("X-CSRF-Token", "token-1");
 
       jest.clearAllMocks();
       getCSRFToken(req, res);
-      expect(res.cookie).toHaveBeenCalledWith('csrf-token', 'token-2', expect.any(Object));
-      expect(res.set).toHaveBeenCalledWith('X-CSRF-Token', 'token-2');
+      expect(res.cookie).toHaveBeenCalledWith(
+        "csrf-token",
+        "token-2",
+        expect.any(Object),
+      );
+      expect(res.set).toHaveBeenCalledWith("X-CSRF-Token", "token-2");
     });
   });
 
-  describe('Integration scenarios', () => {
-    it('should handle complete CSRF flow', () => {
+  describe("Integration scenarios", () => {
+    it("should handle complete CSRF flow", () => {
       // First, generate a token
       generateCSRFToken(req, res, next);
       const generatedToken = res.locals.csrfToken;
@@ -472,9 +514,9 @@ describe('CSRF Middleware', () => {
       jest.clearAllMocks();
 
       // Now test protection with the generated token
-      req.method = 'POST';
-      req.headers['x-csrf-token'] = generatedToken;
-      req.cookies = { 'csrf-token': generatedToken };
+      req.method = "POST";
+      req.headers["x-csrf-token"] = generatedToken;
+      req.cookies = { "csrf-token": generatedToken };
 
       csrfProtection(req, res, next);
 
@@ -482,18 +524,18 @@ describe('CSRF Middleware', () => {
       expect(res.status).not.toHaveBeenCalled();
     });
 
-    it('should handle token generation endpoint flow', () => {
+    it("should handle token generation endpoint flow", () => {
       getCSRFToken(req, res);
 
       const cookieCall = res.cookie.mock.calls[0];
       const headerCall = res.set.mock.calls[0];
 
-      expect(cookieCall[0]).toBe('csrf-token');
-      expect(cookieCall[1]).toBe('mock-token-123');
-      expect(headerCall[0]).toBe('X-CSRF-Token');
-      expect(headerCall[1]).toBe('mock-token-123');
+      expect(cookieCall[0]).toBe("csrf-token");
+      expect(cookieCall[1]).toBe("mock-token-123");
+      expect(headerCall[0]).toBe("X-CSRF-Token");
+      expect(headerCall[1]).toBe("mock-token-123");
       expect(res.status).toHaveBeenCalledWith(204);
       expect(res.send).toHaveBeenCalled();
     });
   });
-});
+});

backend/tests/unit/services/TwoFactorService.test.js

@@ -1,10 +1,10 @@
-const crypto = require('crypto');
-const bcrypt = require('bcryptjs');
-const { authenticator } = require('otplib');
-const QRCode = require('qrcode');
+const crypto = require("crypto");
+const bcrypt = require("bcryptjs");
+const { authenticator } = require("otplib");
+const QRCode = require("qrcode");
 
 // Mock dependencies
-jest.mock('otplib', () => ({
+jest.mock("otplib", () => ({
   authenticator: {
     generateSecret: jest.fn(),
     keyuri: jest.fn(),
@@ -12,34 +12,34 @@ jest.mock('otplib', () => ({
   },
 }));
 
-jest.mock('qrcode', () => ({
+jest.mock("qrcode", () => ({
   toDataURL: jest.fn(),
 }));
 
-jest.mock('bcryptjs', () => ({
+jest.mock("bcryptjs", () => ({
   hash: jest.fn(),
   compare: jest.fn(),
 }));
 
-jest.mock('../../../utils/logger', () => ({
+jest.mock("../../../utils/logger", () => ({
   info: jest.fn(),
   error: jest.fn(),
   warn: jest.fn(),
 }));
 
-const TwoFactorService = require('../../../services/TwoFactorService');
+const TwoFactorService = require("../../../services/TwoFactorService");
 
-describe('TwoFactorService', () => {
+describe("TwoFactorService", () => {
   const originalEnv = process.env;
 
   beforeEach(() => {
     jest.clearAllMocks();
     process.env = {
       ...originalEnv,
-      TOTP_ENCRYPTION_KEY: 'a'.repeat(64), // 64 hex chars = 32 bytes
-      TOTP_ISSUER: 'TestApp',
-      TWO_FACTOR_EMAIL_OTP_EXPIRY_MINUTES: '10',
-      TWO_FACTOR_STEP_UP_VALIDITY_MINUTES: '5',
+      TOTP_ENCRYPTION_KEY: "a".repeat(64),
+      TOTP_ISSUER: "TestApp",
+      TWO_FACTOR_EMAIL_OTP_EXPIRY_MINUTES: "10",
+      TWO_FACTOR_STEP_UP_VALIDITY_MINUTES: "5",
     };
   });
 
@@ -47,91 +47,117 @@ describe('TwoFactorService', () => {
     process.env = originalEnv;
   });
 
-  describe('generateTotpSecret', () => {
-    it('should generate TOTP secret with QR code', async () => {
-      authenticator.generateSecret.mockReturnValue('test-secret');
-      authenticator.keyuri.mockReturnValue('otpauth://totp/VillageShare:test@example.com?secret=test-secret');
-      QRCode.toDataURL.mockResolvedValue('data:image/png;base64,qrcode');
+  describe("generateTotpSecret", () => {
+    it("should generate TOTP secret with QR code", async () => {
+      authenticator.generateSecret.mockReturnValue("test-secret");
+      authenticator.keyuri.mockReturnValue(
+        "otpauth://totp/VillageShare:test@example.com?secret=test-secret",
+      );
+      QRCode.toDataURL.mockResolvedValue("data:image/png;base64,qrcode");
 
-      const result = await TwoFactorService.generateTotpSecret('test@example.com');
+      const result =
+        await TwoFactorService.generateTotpSecret("test@example.com");
 
-      expect(result.qrCodeDataUrl).toBe('data:image/png;base64,qrcode');
+      expect(result.qrCodeDataUrl).toBe("data:image/png;base64,qrcode");
       expect(result.encryptedSecret).toBeDefined();
       expect(result.encryptedSecretIv).toBeDefined();
       // The issuer is loaded at module load time, so it uses the default 'VillageShare'
-      expect(authenticator.keyuri).toHaveBeenCalledWith('test@example.com', 'VillageShare', 'test-secret');
+      expect(authenticator.keyuri).toHaveBeenCalledWith(
+        "test@example.com",
+        "VillageShare",
+        "test-secret",
+      );
     });
 
-    it('should use issuer from environment', async () => {
-      authenticator.generateSecret.mockReturnValue('test-secret');
-      authenticator.keyuri.mockReturnValue('otpauth://totp/VillageShare:test@example.com');
-      QRCode.toDataURL.mockResolvedValue('data:image/png;base64,qrcode');
+    it("should use issuer from environment", async () => {
+      authenticator.generateSecret.mockReturnValue("test-secret");
+      authenticator.keyuri.mockReturnValue(
+        "otpauth://totp/VillageShare:test@example.com",
+      );
+      QRCode.toDataURL.mockResolvedValue("data:image/png;base64,qrcode");
 
-      const result = await TwoFactorService.generateTotpSecret('test@example.com');
+      const result =
+        await TwoFactorService.generateTotpSecret("test@example.com");
 
       expect(result.qrCodeDataUrl).toBeDefined();
       expect(authenticator.keyuri).toHaveBeenCalled();
     });
   });
 
-  describe('verifyTotpCode', () => {
-    it('should return true for valid code', () => {
+  describe("verifyTotpCode", () => {
+    it("should return true for valid code", () => {
       authenticator.verify.mockReturnValue(true);
 
       // Use actual encryption
-      const { encrypted, iv } = TwoFactorService._encryptSecret('test-secret');
-      const result = TwoFactorService.verifyTotpCode(encrypted, iv, '123456');
+      const { encrypted, iv } = TwoFactorService._encryptSecret("test-secret");
+      const result = TwoFactorService.verifyTotpCode(encrypted, iv, "123456");
 
       expect(result).toBe(true);
     });
 
-    it('should return false for invalid code', () => {
+    it("should return false for invalid code", () => {
       authenticator.verify.mockReturnValue(false);
 
-      const { encrypted, iv } = TwoFactorService._encryptSecret('test-secret');
-      const result = TwoFactorService.verifyTotpCode(encrypted, iv, '654321');
+      const { encrypted, iv } = TwoFactorService._encryptSecret("test-secret");
+      const result = TwoFactorService.verifyTotpCode(encrypted, iv, "654321");
 
       expect(result).toBe(false);
     });
 
