fix test failures

apps/api/src/modules/admin/admin.repo.edge.test.ts

@@ -11,6 +11,7 @@ vi.mock('../../lib/prisma', () => ({
 }))
 
 import { prisma } from '../../lib/prisma'
+import { hashPublicAccessToken } from '../../security/publicAccessTokens'
 import * as repo from './admin.repo'
 
 describe('admin.repo edge queries', () => {
@@ -62,7 +63,10 @@ describe('admin.repo edge queries', () => {
 
     expect(prisma.adminUser.findFirst).toHaveBeenCalledWith({
       where: {
-        passwordResetToken: 'reset-token',
+        OR: [
+          { passwordResetToken: hashPublicAccessToken('reset-token') },
+          { passwordResetToken: 'reset-token' },
+        ],
         passwordResetExpiresAt: { gt: new Date('2026-06-01T00:00:00.000Z') },
       },
     })

apps/api/src/modules/auth/auth.employee.repo.edge.test.ts

@@ -10,6 +10,7 @@ const prismaMock = vi.hoisted(() => ({
 
 vi.mock('../../lib/prisma', () => ({ prisma: prismaMock }))
 
+import { hashPublicAccessToken } from '../../security/publicAccessTokens'
 import * as repo from './auth.employee.repo'
 
 describe('auth.employee.repo query boundaries', () => {
@@ -50,7 +51,10 @@ describe('auth.employee.repo query boundaries', () => {
 
     expect(prismaMock.employee.findFirst).toHaveBeenCalledWith({
       where: {
-        passwordResetToken: 'reset_123',
+        OR: [
+          { passwordResetToken: hashPublicAccessToken('reset_123') },
+          { passwordResetToken: 'reset_123' },
+        ],
         passwordResetExpiresAt: { gt: new Date('2026-06-09T12:00:00.000Z') },
       },
     })

apps/api/src/modules/carplace/carplace.repo.edge.test.ts

@@ -52,6 +52,7 @@ describe('carplace.repo public query and write boundaries', () => {
       where: {
         id: 'vehicle_1',
         isPublished: true,
+        status: 'AVAILABLE',
         company: {
           OR: [{ slug: 'atlas' }, { brand: { subdomain: 'atlas' } }],
           status: { in: ['ACTIVE', 'TRIALING'] },

apps/api/src/modules/payments/payment.service.test.ts

@@ -27,6 +27,7 @@ vi.mock('./payment.repo', () => ({
   incrementReservationPaid: vi.fn(),
   createPayment: vi.fn(),
   updatePaypalCapture: vi.fn(),
+  updatePendingPaypalCapture: vi.fn(),
   setReservationPaidAmount: vi.fn(),
   setReservationRefunded: vi.fn(),
   setPaymentRefunded: vi.fn(),
@@ -199,8 +200,8 @@ describe('payment.service', () => {
     vi.mocked(repo.findByPaypal).mockResolvedValue({ id: 'payment_2', reservationId: 'reservation_2', amount: 500, type: 'CHARGE' } as never)
 
     await handleAmanpayWebhook({ transaction_id: 'aman_txn_1', status: 'paid' })
-    await handlePaypalWebhook({ event_type: 'PAYMENT.CAPTURE.COMPLETED', resource: { id: 'paypal_capture_1' } })
-    await handlePaypalWebhook({ event_type: 'PAYMENT.CAPTURE.DENIED', resource: { id: 'paypal_capture_2' } })
+    await handlePaypalWebhook({ id: 'paypal_event_1', event_type: 'PAYMENT.CAPTURE.COMPLETED', resource: { id: 'paypal_capture_1' } })
+    await handlePaypalWebhook({ id: 'paypal_event_2', event_type: 'PAYMENT.CAPTURE.DENIED', resource: { id: 'paypal_capture_2' } })
 
     expect(repo.markPaymentSucceeded).toHaveBeenCalledWith('payment_1')
     expect(repo.incrementReservationPaid).toHaveBeenCalledWith('reservation_1', 450)
@@ -210,14 +211,20 @@ describe('payment.service', () => {
   })
 
