fix both admin and company login

apps/api/src/tests/api/auth-middleware.api.test.ts

@@ -30,12 +30,18 @@ vi.mock('../../modules/admin/admin.service', () => ({
   resetPassword: vi.fn(),
 }))
 
+vi.mock('../../modules/auth/auth.employee.service', () => ({
+  login: vi.fn(),
+}))
+
 import request from 'supertest'
 import jwt from 'jsonwebtoken'
 import { createApp } from '../../app'
 import { prisma } from '../../lib/prisma'
 import * as vehicleService from '../../modules/vehicles/vehicle.service'
 import * as adminService from '../../modules/admin/admin.service'
+import * as employeeService from '../../modules/auth/auth.employee.service'
+import { AppError } from '../../http/errors'
 
 const app = createApp()
 
@@ -65,6 +71,41 @@ describe('auth middleware API boundaries', () => {
     expect(vehicleService.listVehicles).not.toHaveBeenCalled()
   })
 
+  it('uses the unified login endpoint for employee credentials', async () => {
+    vi.mocked(employeeService.login).mockResolvedValue({
+      token: 'employee-jwt',
+      employee: { id: 'employee_1', email: 'owner@example.test' },
+    } as never)
+
+    const res = await request(app)
+      .post('/api/v1/auth/login')
+      .send({ email: 'owner@example.test', password: 'valid-password' })
+
+    expect(res.status).toBe(200)
+    expect(employeeService.login).toHaveBeenCalledWith({ email: 'owner@example.test', password: 'valid-password' })
+    expect(adminService.login).not.toHaveBeenCalled()
+    expect(res.headers['set-cookie']).toEqual(expect.arrayContaining([
+      expect.stringMatching(/^admin_session=;/),
+      expect.stringMatching(/^employee_session=/),
+    ]))
+  })
+
+  it('falls through to admin 2FA when unified login is not an employee account', async () => {
+    vi.mocked(employeeService.login).mockRejectedValue(new AppError('Invalid email or password', 401, 'invalid_credentials'))
+    vi.mocked(adminService.login).mockResolvedValue({ totpRequired: true } as never)
+
+    const res = await request(app)
+      .post('/api/v1/auth/login')
+      .send({ email: 'admin@example.test', password: 'valid-password' })
+
+    expect(res.status).toBe(401)
+    expect(res.body.error).toBe('totp_required')
+    expect(adminService.login).toHaveBeenCalledWith('admin@example.test', 'valid-password', undefined, undefined)
+    expect(res.headers['set-cookie']).toEqual(expect.arrayContaining([
+      expect.stringMatching(/^employee_session=;/),
+    ]))
+  })
+
   it('rejects employee-protected routes when a renter token is used', async () => {
     vi.mocked(jwt.verify).mockReturnValue({ sub: 'renter_1', type: 'renter' } as never)