-    it('should return false for non-6-digit code', () => {
-      const result = TwoFactorService.verifyTotpCode('encrypted', 'iv', '12345');
+    it("should return false for non-6-digit code", () => {
+      const result = TwoFactorService.verifyTotpCode(
+        "encrypted",
+        "iv",
+        "12345",
+      );
       expect(result).toBe(false);
 
-      const result2 = TwoFactorService.verifyTotpCode('encrypted', 'iv', '1234567');
+      const result2 = TwoFactorService.verifyTotpCode(
+        "encrypted",
+        "iv",
+        "1234567",
+      );
       expect(result2).toBe(false);
 
-      const result3 = TwoFactorService.verifyTotpCode('encrypted', 'iv', 'abcdef');
+      const result3 = TwoFactorService.verifyTotpCode(
+        "encrypted",
+        "iv",
+        "abcdef",
+      );
       expect(result3).toBe(false);
     });
 
-    it('should return false when decryption fails', () => {
-      const result = TwoFactorService.verifyTotpCode('invalid-encrypted', 'invalid-iv', '123456');
+    it("should return false when decryption fails", () => {
+      const result = TwoFactorService.verifyTotpCode(
+        "invalid-encrypted",
+        "invalid-iv",
+        "123456",
+      );
       expect(result).toBe(false);
     });
   });
 
-  describe('generateEmailOtp', () => {
-    it('should generate 6-digit code', () => {
+  describe("generateEmailOtp", () => {
+    it("should generate 6-digit code", () => {
       const result = TwoFactorService.generateEmailOtp();
 
       expect(result.code).toMatch(/^\d{6}$/);
     });
 
-    it('should return hashed code', () => {
+    it("should return hashed code", () => {
       const result = TwoFactorService.generateEmailOtp();
 
       expect(result.hashedCode).toHaveLength(64); // SHA-256 hex
     });
 
-    it('should set expiry in the future', () => {
+    it("should set expiry in the future", () => {
       const result = TwoFactorService.generateEmailOtp();
       const now = new Date();
 
       expect(result.expiry.getTime()).toBeGreaterThan(now.getTime());
     });
 
-    it('should generate different codes each time', () => {
+    it("should generate different codes each time", () => {
       const result1 = TwoFactorService.generateEmailOtp();
       const result2 = TwoFactorService.generateEmailOtp();
 
@@ -140,10 +166,10 @@ describe('TwoFactorService', () => {
     });
   });
 
-  describe('verifyEmailOtp', () => {
-    it('should return true for valid code', () => {
-      const code = '123456';
-      const hashedCode = crypto.createHash('sha256').update(code).digest('hex');
+  describe("verifyEmailOtp", () => {
+    it("should return true for valid code", () => {
+      const code = "123456";
+      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");
       const expiry = new Date(Date.now() + 600000); // 10 minutes from now
 
       const result = TwoFactorService.verifyEmailOtp(code, hashedCode, expiry);
@@ -151,18 +177,25 @@ describe('TwoFactorService', () => {
       expect(result).toBe(true);
     });
 
-    it('should return false for invalid code', () => {
-      const correctHash = crypto.createHash('sha256').update('123456').digest('hex');
+    it("should return false for invalid code", () => {
+      const correctHash = crypto
+        .createHash("sha256")
+        .update("123456")
+        .digest("hex");
       const expiry = new Date(Date.now() + 600000);
 
-      const result = TwoFactorService.verifyEmailOtp('654321', correctHash, expiry);
+      const result = TwoFactorService.verifyEmailOtp(
+        "654321",
+        correctHash,
+        expiry,
+      );
 
       expect(result).toBe(false);
     });
 
-    it('should return false for expired code', () => {
-      const code = '123456';
-      const hashedCode = crypto.createHash('sha256').update(code).digest('hex');
+    it("should return false for expired code", () => {
+      const code = "123456";
+      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");
       const expiry = new Date(Date.now() - 60000); // 1 minute ago
 
       const result = TwoFactorService.verifyEmailOtp(code, hashedCode, expiry);
@@ -170,18 +203,27 @@ describe('TwoFactorService', () => {
       expect(result).toBe(false);
     });
 
-    it('should return false for non-6-digit code', () => {
-      const hashedCode = crypto.createHash('sha256').update('123456').digest('hex');
+    it("should return false for non-6-digit code", () => {
+      const hashedCode = crypto
+        .createHash("sha256")
+        .update("123456")
+        .digest("hex");
       const expiry = new Date(Date.now() + 600000);
 
-      expect(TwoFactorService.verifyEmailOtp('12345', hashedCode, expiry)).toBe(false);
-      expect(TwoFactorService.verifyEmailOtp('1234567', hashedCode, expiry)).toBe(false);
-      expect(TwoFactorService.verifyEmailOtp('abcdef', hashedCode, expiry)).toBe(false);
+      expect(TwoFactorService.verifyEmailOtp("12345", hashedCode, expiry)).toBe(
+        false,
+      );
+      expect(
+        TwoFactorService.verifyEmailOtp("1234567", hashedCode, expiry),
+      ).toBe(false);
+      expect(
+        TwoFactorService.verifyEmailOtp("abcdef", hashedCode, expiry),
+      ).toBe(false);
     });
 
-    it('should return false when no expiry provided', () => {
-      const code = '123456';
-      const hashedCode = crypto.createHash('sha256').update(code).digest('hex');
+    it("should return false when no expiry provided", () => {
+      const code = "123456";
+      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");
 
       const result = TwoFactorService.verifyEmailOtp(code, hashedCode, null);
 
@@ -189,9 +231,9 @@ describe('TwoFactorService', () => {
     });
   });
 
-  describe('generateRecoveryCodes', () => {
-    it('should generate 10 recovery codes', async () => {
-      bcrypt.hash.mockResolvedValue('hashed-code');
+  describe("generateRecoveryCodes", () => {
+    it("should generate 10 recovery codes", async () => {
+      bcrypt.hash.mockResolvedValue("hashed-code");
 
       const result = await TwoFactorService.generateRecoveryCodes();
 
@@ -199,31 +241,31 @@ describe('TwoFactorService', () => {
       expect(result.hashedCodes).toHaveLength(10);
     });
 
-    it('should generate codes in XXXX-XXXX format', async () => {
-      bcrypt.hash.mockResolvedValue('hashed-code');
+    it("should generate codes in XXXX-XXXX format", async () => {
+      bcrypt.hash.mockResolvedValue("hashed-code");
 
       const result = await TwoFactorService.generateRecoveryCodes();
 
-      result.codes.forEach(code => {
+      result.codes.forEach((code) => {
         expect(code).toMatch(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/);
       });
     });
 
-    it('should exclude confusing characters', async () => {
-      bcrypt.hash.mockResolvedValue('hashed-code');
+    it("should exclude confusing characters", async () => {
+      bcrypt.hash.mockResolvedValue("hashed-code");
 
       const result = await TwoFactorService.generateRecoveryCodes();
 
-      const confusingChars = ['0', 'O', '1', 'I', 'L'];
-      result.codes.forEach(code => {
-        confusingChars.forEach(char => {
+      const confusingChars = ["0", "O", "1", "I", "L"];
+      result.codes.forEach((code) => {
+        confusingChars.forEach((char) => {
           expect(code).not.toContain(char);
         });
       });
     });
 
-    it('should hash each code with bcrypt', async () => {
-      bcrypt.hash.mockResolvedValue('hashed-code');
+    it("should hash each code with bcrypt", async () => {
+      bcrypt.hash.mockResolvedValue("hashed-code");
 
       await TwoFactorService.generateRecoveryCodes();
 
@@ -231,104 +273,114 @@ describe('TwoFactorService', () => {
     });
   });
 
-  describe('verifyRecoveryCode', () => {
-    it('should return valid for correct code (new format)', async () => {
+  describe("verifyRecoveryCode", () => {
+    it("should return valid for correct code (new format)", async () => {
       bcrypt.compare.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
 
       const recoveryData = {
         version: 1,
         codes: [
-          { hash: 'hash1', used: false, index: 0 },
-          { hash: 'hash2', used: false, index: 1 },
+          { hash: "hash1", used: false, index: 0 },
+          { hash: "hash2", used: false, index: 1 },
         ],
       };
 
-      const result = await TwoFactorService.verifyRecoveryCode('XXXX-YYYY', recoveryData);
+      const result = await TwoFactorService.verifyRecoveryCode(
+        "XXXX-YYYY",
+        recoveryData,
+      );
 
       expect(result.valid).toBe(true);
       expect(result.index).toBe(1);
     });
 