   it('captures PayPal orders, stores the capture id, and increments the original reservation payment', async () => {
-    vi.mocked(repo.findByPaypalForCompany).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 800, type: 'CHARGE' } as never)
-    vi.mocked(paypal.captureOrder).mockResolvedValue({ purchase_units: [{ payments: { captures: [{ id: 'capture_123' }] } }] } as never)
-    vi.mocked(repo.updatePaypalCapture).mockResolvedValue({ id: 'payment_1', status: 'SUCCEEDED', paypalCaptureId: 'capture_123' } as never)
+    vi.mocked(repo.findByPaypalForCompany).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 800, currency: 'MAD', status: 'PENDING', type: 'CHARGE' } as never)
+    vi.mocked(paypal.captureOrder).mockResolvedValue({
+      status: 'COMPLETED',
+      purchase_units: [{
+        reference_id: 'reservation_1-CHARGE-1780913700000',
+        payments: { captures: [{ id: 'capture_123', amount: { value: '8.00', currency_code: 'MAD' } }] },
+      }],
+    } as never)
+    vi.mocked(repo.updatePendingPaypalCapture).mockResolvedValue({ id: 'payment_1', status: 'SUCCEEDED', paypalCaptureId: 'capture_123' } as never)
 
     const result = await capturePaypal('reservation_1', 'company_1', 'order_123')
 
     expect(repo.findByPaypalForCompany).toHaveBeenCalledWith('order_123', 'company_1')
-    expect(repo.updatePaypalCapture).toHaveBeenCalledWith('payment_1', 'capture_123')
+    expect(repo.updatePendingPaypalCapture).toHaveBeenCalledWith('payment_1', 'capture_123')
     expect(repo.incrementReservationPaid).toHaveBeenCalledWith('reservation_1', 800)
     expect(result).toEqual({ id: 'payment_1', status: 'SUCCEEDED', paypalCaptureId: 'capture_123' })
   })

apps/api/src/modules/site/site.repo.edge.test.ts

@@ -22,7 +22,7 @@ describe('site.repo public booking boundaries', () => {
     await repo.findCompanyBySlug('atlas-rentals')
 
     expect(prisma.company.findFirstOrThrow).toHaveBeenCalledWith({
-      where: { slug: 'atlas-rentals', status: { in: ['ACTIVE', 'TRIALING', 'PAST_DUE', 'SUSPENDED'] } },
+      where: { slug: 'atlas-rentals', status: { in: ['ACTIVE', 'TRIALING', 'PAST_DUE'] } },
       include: { brand: true, contractSettings: true },
     })
   })
@@ -31,7 +31,7 @@ describe('site.repo public booking boundaries', () => {
     await repo.findPublishedVehicles('company_1')
 
     expect(prisma.vehicle.findMany).toHaveBeenCalledWith({
-      where: { companyId: 'company_1', isPublished: true },
+      where: { companyId: 'company_1', isPublished: true, status: 'AVAILABLE' },
       orderBy: { createdAt: 'desc' },
     })
   })

apps/api/src/modules/site/site.service.boundary.test.ts

@@ -57,7 +57,7 @@ import * as paypal from '../../services/paypalService'
 import * as repo from './site.repo'
 import * as service from './site.service'
 
-const company = { id: 'company_1', slug: 'atlas', email: 'office@example.test', contractSettings: { depositRequired: true }, brand: { publicEmail: 'hello@example.test' } }
+const company = { id: 'company_1', slug: 'atlas', email: 'office@example.test', status: 'ACTIVE', contractSettings: { depositRequired: true }, brand: { publicEmail: 'hello@example.test' } }
 
 function futureDateRange(startOffsetDays: number, durationDays: number) {
   const start = new Date(Date.now() + startOffsetDays * 24 * 60 * 60 * 1000)

apps/api/src/modules/site/site.test.ts

@@ -91,6 +91,7 @@ function futureDateRange(startOffsetDays: number, durationDays: number) {
 function makeCompany(overrides: object = {}) {
   return {
     id: 'co-1', slug: SLUG, name: 'Test Co', phone: null, email: 'co@test.com',
+    status: 'ACTIVE',
     brand: { publicEmail: null }, contractSettings: null,
     ...overrides,
   }

apps/api/src/tests/api/company-configuration.api.test.ts

@@ -23,6 +23,9 @@ vi.mock('../../middleware/requireTenant', () => ({
 }))
 vi.mock('../../middleware/requireSubscription', () => ({
   requireSubscription: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionRead: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionWrite: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionFull: (_req: any, _res: any, next: any) => next(),
 }))
 vi.mock('../../middleware/requireRole', () => ({
   requireRole: () => (_req: any, _res: any, next: any) => next(),

apps/api/src/tests/api/customer-notification-analytics.api.test.ts

@@ -20,7 +20,10 @@ vi.mock('../../middleware/requireTenant', () => ({
     next()
   },
 }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../middleware/requireRole', () => ({ requireRole: () => (_req: any, _res: any, next: any) => next() }))
 vi.mock('../../middleware/requireRenterAuth', () => ({
   requireRenterAuth: (req: any, _res: any, next: any) => {

