Automated Merge from testing to main

.github/scripts/cleanUp.js

@@ -3,24 +3,24 @@ const User = require("../../server/models/user");
 const { deleteImageFromCloudinary } = require("../../server/config/cloudinary.js");
 const path = require("path");
 const dotenv = require("dotenv");
-dotenv.config({ path: path.resolve(__dirname, '../../.env') }); // Load .env file
+dotenv.config({ path: path.resolve(__dirname, '../../.env') }); // Load .env file (local dev only; CI supplies MONGODB_URI directly)
 
 const uri = process.env.MONGODB_URI;
 
 async function connectDB() {
   try {
-    await mongoose.connect(uri, {dbName: "Authentication-User-Dashboard-App"  });
+    await mongoose.connect(uri, { dbName: "Authentication-User-Dashboard-App" });
     console.log("Successfully connected to MongoDB via Mongoose!");
   } catch (error) {
     console.error("MongoDB connection error:", error);
-    process.exit(1); // Stop the server if database connection fails
+    process.exit(1); // Stop the script if database connection fails
   }
 }
 
 connectDB();
 
-const fetchUsersWithUnverifiedEmailsAndDelete = async () =>{
-  const users = await User.find()
+const fetchEmailsToDelete = async () => {
+  const users = await User.find();
   for (const user of users) {
     if (!user.email_verified) {
       try {
@@ -34,14 +34,13 @@ const fetchUsersWithUnverifiedEmailsAndDelete = async () =>{
         }
         await User.deleteOne({ _id: user._id });
         console.log(`Deleted user with unverified email: ${user.email}`);
-
       } catch (err) {
         console.error(`Error deleting user ${user.email}:`, err);
       }
     }
-  }console.log("Finished checking for unverified emails and deleting users.");
+  }
+  console.log("Finished checking for users to delete.");
   mongoose.connection.close(); // Close the connection after the operation is complete
 };
 
-
-fetchUsersWithUnverifiedEmailsAndDelete ();
+fetchEmailsToDelete();

.github/workflows/tests-automation.yml

@@ -1,5 +1,7 @@
 name: Tests Automation
 
+# Normally I would instead use a webhook as the trigger so the test runs on the latest deployment,
+# but I will instead use the Render API to fetch the current status of deployment to save costs.
 on:
   workflow_dispatch:
   push:
@@ -37,16 +39,23 @@ jobs:
       - name: Install dependencies
         run: npm install --legacy-peer-deps
 
-      # Installs OS system dependencies every run, but skips downloading the 
-      # actual browser binaries if they were found in our cache storage step.
       - name: Install Playwright browsers
         run: npx playwright install --with-deps
 
+      - name: Warm up Render instance
+        run: |
+          # NOTE: there is no /health route on the server, so this always got a 404
+          # and only "worked" because of the || true swallowing the failure.
+          # Hitting the actual signup page still wakes a cold Render instance.
+          curl -s https://audaf-testing.onrender.com/signup || true
+          sleep 5
+
       - name: Run tests
         run: npx playwright test
         env:
           CI: true
-
+          MONGODB_URI: ${{ secrets.MONGODB_URI }}
+
       - name: Format test results
         run: |
           if [ -f results.json ]; then
@@ -63,7 +72,7 @@ jobs:
             echo "| ❌ Failed | $FAILED |" >> $GITHUB_STEP_SUMMARY
             echo "| ⏭️ Skipped | $SKIPPED |" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
-            
+
             # Generate a native Markdown Pie Chart using Mermaid
             echo "#### Visual Breakdown" >> $GITHUB_STEP_SUMMARY
             echo "\`\`\`mermaid" >> $GITHUB_STEP_SUMMARY
@@ -82,7 +91,7 @@ jobs:
 
               # Deep-scans the JSON file, filters for unexpected results, and formats with the project name
               jq -r '.. | .specs? // empty | .[] | select(.tests[].results[].status != "expected") | .file as $file | .title as $title | .tests[] | select(.results[].status != "expected") | "* ❌ **" + $title + "** — 🌐 \`🏼" + .projectName + "\` *(in \`" + $file + "\`)*"' results.json >> $GITHUB_STEP_SUMMARY
-              
+
               echo "" >> $GITHUB_STEP_SUMMARY
               echo "❌ Failing tests detected. Halting pipeline automation."
               exit 1
@@ -102,4 +111,4 @@ jobs:
           source_branch: testing
           target_branch: main
           title: 'Automated Merge from testing to main'
-          body: 'This PR was automatically created by the Tests Automation workflow after successful tests.'
+          body: 'This PR was automatically created by the Tests Automation workflow after successful tests.'