-    it('should return invalid for incorrect code', async () => {
+    it("should return invalid for incorrect code", async () => {
       bcrypt.compare.mockResolvedValue(false);
 
       const recoveryData = {
         version: 1,
-        codes: [
-          { hash: 'hash1', used: false, index: 0 },
-        ],
+        codes: [{ hash: "hash1", used: false, index: 0 }],
       };
 
-      const result = await TwoFactorService.verifyRecoveryCode('XXXX-YYYY', recoveryData);
+      const result = await TwoFactorService.verifyRecoveryCode(
+        "XXXX-YYYY",
+        recoveryData,
+      );
 
       expect(result.valid).toBe(false);
       expect(result.index).toBe(-1);
     });
 
-    it('should skip used codes', async () => {
+    it("should skip used codes", async () => {
       bcrypt.compare.mockResolvedValue(true);
 
       const recoveryData = {
         version: 1,
         codes: [
-          { hash: 'hash1', used: true, index: 0 },
-          { hash: 'hash2', used: false, index: 1 },
+          { hash: "hash1", used: true, index: 0 },
+          { hash: "hash2", used: false, index: 1 },
         ],
       };
 
-      await TwoFactorService.verifyRecoveryCode('XXXX-YYYY', recoveryData);
+      await TwoFactorService.verifyRecoveryCode("XXXX-YYYY", recoveryData);
 
       // Should only check the unused code
       expect(bcrypt.compare).toHaveBeenCalledTimes(1);
     });
 
-    it('should normalize input code to uppercase', async () => {
+    it("should normalize input code to uppercase", async () => {
       bcrypt.compare.mockResolvedValue(true);
 
       const recoveryData = {
         version: 1,
-        codes: [{ hash: 'hash1', used: false, index: 0 }],
+        codes: [{ hash: "hash1", used: false, index: 0 }],
       };
 
-      await TwoFactorService.verifyRecoveryCode('xxxx-yyyy', recoveryData);
+      await TwoFactorService.verifyRecoveryCode("xxxx-yyyy", recoveryData);
 
-      expect(bcrypt.compare).toHaveBeenCalledWith('XXXX-YYYY', 'hash1');
+      expect(bcrypt.compare).toHaveBeenCalledWith("XXXX-YYYY", "hash1");
     });
 
-    it('should return invalid for wrong format', async () => {
+    it("should return invalid for wrong format", async () => {
       const recoveryData = {
         version: 1,
-        codes: [{ hash: 'hash1', used: false, index: 0 }],
+        codes: [{ hash: "hash1", used: false, index: 0 }],
       };
 
-      const result = await TwoFactorService.verifyRecoveryCode('INVALID', recoveryData);
+      const result = await TwoFactorService.verifyRecoveryCode(
+        "INVALID",
+        recoveryData,
+      );
 
       expect(result.valid).toBe(false);
     });
 
-    it('should handle legacy array format', async () => {
+    it("should handle legacy array format", async () => {
       bcrypt.compare.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
 
-      const recoveryData = ['hash1', 'hash2', 'hash3'];
+      const recoveryData = ["hash1", "hash2", "hash3"];
 
-      const result = await TwoFactorService.verifyRecoveryCode('XXXX-YYYY', recoveryData);
+      const result = await TwoFactorService.verifyRecoveryCode(
+        "XXXX-YYYY",
+        recoveryData,
+      );
 
       expect(result.valid).toBe(true);
     });
 
-    it('should skip null entries in legacy format', async () => {
+    it("should skip null entries in legacy format", async () => {
       bcrypt.compare.mockResolvedValue(true);
 
-      const recoveryData = [null, 'hash2'];
+      const recoveryData = [null, "hash2"];
 
-      await TwoFactorService.verifyRecoveryCode('XXXX-YYYY', recoveryData);
+      await TwoFactorService.verifyRecoveryCode("XXXX-YYYY", recoveryData);
 
       expect(bcrypt.compare).toHaveBeenCalledTimes(1);
     });
   });
 
-  describe('validateStepUpSession', () => {
-    it('should return true for valid session', () => {
+  describe("validateStepUpSession", () => {
+    it("should return true for valid session", () => {
       const user = {
         twoFactorVerifiedAt: new Date(Date.now() - 60000), // 1 minute ago
       };
@@ -338,7 +390,7 @@ describe('TwoFactorService', () => {
       expect(result).toBe(true);
     });
 
-    it('should return false for expired session', () => {
+    it("should return false for expired session", () => {
       const user = {
         twoFactorVerifiedAt: new Date(Date.now() - 600000), // 10 minutes ago
       };
@@ -348,7 +400,7 @@ describe('TwoFactorService', () => {
       expect(result).toBe(false);
     });
 
-    it('should return false when no verification timestamp', () => {
+    it("should return false when no verification timestamp", () => {
       const user = {
         twoFactorVerifiedAt: null,
       };
@@ -358,7 +410,7 @@ describe('TwoFactorService', () => {
       expect(result).toBe(false);
     });
 
-    it('should use custom max age when provided', () => {
+    it("should use custom max age when provided", () => {
       const user = {
         twoFactorVerifiedAt: new Date(Date.now() - 1200000), // 20 minutes ago
       };
@@ -369,85 +421,88 @@ describe('TwoFactorService', () => {
     });
   });
 
-  describe('getRemainingRecoveryCodesCount', () => {
-    it('should return count for new format', () => {
+  describe("getRemainingRecoveryCodesCount", () => {
+    it("should return count for new format", () => {
       const recoveryData = {
         version: 1,
         codes: [
-          { hash: 'hash1', used: false },
-          { hash: 'hash2', used: true },
-          { hash: 'hash3', used: false },
+          { hash: "hash1", used: false },
+          { hash: "hash2", used: true },
+          { hash: "hash3", used: false },
         ],
       };
 
-      const result = TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
+      const result =
+        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
 
       expect(result).toBe(2);
     });
 
-    it('should return count for legacy array format', () => {
-      const recoveryData = ['hash1', null, 'hash3', 'hash4', null];
+    it("should return count for legacy array format", () => {
+      const recoveryData = ["hash1", null, "hash3", "hash4", null];
 
-      const result = TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
+      const result =
+        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
 
       expect(result).toBe(3);
     });
 
-    it('should return 0 for null data', () => {
+    it("should return 0 for null data", () => {
       const result = TwoFactorService.getRemainingRecoveryCodesCount(null);
       expect(result).toBe(0);
     });
 
-    it('should return 0 for undefined data', () => {
+    it("should return 0 for undefined data", () => {
       const result = TwoFactorService.getRemainingRecoveryCodesCount(undefined);
       expect(result).toBe(0);
     });
 
-    it('should handle empty array', () => {
+    it("should handle empty array", () => {
       const result = TwoFactorService.getRemainingRecoveryCodesCount([]);
       expect(result).toBe(0);
     });
 
-    it('should handle all used codes', () => {
+    it("should handle all used codes", () => {
       const recoveryData = {
         version: 1,
         codes: [
-          { hash: 'hash1', used: true },
-          { hash: 'hash2', used: true },
+          { hash: "hash1", used: true },
+          { hash: "hash2", used: true },
         ],
       };
 
-      const result = TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
+      const result =
+        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);
 
       expect(result).toBe(0);
     });
   });
 
-  describe('isEmailOtpLocked', () => {
-    it('should return true when max attempts reached', () => {
+  describe("isEmailOtpLocked", () => {
+    it("should return true when max attempts reached", () => {
       const result = TwoFactorService.isEmailOtpLocked(3);
       expect(result).toBe(true);
     });
 
-    it('should return true when over max attempts', () => {
+    it("should return true when over max attempts", () => {
       const result = TwoFactorService.isEmailOtpLocked(5);
       expect(result).toBe(true);
     });
 
-    it('should return false when under max attempts', () => {
+    it("should return false when under max attempts", () => {
       const result = TwoFactorService.isEmailOtpLocked(2);
       expect(result).toBe(false);
     });
 
-    it('should return false for zero attempts', () => {
+    it("should return false for zero attempts", () => {
       const result = TwoFactorService.isEmailOtpLocked(0);
       expect(result).toBe(false);
     });
   });
 
-  describe('_encryptSecret / _decryptSecret', () => {
-    it('should encrypt and decrypt correctly', () => {
-      const secret = 'my-test-secret';
+  describe("_encryptSecret / _decryptSecret", () => {
+    it("should encrypt and decrypt correctly", () => {
+      const secret = "my-test-secret";
 
       const { encrypted, iv } = TwoFactorService._encryptSecret(secret);
       const decrypted = TwoFactorService._decryptSecret(encrypted, iv);
@@ -455,16 +510,20 @@ describe('TwoFactorService', () => {
       expect(decrypted).toBe(secret);
     });
 
