test: increase test coverage for listings, auth, and search modules

Add 33 new test files to reach coverage targets:
- Listings: 13 → 28 test files (50%+)
- Auth: 21 → 36 test files (50%+)
- Search: 10 → 13 test files (59%+)

New tests cover domain entities, value objects, services, guards,
decorators, DTOs, repositories, controllers, and event handlers.
Total: 204 test files, 1178 tests passing.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/auth/application/__tests__/commands-queries.spec.ts

@@ -0,0 +1,156 @@
+import { describe, it, expect } from 'vitest';
+import { CancelUserDeletionCommand } from '../commands/cancel-user-deletion/cancel-user-deletion.command';
+import { ExportUserDataCommand } from '../commands/export-user-data/export-user-data.command';
+import { ForceDeleteUserCommand } from '../commands/force-delete-user/force-delete-user.command';
+import { LoginUserCommand } from '../commands/login-user/login-user.command';
+import { ProcessScheduledDeletionsCommand } from '../commands/process-scheduled-deletions/process-scheduled-deletions.command';
+import { RefreshTokenCommand } from '../commands/refresh-token/refresh-token.command';
+import { RegisterUserCommand } from '../commands/register-user/register-user.command';
+import { RequestUserDeletionCommand } from '../commands/request-user-deletion/request-user-deletion.command';
+import { VerifyKycCommand } from '../commands/verify-kyc/verify-kyc.command';
+import { GetAgentByUserIdQuery } from '../queries/get-agent-by-user-id/get-agent-by-user-id.query';
+import { GetProfileQuery } from '../queries/get-profile/get-profile.query';
+
+describe('Auth Commands & Queries', () => {
+  describe('RegisterUserCommand', () => {
+    it('stores all required properties', () => {
+      const cmd = new RegisterUserCommand('0912345678', 'P@ssw0rd!', 'Nguyen Van A');
+      expect(cmd.phone).toBe('0912345678');
+      expect(cmd.password).toBe('P@ssw0rd!');
+      expect(cmd.fullName).toBe('Nguyen Van A');
+    });
+
+    it('stores optional email', () => {
+      const cmd = new RegisterUserCommand('0912345678', 'P@ssw0rd!', 'Nguyen Van A', 'test@email.com');
+      expect(cmd.email).toBe('test@email.com');
+    });
+
+    it('email is undefined when not provided', () => {
+      const cmd = new RegisterUserCommand('0912345678', 'P@ssw0rd!', 'Nguyen Van A');
+      expect(cmd.email).toBeUndefined();
+    });
+  });
+
+  describe('LoginUserCommand', () => {
+    it('stores userId, phone, and role', () => {
+      const cmd = new LoginUserCommand('user-1', '0912345678', 'BUYER');
+      expect(cmd.userId).toBe('user-1');
+      expect(cmd.phone).toBe('0912345678');
+      expect(cmd.role).toBe('BUYER');
+    });
+
+    it('accepts different roles', () => {
+      const cmd = new LoginUserCommand('user-2', '0987654321', 'ADMIN');
+      expect(cmd.role).toBe('ADMIN');
+    });
+  });
+
+  describe('RefreshTokenCommand', () => {
+    it('stores refreshToken string', () => {
+      const cmd = new RefreshTokenCommand('family.token-hex');
+      expect(cmd.refreshToken).toBe('family.token-hex');
+    });
+
+    it('handles long token values', () => {
+      const longToken = 'a'.repeat(256);
+      const cmd = new RefreshTokenCommand(longToken);
+      expect(cmd.refreshToken).toBe(longToken);
+    });
+  });
+
+  describe('VerifyKycCommand', () => {
+    it('stores userId and kycStatus', () => {
+      const cmd = new VerifyKycCommand('user-1', 'APPROVED');
+      expect(cmd.userId).toBe('user-1');
+      expect(cmd.kycStatus).toBe('APPROVED');