client/src/components/ResetPassword.jsx

@@ -15,7 +15,7 @@ function ResetPasswordCard() {
 
 
   const validForm = () => {
-    return password.length >= 6 && password === confirmPassword;
+    return password.length >= 6 && password === confirmPassword && /[0-9]/.test(password);
   };
 
   const handleSubmit = async (e) => {
@@ -93,7 +93,7 @@ function ResetPasswordCard() {
               style={{ borderRadius: '0.75rem', padding: '0.75rem' }}
             />
             <Form.Control.Feedback type="invalid">
-              Password must be at least 6 characters
+              Password must be at least 6 characters long and contain at least one number
             </Form.Control.Feedback>
           </Form.Group>
 

client/src/components/VerifyCard.jsx

@@ -91,7 +91,8 @@ function VerifyCard() {
         navigate('/reset-password', { state: { email, resetToken } });
       }, 1000);
     } catch (error) {
-      let errorMsg = "Invalid verification code. Please try again.";
+      let errorMsg = error.response?.data?.error || "Verification failed. Please try again.";
+      toast.error(errorMsg);
       if (error.response) {
         if (error.response.status === 429) {
           errorMsg = "Too many attempts. Please wait 15 minutes.";

package.json

@@ -20,6 +20,7 @@
     "jsonwebtoken": "^9.0.3",
     "mongoose": "^9.1.2",
     "multer": "^2.1.1",
+    "nodemailer": "^9.0.3",
     "path": "^0.12.7",
     "rate-limit-redis": "^5.0.0",
     "react": "^18.2.0",
@@ -33,6 +34,7 @@
     "@playwright/test": "^1.60.0",
     "@types/node": "^25.9.1",
     "mailosaur": "^11.1.1",
+    "mailpit-api": "^2.1.0",
     "nodemon": "^3.1.14"
   },
   "scripts": {}

playwright.config.js

@@ -1,75 +1,29 @@
 // @ts-check
 import { defineConfig, devices } from '@playwright/test';
 
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// import dotenv from 'dotenv';
-// import path from 'path';
-// dotenv.config({ path: path.resolve(__dirname, '.env') });
-
-/**
- * @see https://playwright.dev/docs/test-configuration
- */
 export default defineConfig({
   testDir: './tests',
-  /* Run tests in files in parallel */
   fullyParallel: true,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: !!process.env.CI,
-  /* Retry on CI only */
   retries: process.env.CI ? 2 : 0,
-  /* Opt out of parallel tests on CI. */
   workers: process.env.CI ? 1 : undefined,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: process.env.CI 
+  reporter: process.env.CI
     ? [['list'], ['json', { outputFile: 'results.json' }]]
     : [['html']],
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    /* Base URL to use in actions like `await page.goto('')`. */
-    // baseURL: 'http://localhost:3000',
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
     trace: 'on-first-retry',
   },
 
-  /* Configure projects for major browsers */
   projects: [
-
+    {
+      name: 'setup',
+      testMatch: /.*1-signup\.spec\.ts/,
+    },
     {
       name: 'firefox',
       use: { ...devices['Desktop Firefox'] },
+      dependencies: ['setup'],
+      testIgnore: /.*1-signup\.spec\.ts/,
     },
-
-
-    /* Test against mobile viewports. */
-    // {
-    //   name: 'Mobile Chrome',
-    //   use: { ...devices['Pixel 5'] },
-    // },
-    // {
-    //   name: 'Mobile Safari',
-    //   use: { ...devices['iPhone 12'] },
-    // },
-
-    /* Test against branded browsers. */
-    // {
-    //   name: 'Microsoft Edge',
-    //   use: { ...devices['Desktop Edge'], channel: 'msedge' },
-    // },
-    // {
-    //   name: 'Google Chrome',
-    //   use: { ...devices['Desktop Chrome'], channel: 'chrome' },
-    // },
   ],
-
-  /* Run your local dev server before starting the tests */
-  // webServer: {
-  //   command: 'npm run start',
-  //   url: 'http://localhost:3000',
-  //   reuseExistingServer: !process.env.CI,
-  // },
-});
-
+});

server/controllers/emailSender.js

@@ -1,6 +1,35 @@
 require("dotenv").config(); // load .env
 
+const isTest = process.env.NODE_ENV === "test";
+const isdevelopment = process.env.NODE_ENV === "development";
+
 module.exports.sendMail = async (email, code) => {
+  if (isTest || isdevelopment) {
+    const response = await fetch(`${process.env.MAILPIT_URL}/api/v1/send`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        From: { Email: "authApp@gmail.com", Name: "Auth App" },
+        To: [{ Email: email }],
+        Subject: 'Your Verification Code',
+        HTML: `
+          <h3>Your Verification Code</h3>
+          <p>Your verification code is: <strong>${code}</strong></p>
+        `,
+      }),
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error('Mailpit send error:', response.status, errorText);
+      throw new Error('Failed to send email via Mailpit');
+    }
+
+    return response.json();
+  }
+
   const response = await fetch('https://api.brevo.com/v3/smtp/email', {
     method: 'POST',
     headers: {
@@ -27,6 +56,5 @@ module.exports.sendMail = async (email, code) => {
     throw new Error('Failed to send email via Brevo API');
   }
 
-  const data = await response.json();
-  return data;
-};
+  return response.json();
+};

server/routes/codeRequest.js

@@ -152,6 +152,10 @@ router.post("/resetPassword", doubleCsrfProtection, async (req, res) => {
     return res.status(400).json({ error: "Invalid payload input rules" });
   }
 
+  if(!/[0-9]/.test(newPassword)){
+    return res.status(400).json({ error: "Password must contain at least one number" });
+  }
+
   try {
     const decoded = jwt.verify(resetToken, process.env.JWT_SECRET_RESET_PASSWORD);
     if (!decoded || decoded.email !== email) {