-    it('should throw error when encryption key is missing', () => {
+    it("should throw error when encryption key is missing", () => {
       delete process.env.TOTP_ENCRYPTION_KEY;
 
-      expect(() => TwoFactorService._encryptSecret('test')).toThrow('TOTP_ENCRYPTION_KEY');
+      expect(() => TwoFactorService._encryptSecret("test")).toThrow(
+        "TOTP_ENCRYPTION_KEY",
+      );
     });
 
-    it('should throw error when encryption key is wrong length', () => {
-      process.env.TOTP_ENCRYPTION_KEY = 'short';
+    it("should throw error when encryption key is wrong length", () => {
+      process.env.TOTP_ENCRYPTION_KEY = "short";
 
-      expect(() => TwoFactorService._encryptSecret('test')).toThrow('64-character hex string');
+      expect(() => TwoFactorService._encryptSecret("test")).toThrow(
+        "64-character hex string",
+      );
     });
   });
 });

backend/tests/unit/services/email/EmailClient.test.js

@@ -1,34 +1,34 @@
 // Mock AWS SDK before requiring modules
-jest.mock('@aws-sdk/client-ses', () => ({
+jest.mock("@aws-sdk/client-ses", () => ({
   SESClient: jest.fn().mockImplementation(() => ({
     send: jest.fn(),
   })),
   SendEmailCommand: jest.fn(),
 }));
 
-jest.mock('../../../../config/aws', () => ({
-  getAWSConfig: jest.fn(() => ({ region: 'us-east-1' })),
+jest.mock("../../../../config/aws", () => ({
+  getAWSConfig: jest.fn(() => ({ region: "us-east-1" })),
 }));
 
-jest.mock('../../../../services/email/core/emailUtils', () => ({
-  htmlToPlainText: jest.fn((html) => html.replace(/<[^>]*>/g, '')),
+jest.mock("../../../../services/email/core/emailUtils", () => ({
+  htmlToPlainText: jest.fn((html) => html.replace(/<[^>]*>/g, "")),
 }));
 
 // Clear singleton between tests
 beforeEach(() => {
   jest.clearAllMocks();
   // Reset the singleton instance
-  const EmailClient = require('../../../../services/email/core/EmailClient');
+  const EmailClient = require("../../../../services/email/core/EmailClient");
   EmailClient.instance = null;
 });
 
-describe('EmailClient', () => {
-  const { SESClient, SendEmailCommand } = require('@aws-sdk/client-ses');
-  const { getAWSConfig } = require('../../../../config/aws');
+describe("EmailClient", () => {
+  const { SESClient, SendEmailCommand } = require("@aws-sdk/client-ses");
+  const { getAWSConfig } = require("../../../../config/aws");
 
-  describe('constructor', () => {
-    it('should create a new instance', () => {
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+  describe("constructor", () => {
+    it("should create a new instance", () => {
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
       expect(client).toBeDefined();
@@ -36,8 +36,8 @@ describe('EmailClient', () => {
       expect(client.initialized).toBe(false);
     });
 
-    it('should return existing instance (singleton pattern)', () => {
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+    it("should return existing instance (singleton pattern)", () => {
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client1 = new EmailClient();
       const client2 = new EmailClient();
@@ -45,21 +45,21 @@ describe('EmailClient', () => {
     });
   });
 
-  describe('initialize', () => {
-    it('should initialize SES client with AWS config', async () => {
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+  describe("initialize", () => {
+    it("should initialize SES client with AWS config", async () => {
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       await client.initialize();
 
       expect(getAWSConfig).toHaveBeenCalled();
-      expect(SESClient).toHaveBeenCalledWith({ region: 'us-east-1' });
+      expect(SESClient).toHaveBeenCalledWith({ region: "us-east-1" });
       expect(client.initialized).toBe(true);
     });
 
-    it('should not re-initialize if already initialized', async () => {
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+    it("should not re-initialize if already initialized", async () => {
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
@@ -69,8 +69,8 @@ describe('EmailClient', () => {
       expect(SESClient).toHaveBeenCalledTimes(1);
     });
 
-    it('should wait for existing initialization if in progress', async () => {
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+    it("should wait for existing initialization if in progress", async () => {
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
@@ -83,28 +83,28 @@ describe('EmailClient', () => {
       expect(SESClient).toHaveBeenCalledTimes(1);
     });
 
-    it('should throw error if AWS config fails', async () => {
+    it("should throw error if AWS config fails", async () => {
       getAWSConfig.mockImplementationOnce(() => {
-        throw new Error('AWS config error');
+        throw new Error("AWS config error");
       });
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
-      await expect(client.initialize()).rejects.toThrow('AWS config error');
+      await expect(client.initialize()).rejects.toThrow("AWS config error");
     });
   });
 
-  describe('sendEmail', () => {
+  describe("sendEmail", () => {
     const originalEnv = process.env;
 
     beforeEach(() => {
       process.env = {
         ...originalEnv,
-        EMAIL_ENABLED: 'true',
-        SES_FROM_EMAIL: 'noreply@villageshare.app',
-        SES_FROM_NAME: 'Village Share',
+        EMAIL_ENABLED: "true",
+        SES_FROM_EMAIL: "noreply@email.com",
+        SES_FROM_NAME: "Village Share",
       };
     });
 
@@ -112,114 +112,114 @@ describe('EmailClient', () => {
       process.env = originalEnv;
     });
 
-    it('should return early if EMAIL_ENABLED is not true', async () => {
-      process.env.EMAIL_ENABLED = 'false';
+    it("should return early if EMAIL_ENABLED is not true", async () => {
+      process.env.EMAIL_ENABLED = "false";
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       const result = await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
-      expect(result).toEqual({ success: true, messageId: 'disabled' });
+      expect(result).toEqual({ success: true, messageId: "disabled" });
     });
 
-    it('should return early if EMAIL_ENABLED is not set', async () => {
+    it("should return early if EMAIL_ENABLED is not set", async () => {
       delete process.env.EMAIL_ENABLED;
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       const result = await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
-      expect(result).toEqual({ success: true, messageId: 'disabled' });
+      expect(result).toEqual({ success: true, messageId: "disabled" });
     });
 
-    it('should send email with correct parameters', async () => {
-      const mockSend = jest.fn().mockResolvedValue({ MessageId: 'msg-123' });
+    it("should send email with correct parameters", async () => {
+      const mockSend = jest.fn().mockResolvedValue({ MessageId: "msg-123" });
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       const result = await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello World</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello World</p>",
       );
 
       expect(SendEmailCommand).toHaveBeenCalledWith({
-        Source: 'Village Share <noreply@villageshare.app>',
+        Source: "Village Share <noreply@villageshare.app>",
         Destination: {
-          ToAddresses: ['test@example.com'],
+          ToAddresses: ["test@example.com"],
         },
         Message: {
           Subject: {
-            Data: 'Test Subject',
-            Charset: 'UTF-8',
+            Data: "Test Subject",
+            Charset: "UTF-8",
           },
           Body: {
             Html: {
-              Data: '<p>Hello World</p>',
-              Charset: 'UTF-8',
+              Data: "<p>Hello World</p>",
+              Charset: "UTF-8",
             },
             Text: {
               Data: expect.any(String),
-              Charset: 'UTF-8',
+              Charset: "UTF-8",
             },
           },
         },
       });
 
-      expect(result).toEqual({ success: true, messageId: 'msg-123' });
+      expect(result).toEqual({ success: true, messageId: "msg-123" });
     });
 
-    it('should send to multiple recipients', async () => {
-      const mockSend = jest.fn().mockResolvedValue({ MessageId: 'msg-456' });
+    it("should send to multiple recipients", async () => {
+      const mockSend = jest.fn().mockResolvedValue({ MessageId: "msg-456" });
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       await client.sendEmail(
-        ['user1@example.com', 'user2@example.com'],
-        'Test Subject',
-        '<p>Hello</p>'
+        ["user1@example.com", "user2@example.com"],
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
       expect(SendEmailCommand).toHaveBeenCalledWith(
         expect.objectContaining({
           Destination: {
-            ToAddresses: ['user1@example.com', 'user2@example.com'],
+            ToAddresses: ["user1@example.com", "user2@example.com"],
           },
-        })
+        }),
       );
     });
 