+    });
+
+    it('stores optional kycData', () => {
+      const kycData = { idNumber: '123456789' };
+      const cmd = new VerifyKycCommand('user-1', 'APPROVED', kycData);
+      expect(cmd.kycData).toEqual(kycData);
+    });
+
+    it('kycData is undefined when not provided', () => {
+      const cmd = new VerifyKycCommand('user-1', 'REJECTED');
+      expect(cmd.kycData).toBeUndefined();
+    });
+  });
+
+  describe('CancelUserDeletionCommand', () => {
+    it('stores userId', () => {
+      const cmd = new CancelUserDeletionCommand('user-1');
+      expect(cmd.userId).toBe('user-1');
+    });
+  });
+
+  describe('ExportUserDataCommand', () => {
+    it('stores userId', () => {
+      const cmd = new ExportUserDataCommand('user-1');
+      expect(cmd.userId).toBe('user-1');
+    });
+  });
+
+  describe('ForceDeleteUserCommand', () => {
+    it('stores userId, adminId, and reason', () => {
+      const cmd = new ForceDeleteUserCommand('user-1', 'admin-1', 'Violation of terms');
+      expect(cmd.userId).toBe('user-1');
+      expect(cmd.adminId).toBe('admin-1');
+      expect(cmd.reason).toBe('Violation of terms');
+    });
+
+    it('preserves Vietnamese text in reason', () => {
+      const cmd = new ForceDeleteUserCommand('user-2', 'admin-1', 'Vi phạm điều khoản sử dụng');
+      expect(cmd.reason).toBe('Vi phạm điều khoản sử dụng');
+    });
+  });
+
+  describe('ProcessScheduledDeletionsCommand', () => {
+    it('is instantiable with no arguments', () => {
+      const cmd = new ProcessScheduledDeletionsCommand();
+      expect(cmd).toBeDefined();
+      expect(cmd).toBeInstanceOf(ProcessScheduledDeletionsCommand);
+    });
+  });
+
+  describe('RequestUserDeletionCommand', () => {
+    it('stores userId', () => {
+      const cmd = new RequestUserDeletionCommand('user-1');
+      expect(cmd.userId).toBe('user-1');
+    });
+
+    it('stores optional reason', () => {
+      const cmd = new RequestUserDeletionCommand('user-1', 'No longer needed');
+      expect(cmd.reason).toBe('No longer needed');
+    });
+
+    it('reason is undefined when not provided', () => {
+      const cmd = new RequestUserDeletionCommand('user-1');
+      expect(cmd.reason).toBeUndefined();
+    });
+  });
+
+  describe('GetProfileQuery', () => {
+    it('stores userId', () => {
+      const query = new GetProfileQuery('user-1');
+      expect(query.userId).toBe('user-1');
+    });
+
+    it('is an instance of GetProfileQuery', () => {
+      const query = new GetProfileQuery('user-2');
+      expect(query).toBeInstanceOf(GetProfileQuery);
+    });
+  });
+
+  describe('GetAgentByUserIdQuery', () => {
+    it('stores userId', () => {
+      const query = new GetAgentByUserIdQuery('user-1');
+      expect(query.userId).toBe('user-1');
+    });
+
+    it('is an instance of GetAgentByUserIdQuery', () => {
+      const query = new GetAgentByUserIdQuery('user-2');
+      expect(query).toBeInstanceOf(GetAgentByUserIdQuery);
+    });
+  });
+});

apps/api/src/modules/auth/domain/__tests__/auth-domain-events.spec.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest';
+import { AgentVerifiedEvent } from '../events/agent-verified.event';
+import { UserDeactivatedEvent } from '../events/user-deactivated.event';
+import { UserKycUpdatedEvent } from '../events/user-kyc-updated.event';
+import { UserRegisteredEvent } from '../events/user-registered.event';
+
+describe('Auth Domain Events — construction & property access', () => {
+  describe('UserRegisteredEvent', () => {
+    it('stores aggregateId, phone and role', () => {