apps/api/src/tests/api/employee-carplace-notification.api.test.ts

@@ -17,7 +17,10 @@ vi.mock('../../middleware/requireTenant', () => ({
     next()
   },
 }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../modules/auth/auth.employee.service', () => ({
   getMe: vi.fn(),
   login: vi.fn(),

apps/api/src/tests/api/feedback-offer-boundaries.api.test.ts

@@ -17,7 +17,10 @@ vi.mock('../../middleware/requireTenant', () => ({
     next()
   },
 }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../middleware/requireRole', () => ({ requireRole: () => (_req: any, _res: any, next: any) => next() }))
 vi.mock('../../modules/offers/offer.service', () => ({
   listOffers: vi.fn(),

apps/api/src/tests/api/operations-validation.api.test.ts

@@ -22,6 +22,9 @@ vi.mock('../../middleware/requireTenant', () => ({
 }))
 vi.mock('../../middleware/requireSubscription', () => ({
   requireSubscription: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionRead: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionWrite: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionFull: (_req: any, _res: any, next: any) => next(),
 }))
 vi.mock('../../middleware/requireRole', () => ({
   requireRole: () => (_req: any, _res: any, next: any) => next(),

apps/api/src/tests/api/operations.api.test.ts

@@ -21,6 +21,9 @@ vi.mock('../../middleware/requireTenant', () => ({
 
 vi.mock('../../middleware/requireSubscription', () => ({
   requireSubscription: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionRead: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionWrite: (_req: any, _res: any, next: any) => next(),
+  requireSubscriptionFull: (_req: any, _res: any, next: any) => next(),
 }))
 
 vi.mock('../../middleware/requireRole', () => ({

apps/api/src/tests/api/subscription-team-boundaries.api.test.ts

@@ -17,7 +17,10 @@ vi.mock('../../middleware/requireTenant', () => ({
     next()
   },
 }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../middleware/requireRole', () => ({ requireRole: () => (_req: any, _res: any, next: any) => next() }))
 vi.mock('../../modules/subscriptions/subscription.service', () => ({
   getPlans: vi.fn(),

apps/api/src/tests/e2e/admin-menu-boundaries.e2e.test.ts

@@ -11,6 +11,7 @@ vi.mock('../../middleware/requireAdminAuth', () => ({
   },
   requireAdminRole: () => (_req: any, res: any) => res.status(403).json({ code: 'forbidden' }),
   requireFreshAdmin2FA: (_req: any, _res: any, next: any) => next(),
+  requireFreshAdmin2FAWhenEnabled: (_req: any, _res: any, next: any) => next(),
 }))
 vi.mock('../../modules/menu/menu.service', () => ({
   listMenuItems: vi.fn(),

apps/api/src/tests/e2e/customer-boundaries.e2e.test.ts

@@ -13,7 +13,10 @@ vi.mock('../../middleware/requireCompanyAuth', () => ({
   },
 }))
 vi.mock('../../middleware/requireTenant', () => ({ requireTenant: (req: any, _res: any, next: any) => { req.companyId = 'company_1'; next() } }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../middleware/requireRole', () => ({ requireRole: () => (_req: any, _res: any, next: any) => next() }))
 vi.mock('../../modules/customers/customer.service', () => ({
   createCustomer: vi.fn(),

apps/api/src/tests/e2e/operations-validation-smoke.e2e.test.ts

@@ -20,7 +20,10 @@ vi.mock('../../middleware/requireTenant', () => ({
     next()
   },
 }))
-vi.mock('../../middleware/requireSubscription', () => ({ requireSubscription: (_req: any, _res: any, next: any) => next() }))
+vi.mock('../../middleware/requireSubscription', () => {
+  const pass = (_req: any, _res: any, next: any) => next()
+  return { requireSubscription: pass, requireSubscriptionRead: pass, requireSubscriptionWrite: pass, requireSubscriptionFull: pass }
+})
 vi.mock('../../middleware/requireRole', () => ({ requireRole: () => (_req: any, _res: any, next: any) => next() }))
 vi.mock('../../modules/team/team.service', () => ({ inviteEmployee: vi.fn(), updateEmployeeRole: vi.fn(), getMembers: vi.fn(), getMemberStats: vi.fn() }))
 vi.mock('../../modules/notifications/notification.service', () => ({ setPreferences: vi.fn(), getPreferences: vi.fn(), listCompany: vi.fn(), countUnread: vi.fn() }))