-    it('should use provided text content', async () => {
-      const mockSend = jest.fn().mockResolvedValue({ MessageId: 'msg-789' });
+    it("should use provided text content", async () => {
+      const mockSend = jest.fn().mockResolvedValue({ MessageId: "msg-789" });
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>',
-        'Custom plain text'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
+        "Custom plain text",
       );
 
       expect(SendEmailCommand).toHaveBeenCalledWith(
@@ -227,68 +227,70 @@ describe('EmailClient', () => {
           Message: expect.objectContaining({
             Body: expect.objectContaining({
               Text: {
-                Data: 'Custom plain text',
-                Charset: 'UTF-8',
+                Data: "Custom plain text",
+                Charset: "UTF-8",
               },
             }),
           }),
-        })
+        }),
       );
     });
 
-    it('should add reply-to address if configured', async () => {
-      process.env.SES_REPLY_TO_EMAIL = 'support@villageshare.app';
-      const mockSend = jest.fn().mockResolvedValue({ MessageId: 'msg-000' });
+    it("should add reply-to address if configured", async () => {
+      process.env.SES_REPLY_TO_EMAIL = "support@email.com";
+      const mockSend = jest.fn().mockResolvedValue({ MessageId: "msg-000" });
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
       expect(SendEmailCommand).toHaveBeenCalledWith(
         expect.objectContaining({
-          ReplyToAddresses: ['support@villageshare.app'],
-        })
+          ReplyToAddresses: ["support@villageshare.app"],
+        }),
       );
     });
 
-    it('should return error if send fails', async () => {
-      const mockSend = jest.fn().mockRejectedValue(new Error('SES send failed'));
+    it("should return error if send fails", async () => {
+      const mockSend = jest
+        .fn()
+        .mockRejectedValue(new Error("SES send failed"));
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       const result = await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
-      expect(result).toEqual({ success: false, error: 'SES send failed' });
+      expect(result).toEqual({ success: false, error: "SES send failed" });
     });
 
-    it('should auto-initialize if not initialized', async () => {
-      const mockSend = jest.fn().mockResolvedValue({ MessageId: 'msg-auto' });
+    it("should auto-initialize if not initialized", async () => {
+      const mockSend = jest.fn().mockResolvedValue({ MessageId: "msg-auto" });
       SESClient.mockImplementation(() => ({ send: mockSend }));
 
-      const EmailClient = require('../../../../services/email/core/EmailClient');
+      const EmailClient = require("../../../../services/email/core/EmailClient");
       EmailClient.instance = null;
       const client = new EmailClient();
 
       expect(client.initialized).toBe(false);
 
       await client.sendEmail(
-        'test@example.com',
-        'Test Subject',
-        '<p>Hello</p>'
+        "test@example.com",
+        "Test Subject",
+        "<p>Hello</p>",
       );
 
       expect(client.initialized).toBe(true);

backend/tests/unit/services/email/domain/FeedbackEmailService.test.js

@@ -1,27 +1,32 @@
 // Mock dependencies
-jest.mock('../../../../../services/email/core/EmailClient', () => {
+jest.mock("../../../../../services/email/core/EmailClient", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    sendEmail: jest.fn().mockResolvedValue({ success: true, messageId: 'msg-123' }),
+    sendEmail: jest
+      .fn()
+      .mockResolvedValue({ success: true, messageId: "msg-123" }),
   }));
 });
 
-jest.mock('../../../../../services/email/core/TemplateManager', () => {
+jest.mock("../../../../../services/email/core/TemplateManager", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    renderTemplate: jest.fn().mockResolvedValue('<html>Test</html>'),
+    renderTemplate: jest.fn().mockResolvedValue("<html>Test</html>"),
   }));
 });
 
-const FeedbackEmailService = require('../../../../../services/email/domain/FeedbackEmailService');
+const FeedbackEmailService = require("../../../../../services/email/domain/FeedbackEmailService");
 
-describe('FeedbackEmailService', () => {
+describe("FeedbackEmailService", () => {
   let service;
   const originalEnv = process.env;
 
   beforeEach(() => {
     jest.clearAllMocks();
-    process.env = { ...originalEnv, FEEDBACK_EMAIL: 'feedback@example.com' };
+    process.env = {
+      ...originalEnv,
+      CUSTOMER_SUPPORT_EMAIL: "feedback@example.com",
+    };
     service = new FeedbackEmailService();
   });
 
@@ -29,8 +34,8 @@ describe('FeedbackEmailService', () => {
     process.env = originalEnv;
   });
 
-  describe('initialize', () => {
-    it('should initialize only once', async () => {
+  describe("initialize", () => {
+    it("should initialize only once", async () => {
       await service.initialize();
       await service.initialize();
 
@@ -39,11 +44,11 @@ describe('FeedbackEmailService', () => {
     });
   });
 
-  describe('sendFeedbackConfirmation', () => {
-    it('should send feedback confirmation to user', async () => {
-      const user = { firstName: 'John', email: 'john@example.com' };
+  describe("sendFeedbackConfirmation", () => {
+    it("should send feedback confirmation to user", async () => {
+      const user = { firstName: "John", email: "john@example.com" };
       const feedback = {
-        feedbackText: 'Great app!',
+        feedbackText: "Great app!",
         createdAt: new Date(),
       };
 
@@ -51,115 +56,122 @@ describe('FeedbackEmailService', () => {
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'feedbackConfirmationToUser',
+        "feedbackConfirmationToUser",
         expect.objectContaining({
-          userName: 'John',
-          userEmail: 'john@example.com',
-          feedbackText: 'Great app!',
-        })
+          userName: "John",
+          userEmail: "john@example.com",
+          feedbackText: "Great app!",
+        }),
       );
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'john@example.com',
-        'Thank You for Your Feedback - Village Share',
-        expect.any(String)
+        "john@example.com",
+        "Thank You for Your Feedback - Village Share",
+        expect.any(String),
       );
     });
 
-    it('should use default name when firstName is missing', async () => {
-      const user = { email: 'john@example.com' };
+    it("should use default name when firstName is missing", async () => {
+      const user = { email: "john@example.com" };
       const feedback = {
-        feedbackText: 'Great app!',
+        feedbackText: "Great app!",
         createdAt: new Date(),
       };
 
       await service.sendFeedbackConfirmation(user, feedback);
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'feedbackConfirmationToUser',
-        expect.objectContaining({ userName: 'there' })
+        "feedbackConfirmationToUser",
+        expect.objectContaining({ userName: "there" }),
       );
     });
   });
 
-  describe('sendFeedbackNotificationToAdmin', () => {
-    it('should send feedback notification to admin', async () => {
+  describe("sendFeedbackNotificationToAdmin", () => {
+    it("should send feedback notification to admin", async () => {
       const user = {
-        id: 'user-123',
-        firstName: 'John',
-        lastName: 'Doe',
-        email: 'john@example.com',
+        id: "user-123",
+        firstName: "John",
+        lastName: "Doe",
+        email: "john@example.com",
       };
       const feedback = {
-        id: 'feedback-123',
-        feedbackText: 'Great app!',
-        url: 'https://example.com/page',
-        userAgent: 'Mozilla/5.0',
+        id: "feedback-123",
+        feedbackText: "Great app!",
+        url: "https://example.com/page",
+        userAgent: "Mozilla/5.0",
         createdAt: new Date(),
       };
 
-      const result = await service.sendFeedbackNotificationToAdmin(user, feedback);
+      const result = await service.sendFeedbackNotificationToAdmin(
+        user,
+        feedback,
+      );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'feedbackNotificationToAdmin',
+        "feedbackNotificationToAdmin",
         expect.objectContaining({
-          userName: 'John Doe',
-          userEmail: 'john@example.com',
-          userId: 'user-123',
-          feedbackText: 'Great app!',
-          feedbackId: 'feedback-123',
-          url: 'https://example.com/page',
-          userAgent: 'Mozilla/5.0',
-        })
+          userName: "John Doe",
+          userEmail: "john@example.com",
+          userId: "user-123",
+          feedbackText: "Great app!",
+          feedbackId: "feedback-123",
+          url: "https://example.com/page",
+          userAgent: "Mozilla/5.0",
+        }),
       );
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'feedback@example.com',
-        'New Feedback from John Doe',
-        expect.any(String)
+        "feedback@example.com",
+        "New Feedback from John Doe",
+        expect.any(String),
       );
     });
 
-    it('should return error when no admin email configured', async () => {
-      delete process.env.FEEDBACK_EMAIL;
+    it("should return error when no admin email configured", async () => {
       delete process.env.CUSTOMER_SUPPORT_EMAIL;
 