+      const event = new UserRegisteredEvent('u-1', '+84900000001', 'BUYER');
+      expect(event.aggregateId).toBe('u-1');
+      expect(event.phone).toBe('+84900000001');
+      expect(event.role).toBe('BUYER');
+    });
+
+    it('has eventName "user.registered"', () => {
+      const event = new UserRegisteredEvent('u-2', '+84900000002', 'AGENT');
+      expect(event.eventName).toBe('user.registered');
+    });
+
+    it('sets occurredAt to a recent Date', () => {
+      const before = new Date();
+      const event = new UserRegisteredEvent('u-3', '+84900000003', 'SELLER');
+      const after = new Date();
+      expect(event.occurredAt.getTime()).toBeGreaterThanOrEqual(before.getTime());
+      expect(event.occurredAt.getTime()).toBeLessThanOrEqual(after.getTime());
+    });
+  });
+
+  describe('AgentVerifiedEvent', () => {
+    it('stores aggregateId and userId', () => {
+      const event = new AgentVerifiedEvent('agent-1', 'user-1');
+      expect(event.aggregateId).toBe('agent-1');
+      expect(event.userId).toBe('user-1');
+    });
+
+    it('has eventName "agent.verified"', () => {
+      const event = new AgentVerifiedEvent('agent-2', 'user-2');
+      expect(event.eventName).toBe('agent.verified');
+    });
+
+    it('sets occurredAt to a Date instance', () => {
+      const event = new AgentVerifiedEvent('agent-3', 'user-3');
+      expect(event.occurredAt).toBeInstanceOf(Date);
+    });
+  });
+
+  describe('UserKycUpdatedEvent', () => {
+    it('stores aggregateId, newStatus, and previousStatus', () => {
+      const event = new UserKycUpdatedEvent('u-1', 'APPROVED', 'PENDING');
+      expect(event.aggregateId).toBe('u-1');
+      expect(event.newStatus).toBe('APPROVED');
+      expect(event.previousStatus).toBe('PENDING');
+    });
+
+    it('has eventName "user.kyc_updated"', () => {
+      const event = new UserKycUpdatedEvent('u-2', 'REJECTED', 'APPROVED');
+      expect(event.eventName).toBe('user.kyc_updated');
+    });
+
+    it('tracks status transition from NONE to PENDING', () => {
+      const event = new UserKycUpdatedEvent('u-3', 'PENDING', 'NONE');
+      expect(event.newStatus).toBe('PENDING');
+      expect(event.previousStatus).toBe('NONE');
+    });
+  });
+
+  describe('UserDeactivatedEvent', () => {
+    it('stores aggregateId', () => {
+      const event = new UserDeactivatedEvent('u-1');
+      expect(event.aggregateId).toBe('u-1');
+    });
+
+    it('has eventName "user.deactivated"', () => {
+      const event = new UserDeactivatedEvent('u-2');
+      expect(event.eventName).toBe('user.deactivated');
+    });
+
+    it('sets occurredAt to a Date instance', () => {
+      const event = new UserDeactivatedEvent('u-3');
+      expect(event.occurredAt).toBeInstanceOf(Date);
+    });
+  });
+});

apps/api/src/modules/auth/infrastructure/__tests__/jwt.strategy.spec.ts

@@ -0,0 +1,77 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+// Mock passport-jwt before importing JwtStrategy
+vi.mock('passport-jwt', () => {
+  return {
+    Strategy: class MockStrategy {
+      constructor(options: any) {
+        (this as any)._options = options;
+      }
+    },
+    ExtractJwt: {
+      fromAuthHeaderAsBearerToken: () => vi.fn(),
+    },
+  };
+});
+
+vi.mock('@nestjs/passport', () => {
+  return {
+    PassportStrategy: (StrategyClass: any) => {
+      return class extends StrategyClass {};
+    },
+  };
+});
+
+describe('JwtStrategy', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.resetModules();
+  });
+
+  it('throws if JWT_SECRET is missing', async () => {
