fix admin login issue

apps/api/src/modules/admin/admin.service.test.ts

@@ -39,6 +39,7 @@ vi.mock('../../lib/redis', () => ({
 
 import * as repo from './admin.repo'
 import { sendTransactionalEmail } from '../../services/notificationService'
+import { hashPublicAccessToken } from '../../security/publicAccessTokens'
 import { forgotPassword, login, setupTotp } from './admin.service'
 
 describe('admin.service forgotPassword', () => {
@@ -79,7 +80,7 @@ describe('admin.service forgotPassword', () => {
     )
   })
 
-  it('sends an email login code when admin 2FA is enabled', async () => {
+  it('signs in without an email login code when admin 2FA is enabled', async () => {
     vi.mocked(repo.findAdminByEmail).mockResolvedValue({
       id: 'admin_2',
       email: 'admin@example.test',
@@ -92,18 +93,15 @@ describe('admin.service forgotPassword', () => {
       totpSecret: null,
     } as any)
 
-    await expect(login('admin@example.test', 'password123')).resolves.toEqual({ totpRequired: true, method: 'email' })
+    await expect(login('admin@example.test', 'password123')).resolves.toEqual(expect.objectContaining({
+      token: expect.any(String),
+      admin: expect.objectContaining({ id: 'admin_2', email: 'admin@example.test', totpEnabled: true }),
+    }))
 
-    expect(sendTransactionalEmail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: 'admin@example.test',
-        subject: 'Your RentalDriveGo admin login code',
-        text: expect.stringMatching(/\b\d{6}\b/),
-      }),
-    )
+    expect(sendTransactionalEmail).not.toHaveBeenCalled()
   })
 
-  it('accepts the emailed admin login code in the 2FA field', async () => {
+  it('accepts a previously issued emailed admin login code in the 2FA field', async () => {
     vi.mocked(repo.findAdminByEmail).mockResolvedValue({
       id: 'admin_3',
       email: 'admin3@example.test',
@@ -116,11 +114,9 @@ describe('admin.service forgotPassword', () => {
       totpSecret: null,
     } as any)
 
-    await login('admin3@example.test', 'password123')
-    const emailText = vi.mocked(sendTransactionalEmail).mock.calls[0]?.[0]?.text ?? ''
-    const code = emailText.match(/\b\d{6}\b/)?.[0]
+    const code = '123456'
+    redisStore.set('admin:email-otp:admin_3', hashPublicAccessToken(code))
 
-    expect(code).toBeTruthy()
     const result = await login('admin3@example.test', 'password123', code)
 
     expect(result).toEqual(expect.objectContaining({