-      const user = { id: 'user-123', firstName: 'John', lastName: 'Doe', email: 'john@example.com' };
-      const feedback = { id: 'feedback-123', feedbackText: 'Test', createdAt: new Date() };
+      const user = {
+        id: "user-123",
+        firstName: "John",
+        lastName: "Doe",
+        email: "john@example.com",
+      };
+      const feedback = {
+        id: "feedback-123",
+        feedbackText: "Test",
+        createdAt: new Date(),
+      };
 
-      const result = await service.sendFeedbackNotificationToAdmin(user, feedback);
+      const result = await service.sendFeedbackNotificationToAdmin(
+        user,
+        feedback,
+      );
 
       expect(result.success).toBe(false);
-      expect(result.error).toContain('No admin email configured');
+      expect(result.error).toContain("No admin email configured");
     });
 
-    it('should use CUSTOMER_SUPPORT_EMAIL when FEEDBACK_EMAIL not set', async () => {
-      delete process.env.FEEDBACK_EMAIL;
-      process.env.CUSTOMER_SUPPORT_EMAIL = 'support@example.com';
-
-      const user = { id: 'user-123', firstName: 'John', lastName: 'Doe', email: 'john@example.com' };
-      const feedback = { id: 'feedback-123', feedbackText: 'Test', createdAt: new Date() };
-
-      await service.sendFeedbackNotificationToAdmin(user, feedback);
-
-      expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'support@example.com',
-        expect.any(String),
-        expect.any(String)
-      );
-    });
-
-    it('should use default values for optional fields', async () => {
-      const user = { id: 'user-123', firstName: 'John', lastName: 'Doe', email: 'john@example.com' };
-      const feedback = { id: 'feedback-123', feedbackText: 'Test', createdAt: new Date() };
+    it("should use default values for optional fields", async () => {
+      const user = {
+        id: "user-123",
+        firstName: "John",
+        lastName: "Doe",
+        email: "john@example.com",
+      };
+      const feedback = {
+        id: "feedback-123",
+        feedbackText: "Test",
+        createdAt: new Date(),
+      };
 
       await service.sendFeedbackNotificationToAdmin(user, feedback);
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'feedbackNotificationToAdmin',
+        "feedbackNotificationToAdmin",
         expect.objectContaining({
-          url: 'Not provided',
-          userAgent: 'Not provided',
-        })
+          url: "Not provided",
+          userAgent: "Not provided",
+        }),
       );
     });
   });

backend/tests/unit/services/email/domain/PaymentEmailService.test.js

@@ -1,27 +1,29 @@
 // Mock dependencies
-jest.mock('../../../../../services/email/core/EmailClient', () => {
+jest.mock("../../../../../services/email/core/EmailClient", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    sendEmail: jest.fn().mockResolvedValue({ success: true, messageId: 'msg-123' }),
+    sendEmail: jest
+      .fn()
+      .mockResolvedValue({ success: true, messageId: "msg-123" }),
   }));
 });
 
-jest.mock('../../../../../services/email/core/TemplateManager', () => {
+jest.mock("../../../../../services/email/core/TemplateManager", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    renderTemplate: jest.fn().mockResolvedValue('<html>Test</html>'),
+    renderTemplate: jest.fn().mockResolvedValue("<html>Test</html>"),
   }));
 });
 
-jest.mock('../../../../../utils/logger', () => ({
+jest.mock("../../../../../utils/logger", () => ({
   info: jest.fn(),
   error: jest.fn(),
   warn: jest.fn(),
 }));
 
-const PaymentEmailService = require('../../../../../services/email/domain/PaymentEmailService');
+const PaymentEmailService = require("../../../../../services/email/domain/PaymentEmailService");
 
-describe('PaymentEmailService', () => {
+describe("PaymentEmailService", () => {
   let service;
   const originalEnv = process.env;
 
@@ -29,8 +31,8 @@ describe('PaymentEmailService', () => {
     jest.clearAllMocks();
     process.env = {
       ...originalEnv,
-      FRONTEND_URL: 'http://localhost:3000',
-      ADMIN_EMAIL: 'admin@example.com',
+      FRONTEND_URL: "http://localhost:3000",
+      CUSTOMER_SUPPORT_EMAIL: "admin@example.com",
     };
     service = new PaymentEmailService();
   });
@@ -39,8 +41,8 @@ describe('PaymentEmailService', () => {
     process.env = originalEnv;
   });
 
-  describe('initialize', () => {
-    it('should initialize only once', async () => {
+  describe("initialize", () => {
+    it("should initialize only once", async () => {
       await service.initialize();
       await service.initialize();
 
@@ -48,196 +50,222 @@ describe('PaymentEmailService', () => {
     });
   });
 
-  describe('sendPaymentDeclinedNotification', () => {
-    it('should send payment declined notification to renter', async () => {
-      const result = await service.sendPaymentDeclinedNotification('renter@example.com', {
-        renterFirstName: 'John',
-        itemName: 'Test Item',
-        declineReason: 'Card declined',
-        updatePaymentUrl: 'http://localhost:3000/update-payment',
-      });
+  describe("sendPaymentDeclinedNotification", () => {
+    it("should send payment declined notification to renter", async () => {
+      const result = await service.sendPaymentDeclinedNotification(
+        "renter@example.com",
+        {
+          renterFirstName: "John",
+          itemName: "Test Item",
+          declineReason: "Card declined",
+          updatePaymentUrl: "http://localhost:3000/update-payment",
+        },
+      );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'paymentDeclinedToRenter',
+        "paymentDeclinedToRenter",
         expect.objectContaining({
-          renterFirstName: 'John',
-          itemName: 'Test Item',
-          declineReason: 'Card declined',
-        })
+          renterFirstName: "John",
+          itemName: "Test Item",
+          declineReason: "Card declined",
+        }),
       );
     });
 
-    it('should use default values for missing params', async () => {
-      await service.sendPaymentDeclinedNotification('renter@example.com', {});
+    it("should use default values for missing params", async () => {
+      await service.sendPaymentDeclinedNotification("renter@example.com", {});
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'paymentDeclinedToRenter',
+        "paymentDeclinedToRenter",
         expect.objectContaining({
-          renterFirstName: 'there',
-          itemName: 'the item',
-        })
+          renterFirstName: "there",
+          itemName: "the item",
+        }),
       );
     });
 
-    it('should handle errors gracefully', async () => {
-      service.templateManager.renderTemplate.mockRejectedValue(new Error('Template error'));
+    it("should handle errors gracefully", async () => {
+      service.templateManager.renderTemplate.mockRejectedValue(
+        new Error("Template error"),
+      );
 
-      const result = await service.sendPaymentDeclinedNotification('test@example.com', {});
+      const result = await service.sendPaymentDeclinedNotification(
+        "test@example.com",
+        {},
+      );
 
       expect(result.success).toBe(false);
-      expect(result.error).toContain('Template error');
+      expect(result.error).toContain("Template error");
     });
   });
 
-  describe('sendPaymentMethodUpdatedNotification', () => {
-    it('should send payment method updated notification to owner', async () => {
-      const result = await service.sendPaymentMethodUpdatedNotification('owner@example.com', {
-        ownerFirstName: 'Jane',
-        itemName: 'Test Item',
-        approvalUrl: 'http://localhost:3000/approve',
-      });
+  describe("sendPaymentMethodUpdatedNotification", () => {
+    it("should send payment method updated notification to owner", async () => {
+      const result = await service.sendPaymentMethodUpdatedNotification(
+        "owner@example.com",
+        {
+          ownerFirstName: "Jane",
+          itemName: "Test Item",
+          approvalUrl: "http://localhost:3000/approve",
+        },
+      );
 
       expect(result.success).toBe(true);
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'owner@example.com',
-        'Payment Method Updated - Test Item',
-        expect.any(String)
+        "owner@example.com",
+        "Payment Method Updated - Test Item",
+        expect.any(String),
       );
     });
   });
 