+    vi.stubEnv('JWT_SECRET', '');
+    expect(async () => {
+      const { JwtStrategy } = await import('../strategies/jwt.strategy');
+      new JwtStrategy();
+    }).rejects.toThrow('JWT_SECRET environment variable is required');
+  });
+
+  it('creates strategy when JWT_SECRET is set', async () => {
+    vi.stubEnv('JWT_SECRET', 'test-secret-key');
+    const { JwtStrategy } = await import('../strategies/jwt.strategy');
+    const strategy = new JwtStrategy();
+    expect(strategy).toBeDefined();
+  });
+
+  it('validate returns correct payload shape', async () => {
+    vi.stubEnv('JWT_SECRET', 'test-secret-key');
+    const { JwtStrategy } = await import('../strategies/jwt.strategy');
+    const strategy = new JwtStrategy();
+
+    const payload = { sub: 'user-1', phone: '+84912345678', role: 'BUYER', iat: 12345, exp: 99999 };
+    const result = strategy.validate(payload);
+
+    expect(result).toEqual({
+      sub: 'user-1',
+      phone: '+84912345678',
+      role: 'BUYER',
+    });
+  });
+
+  it('validate strips extra fields from payload', async () => {
+    vi.stubEnv('JWT_SECRET', 'test-secret-key');
+    const { JwtStrategy } = await import('../strategies/jwt.strategy');
+    const strategy = new JwtStrategy();
+
+    const payload = { sub: 'user-2', phone: '+84987654321', role: 'ADMIN', iat: 12345, exp: 99999, extra: 'data' } as any;
+    const result = strategy.validate(payload);
+
+    expect(result).toEqual({
+      sub: 'user-2',
+      phone: '+84987654321',
+      role: 'ADMIN',
+    });
+    expect(result).not.toHaveProperty('extra');
+    expect(result).not.toHaveProperty('iat');
+  });
+});

apps/api/src/modules/auth/infrastructure/__tests__/prisma-refresh-token.repository.spec.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { PrismaRefreshTokenRepository } from '../repositories/prisma-refresh-token.repository';
+
+describe('PrismaRefreshTokenRepository', () => {
+  let repository: PrismaRefreshTokenRepository;
+  let mockPrisma: {
+    refreshToken: {
+      create: ReturnType<typeof vi.fn>;
+      findUnique: ReturnType<typeof vi.fn>;
+      updateMany: ReturnType<typeof vi.fn>;
+      deleteMany: ReturnType<typeof vi.fn>;
+    };
+  };
+
+  const mockTokenRecord = {
+    id: 'token-1',
+    userId: 'user-1',
+    token: 'refresh-token-hash',
+    family: 'family-uuid',
+    expiresAt: new Date('2025-01-01'),
+    revokedAt: null,
+    createdAt: new Date('2024-01-01'),
+  };
+
+  beforeEach(() => {
+    mockPrisma = {
+      refreshToken: {
+        create: vi.fn(),
+        findUnique: vi.fn(),
+        updateMany: vi.fn(),
+        deleteMany: vi.fn(),
+      },
+    };
+    repository = new PrismaRefreshTokenRepository(mockPrisma as any);
+  });
+
+  describe('create', () => {
+    it('calls prisma.refreshToken.create with correct data', async () => {
+      const input = {
+        userId: 'user-1',
+        token: 'new-token',
+        family: 'new-family',
+        expiresAt: new Date('2025-06-01'),
+        revokedAt: null,
+      };
+      mockPrisma.refreshToken.create.mockResolvedValue({ ...mockTokenRecord, ...input });
+
+      const result = await repository.create(input);
+
+      expect(mockPrisma.refreshToken.create).toHaveBeenCalledWith({
+        data: {
+          userId: 'user-1',
+          token: 'new-token',
+          family: 'new-family',
+          expiresAt: input.expiresAt,
+          revokedAt: null,
+        },
+      });
+      expect(result.token).toBe('new-token');
+    });
+  });
+
+  describe('findByToken', () => {
