fix failed tests

apps/api/src/tests/integration/admin.test.ts

@@ -12,6 +12,7 @@ const app = createApp()
 
 describe('Admin API', () => {
   let adminToken: string
+  let protectedAdminToken: string
   let financeToken: string
   let viewerToken: string
   let adminId: string
@@ -28,17 +29,30 @@ describe('Admin API', () => {
     adminId = admin.id
     adminToken = signAdminToken(admin.id)
 
+    const protectedAdmin = await createAdminUser({
+      email:       'protected-admin@test.com',
+      role:        'ADMIN',
+      password:    'AdminPass123!',
+      totpEnabled: true,
+      totpSecret:  'JBSWY3DPEHPK3PXP',
+    })
+    protectedAdminToken = signAdminToken(protectedAdmin.id)
+
     const financeAdmin = await createAdminUser({
-      email:    'finance-admin@test.com',
-      role:     'FINANCE',
-      password: 'FinancePass123!',
+      email:       'finance-admin@test.com',
+      role:        'FINANCE',
+      password:    'FinancePass123!',
+      totpEnabled: true,
+      totpSecret:  'JBSWY3DPEHPK3PXP',
     })
     financeToken = signAdminToken(financeAdmin.id)
 
     const viewerAdmin = await createAdminUser({
-      email:    'viewer-admin@test.com',
-      role:     'VIEWER',
-      password: 'ViewerPass123!',
+      email:       'viewer-admin@test.com',
+      role:        'VIEWER',
+      password:    'ViewerPass123!',
+      totpEnabled: true,
+      totpSecret:  'JBSWY3DPEHPK3PXP',
     })
     viewerToken = signAdminToken(viewerAdmin.id)
 
@@ -90,7 +104,7 @@ describe('Admin API', () => {
     it('returns paginated companies', async () => {
       const res = await request(app)
         .get('/api/v1/admin/companies')
-        .set(authHeader(adminToken))
+        .set(authHeader(protectedAdminToken))
 
       expect(res.status).toBe(200)
       expect(Array.isArray(res.body.data.data)).toBe(true)
@@ -103,7 +117,7 @@ describe('Admin API', () => {
     it('returns paginated renters', async () => {
       const res = await request(app)
         .get('/api/v1/admin/renters')
-        .set(authHeader(adminToken))
+        .set(authHeader(protectedAdminToken))
 
       expect(res.status).toBe(200)
       expect(Array.isArray(res.body.data.data)).toBe(true)

apps/api/src/tests/integration/infrastructure-boundaries.test.ts

@@ -2,14 +2,21 @@ import { describe, expect, it } from 'vitest'
 import { assertImageFile, assertImageFiles } from '../../http/upload'
 import { assertStorageConfiguration } from '../../lib/storage'
 
-function fakeFile(mimetype: string, originalname = 'upload.jpg'): Express.Multer.File {
+const imageFixtures: Record<string, { name: string; buffer: Buffer }> = {
+  'image/jpeg': { name: 'upload.jpg', buffer: Buffer.from([0xff, 0xd8, 0xff, 0x00]) },
+  'image/png':  { name: 'upload.png', buffer: Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]) },
+}
+
+function fakeFile(mimetype: string, originalname?: string): Express.Multer.File {
+  const fixture = imageFixtures[mimetype]
+
   return {
     fieldname: 'file',
-    originalname,
+    originalname: originalname ?? fixture?.name ?? 'upload.bin',
     encoding: '7bit',
     mimetype,
-    size: 10,
-    buffer: Buffer.from('x'),
+    size: fixture?.buffer.length ?? 10,
+    buffer: fixture?.buffer ?? Buffer.from('x'),
     stream: undefined as any,
     destination: '',
     filename: '',
@@ -21,7 +28,7 @@ describe('infrastructure boundaries', () => {
   it('keeps upload validation strict before service-layer storage writes happen', () => {
     expect(() => assertImageFile(fakeFile('image/jpeg'))).not.toThrow()
     expect(() => assertImageFiles([fakeFile('image/png')])).not.toThrow()
-    expect(() => assertImageFile(fakeFile('application/pdf', 'id.pdf'))).toThrow('Only image uploads are supported')
+    expect(() => assertImageFile(fakeFile('application/pdf', 'id.pdf'))).toThrow('Unsupported or spoofed image file')
     expect(() => assertImageFiles([fakeFile('image/png'), fakeFile('text/plain', 'notes.txt')])).toThrow('notes.txt')
   })
 

apps/api/src/tests/integration/operations.test.ts

@@ -23,6 +23,10 @@ describe('Operations API integration', () => {
     const { company, employee } = await createCompanyWithEmployee({ role: 'OWNER' })
     companyId = company.id
     employeeId = employee.id
+    await prisma.employee.update({
+      where: { id: employee.id },
+      data:  { passwordHash: 'accepted-test-password-hash' },
+    })
     token = signEmployeeToken(employee.id, company.id, 'OWNER')
   })
 

apps/api/src/tests/integration/public-validation-boundaries.test.ts

@@ -20,7 +20,8 @@ describe('public validation boundaries', () => {
       provider: 'STRIPE',
       successUrl: 'https://ok.example.test',
       failureUrl: 'https://fail.example.test',
-    }))).toThrow('Validation failed')
+      accessToken: 'booking-access-token-123',
+    }))).toThrow('Invalid enum value')
   })
 
   it('requires enough anonymous marketplace reservation identity to create a booking request', () => {

apps/dashboard/src/lib/api.test.ts

@@ -30,7 +30,7 @@ describe('dashboard apiFetch', () => {
     const { apiFetch } = await import('./api')
     await expect(apiFetch('/team')).resolves.toEqual({ ok: true })
 
-    expect(fetchMock).toHaveBeenCalledWith('/dashboard/api/v1/team', expect.objectContaining({
+    expect(fetchMock).toHaveBeenCalledWith(expect.stringMatching(/\/api\/v1\/team$/), expect.objectContaining({
       credentials: 'include',
       headers: expect.objectContaining({
         'Content-Type': 'application/json',