-  describe('sendPayoutFailedNotification', () => {
-    it('should send payout failed notification to owner', async () => {
-      const result = await service.sendPayoutFailedNotification('owner@example.com', {
-        ownerName: 'John',
-        payoutAmount: 50.00,
-        failureMessage: 'Bank account closed',
-        actionRequired: 'Please update your bank account',
-        failureCode: 'account_closed',
-        requiresBankUpdate: true,
-      });
-
-      expect(result.success).toBe(true);
-      expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'payoutFailedToOwner',
-        expect.objectContaining({
-          ownerName: 'John',
-          payoutAmount: '50.00',
-          failureCode: 'account_closed',
+  describe("sendPayoutFailedNotification", () => {
+    it("should send payout failed notification to owner", async () => {
+      const result = await service.sendPayoutFailedNotification(
+        "owner@example.com",
+        {
+          ownerName: "John",
+          payoutAmount: 50.0,
+          failureMessage: "Bank account closed",
+          actionRequired: "Please update your bank account",
+          failureCode: "account_closed",
           requiresBankUpdate: true,
-        })
+        },
+      );
+
+      expect(result.success).toBe(true);
+      expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
+        "payoutFailedToOwner",
+        expect.objectContaining({
+          ownerName: "John",
+          payoutAmount: "50.00",
+          failureCode: "account_closed",
+          requiresBankUpdate: true,
+        }),
       );
     });
   });
 
-  describe('sendAccountDisconnectedEmail', () => {
-    it('should send account disconnected notification', async () => {
-      const result = await service.sendAccountDisconnectedEmail('owner@example.com', {
-        ownerName: 'John',
-        hasPendingPayouts: true,
-        pendingPayoutCount: 3,
-      });
+  describe("sendAccountDisconnectedEmail", () => {
+    it("should send account disconnected notification", async () => {
+      const result = await service.sendAccountDisconnectedEmail(
+        "owner@example.com",
+        {
+          ownerName: "John",
+          hasPendingPayouts: true,
+          pendingPayoutCount: 3,
+        },
+      );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'accountDisconnectedToOwner',
+        "accountDisconnectedToOwner",
         expect.objectContaining({
           hasPendingPayouts: true,
           pendingPayoutCount: 3,
-        })
+        }),
       );
     });
 
-    it('should use default values for missing params', async () => {
-      await service.sendAccountDisconnectedEmail('owner@example.com', {});
+    it("should use default values for missing params", async () => {
+      await service.sendAccountDisconnectedEmail("owner@example.com", {});
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'accountDisconnectedToOwner',
+        "accountDisconnectedToOwner",
         expect.objectContaining({
-          ownerName: 'there',
+          ownerName: "there",
           hasPendingPayouts: false,
           pendingPayoutCount: 0,
-        })
+        }),
       );
     });
   });
 
-  describe('sendPayoutsDisabledEmail', () => {
-    it('should send payouts disabled notification', async () => {
-      const result = await service.sendPayoutsDisabledEmail('owner@example.com', {
-        ownerName: 'John',
-        disabledReason: 'Verification required',
-      });
+  describe("sendPayoutsDisabledEmail", () => {
+    it("should send payouts disabled notification", async () => {
+      const result = await service.sendPayoutsDisabledEmail(
+        "owner@example.com",
+        {
+          ownerName: "John",
+          disabledReason: "Verification required",
+        },
+      );
 
       expect(result.success).toBe(true);
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'owner@example.com',
-        'Action Required: Your payouts have been paused - Village Share',
-        expect.any(String)
+        "owner@example.com",
+        "Action Required: Your payouts have been paused - Village Share",
+        expect.any(String),
       );
     });
   });
 
-  describe('sendDisputeAlertEmail', () => {
-    it('should send dispute alert to admin', async () => {
+  describe("sendDisputeAlertEmail", () => {
+    it("should send dispute alert to admin", async () => {
       const result = await service.sendDisputeAlertEmail({
-        rentalId: 'rental-123',
-        amount: 50.00,
-        reason: 'fraudulent',
+        rentalId: "rental-123",
+        amount: 50.0,
+        reason: "fraudulent",
         evidenceDueBy: new Date(),
-        renterName: 'Renter Name',
-        renterEmail: 'renter@example.com',
-        ownerName: 'Owner Name',
-        ownerEmail: 'owner@example.com',
-        itemName: 'Test Item',
+        renterName: "Renter Name",
+        renterEmail: "renter@example.com",
+        ownerName: "Owner Name",
+        ownerEmail: "owner@example.com",
+        itemName: "Test Item",
       });
 
       expect(result.success).toBe(true);
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'admin@example.com',
-        'URGENT: Payment Dispute - Rental #rental-123',
-        expect.any(String)
+        "admin@example.com",
+        "URGENT: Payment Dispute - Rental #rental-123",
+        expect.any(String),
       );
     });
   });
 
-  describe('sendDisputeLostAlertEmail', () => {
-    it('should send dispute lost alert to admin', async () => {
+  describe("sendDisputeLostAlertEmail", () => {
+    it("should send dispute lost alert to admin", async () => {
       const result = await service.sendDisputeLostAlertEmail({
-        rentalId: 'rental-123',
-        amount: 50.00,
-        ownerPayoutAmount: 45.00,
-        ownerName: 'Owner Name',
-        ownerEmail: 'owner@example.com',
+        rentalId: "rental-123",
+        amount: 50.0,
+        ownerPayoutAmount: 45.0,
+        ownerName: "Owner Name",
+        ownerEmail: "owner@example.com",
       });
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'disputeLostAlertToAdmin',
+        "disputeLostAlertToAdmin",
         expect.objectContaining({
-          rentalId: 'rental-123',
-          amount: '50.00',
-          ownerPayoutAmount: '45.00',
-        })
+          rentalId: "rental-123",
+          amount: "50.00",
+          ownerPayoutAmount: "45.00",
+        }),
       );
     });
   });
 
-  describe('formatDisputeReason', () => {
-    it('should format known dispute reasons', () => {
-      expect(service.formatDisputeReason('fraudulent')).toBe('Fraudulent transaction');
-      expect(service.formatDisputeReason('product_not_received')).toBe('Product not received');
-      expect(service.formatDisputeReason('duplicate')).toBe('Duplicate charge');
+  describe("formatDisputeReason", () => {
+    it("should format known dispute reasons", () => {
+      expect(service.formatDisputeReason("fraudulent")).toBe(
+        "Fraudulent transaction",
+      );
+      expect(service.formatDisputeReason("product_not_received")).toBe(
+        "Product not received",
+      );
+      expect(service.formatDisputeReason("duplicate")).toBe("Duplicate charge");
     });
 
-    it('should return original reason for unknown reasons', () => {
-      expect(service.formatDisputeReason('unknown_reason')).toBe('unknown_reason');
+    it("should return original reason for unknown reasons", () => {
+      expect(service.formatDisputeReason("unknown_reason")).toBe(
+        "unknown_reason",
+      );
     });
 
     it('should return "Unknown reason" for null/undefined', () => {
-      expect(service.formatDisputeReason(null)).toBe('Unknown reason');
-      expect(service.formatDisputeReason(undefined)).toBe('Unknown reason');
+      expect(service.formatDisputeReason(null)).toBe("Unknown reason");
+      expect(service.formatDisputeReason(undefined)).toBe("Unknown reason");
     });
   });
 });

backend/tests/unit/services/email/domain/UserEngagementEmailService.test.js

@@ -1,27 +1,29 @@
 // Mock dependencies
-jest.mock('../../../../../services/email/core/EmailClient', () => {
+jest.mock("../../../../../services/email/core/EmailClient", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    sendEmail: jest.fn().mockResolvedValue({ success: true, messageId: 'msg-123' }),
+    sendEmail: jest
+      .fn()
+      .mockResolvedValue({ success: true, messageId: "msg-123" }),
   }));
 });
 
-jest.mock('../../../../../services/email/core/TemplateManager', () => {
+jest.mock("../../../../../services/email/core/TemplateManager", () => {
   return jest.fn().mockImplementation(() => ({
     initialize: jest.fn().mockResolvedValue(),
-    renderTemplate: jest.fn().mockResolvedValue('<html>Test</html>'),
+    renderTemplate: jest.fn().mockResolvedValue("<html>Test</html>"),
   }));
 });
 
-jest.mock('../../../../../utils/logger', () => ({
+jest.mock("../../../../../utils/logger", () => ({
   info: jest.fn(),
   error: jest.fn(),
   warn: jest.fn(),
 }));
 
-const UserEngagementEmailService = require('../../../../../services/email/domain/UserEngagementEmailService');
+const UserEngagementEmailService = require("../../../../../services/email/domain/UserEngagementEmailService");
 
-describe('UserEngagementEmailService', () => {
+describe("UserEngagementEmailService", () => {
   let service;
   const originalEnv = process.env;
 
@@ -29,8 +31,8 @@ describe('UserEngagementEmailService', () => {
     jest.clearAllMocks();
     process.env = {
       ...originalEnv,
-      FRONTEND_URL: 'http://localhost:3000',
-      SUPPORT_EMAIL: 'support@villageshare.com',
+      FRONTEND_URL: "http://localhost:3000",
+      CUSTOMER_SUPPORT_EMAIL: "support@email.com",
     };
     service = new UserEngagementEmailService();
   });
@@ -39,8 +41,8 @@ describe('UserEngagementEmailService', () => {
     process.env = originalEnv;
   });
 
