From 9038572ff9f896f22db1011faaaf2251ada1146a Mon Sep 17 00:00:00 2001
From: Phillip Thelen <phillip@habitica.com>
Date: Wed, 9 Apr 2025 13:13:03 +0200
Subject: [PATCH] add tests for new api route

---
 .../user/auth/POST-user_auth_social.test.js   |  2 +-
 .../api/v4/user/auth/POST-check_email.test.js | 56 +++++++++++++++++++
 website/server/controllers/api-v4/auth.js     |  9 +++
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 test/api/v4/user/auth/POST-check_email.test.js

diff --git a/test/api/v3/integration/user/auth/POST-user_auth_social.test.js b/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
index f4e8d0f6c3..1982c4bdb6 100644
--- a/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
+++ b/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
@@ -7,7 +7,7 @@ import {
   getProperty,
 } from '../../../../../helpers/api-integration/v3';
 
-describe.only('POST /user/auth/social', () => {
+describe('POST /user/auth/social', () => {
   let api;
   let user;
   const endpoint = '/user/auth/social';
diff --git a/test/api/v4/user/auth/POST-check_email.test.js b/test/api/v4/user/auth/POST-check_email.test.js
new file mode 100644
index 0000000000..0e869cbe67
--- /dev/null
+++ b/test/api/v4/user/auth/POST-check_email.test.js
@@ -0,0 +1,56 @@
+import {
+  translate as t,
+  requester,
+  generateUser,
+} from '../../../../helpers/api-integration/v4';
+
+const ENDPOINT = '/user/auth/check-email';
+
+describe('POST /user/auth/check-email', () => {
+  const email = 'SOmE-nEw-emAIl_2@example.net';
+  let api;
+
+  beforeEach(async () => {
+    api = requester();
+  });
+
+  it('returns email if it is not used yet', async () => {
+    const response = await api.post(ENDPOINT, {
+      email,
+    });
+    expect(response.email).to.eql(email);
+  });
+
+  it('rejects if email is not provided', async () => {
+    await expect(api.post(ENDPOINT, {
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: 'Invalid request parameters.',
+    });
+  });
+
+  it('rejects if email is already taken', async () => {
+    const user = await generateUser();
+
+    await expect(api.post(ENDPOINT, {
+      email: user.auth.local.email,
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('emailTaken'),
+    });
+  });
+
+  it('rejects if casing is different', async () => {
+    const user = await generateUser();
+
+    await expect(api.post(ENDPOINT, {
+      email: user.auth.local.email.toUpperCase(),
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('emailTaken'),
+    });
+  });
+});
diff --git a/website/server/controllers/api-v4/auth.js b/website/server/controllers/api-v4/auth.js
index ed20d65692..3ba48f3f64 100644
--- a/website/server/controllers/api-v4/auth.js
+++ b/website/server/controllers/api-v4/auth.js
@@ -101,6 +101,15 @@ api.checkEmail = {
   method: 'POST',
   url: '/user/auth/check-email',
   async handler (req, res) {
+    req.checkBody({
+      email: {
+        notEmpty: { errorMessage: res.t('missingEmail') },
+      },
+    });
+
+    const validationErrors = req.validationErrors();
+    if (validationErrors) throw validationErrors;
+
     const emailAlreadyInUse = await User.findOne({
       'auth.local.email': req.body.email.toLowerCase(),
     }).select({ _id: 1 }).lean().exec();