-  describe('initialize', () => {
-    it('should initialize only once', async () => {
+  describe("initialize", () => {
+    it("should initialize only once", async () => {
       await service.initialize();
       await service.initialize();
 
@@ -49,148 +51,176 @@ describe('UserEngagementEmailService', () => {
     });
   });
 
-  describe('sendFirstListingCelebrationEmail', () => {
-    const owner = { firstName: 'John', email: 'john@example.com' };
-    const item = { id: 123, name: 'Power Drill' };
+  describe("sendFirstListingCelebrationEmail", () => {
+    const owner = { firstName: "John", email: "john@example.com" };
+    const item = { id: 123, name: "Power Drill" };
 
-    it('should send first listing celebration email with correct variables', async () => {
-      const result = await service.sendFirstListingCelebrationEmail(owner, item);
+    it("should send first listing celebration email with correct variables", async () => {
+      const result = await service.sendFirstListingCelebrationEmail(
+        owner,
+        item,
+      );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'firstListingCelebrationToOwner',
+        "firstListingCelebrationToOwner",
         expect.objectContaining({
-          ownerName: 'John',
-          itemName: 'Power Drill',
+          ownerName: "John",
+          itemName: "Power Drill",
           itemId: 123,
-          viewItemUrl: 'http://localhost:3000/items/123',
-        })
+          viewItemUrl: "http://localhost:3000/items/123",
+        }),
       );
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'john@example.com',
-        'Congratulations! Your first item is live on Village Share',
-        expect.any(String)
+        "john@example.com",
+        "Congratulations! Your first item is live on Village Share",
+        expect.any(String),
       );
     });
 
-    it('should use default name when firstName is missing', async () => {
-      const ownerNoName = { email: 'john@example.com' };
+    it("should use default name when firstName is missing", async () => {
+      const ownerNoName = { email: "john@example.com" };
 
       await service.sendFirstListingCelebrationEmail(ownerNoName, item);
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'firstListingCelebrationToOwner',
-        expect.objectContaining({ ownerName: 'there' })
+        "firstListingCelebrationToOwner",
+        expect.objectContaining({ ownerName: "there" }),
       );
     });
 
-    it('should handle errors gracefully', async () => {
-      service.templateManager.renderTemplate.mockRejectedValueOnce(new Error('Template error'));
+    it("should handle errors gracefully", async () => {
+      service.templateManager.renderTemplate.mockRejectedValueOnce(
+        new Error("Template error"),
+      );
 
-      const result = await service.sendFirstListingCelebrationEmail(owner, item);
+      const result = await service.sendFirstListingCelebrationEmail(
+        owner,
+        item,
+      );
 
       expect(result.success).toBe(false);
-      expect(result.error).toBe('Template error');
+      expect(result.error).toBe("Template error");
     });
   });
 
-  describe('sendItemDeletionNotificationToOwner', () => {
-    const owner = { firstName: 'John', email: 'john@example.com' };
-    const item = { id: 123, name: 'Power Drill' };
-    const deletionReason = 'Violated community guidelines';
+  describe("sendItemDeletionNotificationToOwner", () => {
+    const owner = { firstName: "John", email: "john@example.com" };
+    const item = { id: 123, name: "Power Drill" };
+    const deletionReason = "Violated community guidelines";
 
-    it('should send item deletion notification with correct variables', async () => {
+    it("should send item deletion notification with correct variables", async () => {
       const result = await service.sendItemDeletionNotificationToOwner(
         owner,
         item,
-        deletionReason
+        deletionReason,
       );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'itemDeletionToOwner',
+        "itemDeletionToOwner",
         expect.objectContaining({
-          ownerName: 'John',
-          itemName: 'Power Drill',
-          deletionReason: 'Violated community guidelines',
-          supportEmail: 'support@villageshare.com',
-          dashboardUrl: 'http://localhost:3000/owning',
-        })
+          ownerName: "John",
+          itemName: "Power Drill",
+          deletionReason: "Violated community guidelines",
+          supportEmail: "support@villageshare.com",
+          dashboardUrl: "http://localhost:3000/owning",
+        }),
       );
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'john@example.com',
+        "john@example.com",
         'Important: Your listing "Power Drill" has been removed',
-        expect.any(String)
+        expect.any(String),
       );
     });
 
-    it('should use default name when firstName is missing', async () => {
-      const ownerNoName = { email: 'john@example.com' };
+    it("should use default name when firstName is missing", async () => {
+      const ownerNoName = { email: "john@example.com" };
 
-      await service.sendItemDeletionNotificationToOwner(ownerNoName, item, deletionReason);
+      await service.sendItemDeletionNotificationToOwner(
+        ownerNoName,
+        item,
+        deletionReason,
+      );
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'itemDeletionToOwner',
-        expect.objectContaining({ ownerName: 'there' })
+        "itemDeletionToOwner",
+        expect.objectContaining({ ownerName: "there" }),
       );
     });
 
-    it('should handle errors gracefully', async () => {
-      service.emailClient.sendEmail.mockRejectedValueOnce(new Error('Send error'));
+    it("should handle errors gracefully", async () => {
+      service.emailClient.sendEmail.mockRejectedValueOnce(
+        new Error("Send error"),
+      );
 
       const result = await service.sendItemDeletionNotificationToOwner(
         owner,
         item,
-        deletionReason
+        deletionReason,
       );
 
       expect(result.success).toBe(false);
-      expect(result.error).toBe('Send error');
+      expect(result.error).toBe("Send error");
     });
   });
 
-  describe('sendUserBannedNotification', () => {
-    const bannedUser = { firstName: 'John', email: 'john@example.com' };
-    const admin = { firstName: 'Admin', lastName: 'User' };
-    const banReason = 'Multiple policy violations';
+  describe("sendUserBannedNotification", () => {
+    const bannedUser = { firstName: "John", email: "john@example.com" };
+    const admin = { firstName: "Admin", lastName: "User" };
+    const banReason = "Multiple policy violations";
 
-    it('should send user banned notification with correct variables', async () => {
-      const result = await service.sendUserBannedNotification(bannedUser, admin, banReason);
+    it("should send user banned notification with correct variables", async () => {
+      const result = await service.sendUserBannedNotification(
+        bannedUser,
+        admin,
+        banReason,
+      );
 
       expect(result.success).toBe(true);
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'userBannedNotification',
+        "userBannedNotification",
         expect.objectContaining({
-          userName: 'John',
-          banReason: 'Multiple policy violations',
-          supportEmail: 'support@villageshare.com',
-        })
+          userName: "John",
+          banReason: "Multiple policy violations",
+          supportEmail: "support@villageshare.com",
+        }),
       );
       expect(service.emailClient.sendEmail).toHaveBeenCalledWith(
-        'john@example.com',
-        'Important: Your Village Share Account Has Been Suspended',
-        expect.any(String)
+        "john@example.com",
+        "Important: Your Village Share Account Has Been Suspended",
+        expect.any(String),
       );
     });
 
-    it('should use default name when firstName is missing', async () => {
-      const bannedUserNoName = { email: 'john@example.com' };
+    it("should use default name when firstName is missing", async () => {
+      const bannedUserNoName = { email: "john@example.com" };
 
-      await service.sendUserBannedNotification(bannedUserNoName, admin, banReason);
+      await service.sendUserBannedNotification(
+        bannedUserNoName,
+        admin,
+        banReason,
+      );
 
       expect(service.templateManager.renderTemplate).toHaveBeenCalledWith(
-        'userBannedNotification',
-        expect.objectContaining({ userName: 'there' })
+        "userBannedNotification",
+        expect.objectContaining({ userName: "there" }),
       );
     });
 
-    it('should handle errors gracefully', async () => {
-      service.templateManager.renderTemplate.mockRejectedValueOnce(new Error('Template error'));
+    it("should handle errors gracefully", async () => {
+      service.templateManager.renderTemplate.mockRejectedValueOnce(
+        new Error("Template error"),
+      );
 
-      const result = await service.sendUserBannedNotification(bannedUser, admin, banReason);
+      const result = await service.sendUserBannedNotification(
+        bannedUser,
+        admin,
+        banReason,
+      );
 
       expect(result.success).toBe(false);
-      expect(result.error).toBe('Template error');
+      expect(result.error).toBe("Template error");
     });
   });
 });