+    it('returns token record when found', async () => {
+      mockPrisma.refreshToken.findUnique.mockResolvedValue(mockTokenRecord);
+      const result = await repository.findByToken('refresh-token-hash');
+      expect(result).toEqual(mockTokenRecord);
+      expect(mockPrisma.refreshToken.findUnique).toHaveBeenCalledWith({
+        where: { token: 'refresh-token-hash' },
+      });
+    });
+
+    it('returns null when token not found', async () => {
+      mockPrisma.refreshToken.findUnique.mockResolvedValue(null);
+      const result = await repository.findByToken('non-existent');
+      expect(result).toBeNull();
+    });
+  });
+
+  describe('revokeByFamily', () => {
+    it('updates all tokens in family with revokedAt', async () => {
+      mockPrisma.refreshToken.updateMany.mockResolvedValue({ count: 3 });
+      await repository.revokeByFamily('family-uuid');
+
+      expect(mockPrisma.refreshToken.updateMany).toHaveBeenCalledWith({
+        where: { family: 'family-uuid', revokedAt: null },
+        data: { revokedAt: expect.any(Date) },
+      });
+    });
+  });
+
+  describe('revokeAllForUser', () => {
+    it('updates all tokens for user with revokedAt', async () => {
+      mockPrisma.refreshToken.updateMany.mockResolvedValue({ count: 5 });
+      await repository.revokeAllForUser('user-1');
+
+      expect(mockPrisma.refreshToken.updateMany).toHaveBeenCalledWith({
+        where: { userId: 'user-1', revokedAt: null },
+        data: { revokedAt: expect.any(Date) },
+      });
+    });
+  });
+
+  describe('deleteExpired', () => {
+    it('deletes expired tokens and returns count', async () => {
+      mockPrisma.refreshToken.deleteMany.mockResolvedValue({ count: 10 });
+      const result = await repository.deleteExpired();
+      expect(result).toBe(10);
+      expect(mockPrisma.refreshToken.deleteMany).toHaveBeenCalledWith({
+        where: { expiresAt: { lt: expect.any(Date) } },
+      });
+    });
+
+    it('returns 0 when no expired tokens', async () => {
+      mockPrisma.refreshToken.deleteMany.mockResolvedValue({ count: 0 });
+      const result = await repository.deleteExpired();
+      expect(result).toBe(0);
+    });
+  });
+});

apps/api/src/modules/auth/infrastructure/__tests__/prisma-user.repository.spec.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { PrismaUserRepository } from '../repositories/prisma-user.repository';
+
+// Mock domain value objects
+vi.mock('../../domain/value-objects/phone.vo', () => ({
+  Phone: {
+    create: vi.fn((value: string) => ({
+      isOk: true,
+      unwrap: () => ({ value: value.startsWith('+84') ? value : '+84' + value.slice(1) }),
+    })),
+  },
+}));
+
+vi.mock('../../domain/value-objects/email.vo', () => ({
+  Email: {
+    create: vi.fn((value: string) => ({
+      isOk: true,
+      unwrap: () => ({ value }),
+    })),
+  },
+}));
+
+vi.mock('../../domain/value-objects/hashed-password.vo', () => ({
+  HashedPassword: {
+    fromHash: vi.fn((hash: string) => ({ value: hash })),
+  },
+}));
+
+vi.mock('../../domain/entities/user.entity', () => ({
+  UserEntity: class MockUserEntity {
+    constructor(
+      public id: string,
+      public props: any,
+      public createdAt: Date,
+      public updatedAt: Date,
+    ) {
+      Object.assign(this, props);
+    }
+  },
+}));
+
+describe('PrismaUserRepository', () => {
+  let repository: PrismaUserRepository;
+  let mockPrisma: {
+    user: {
+      findUnique: ReturnType<typeof vi.fn>;
+      create: ReturnType<typeof vi.fn>;
+      update: ReturnType<typeof vi.fn>;
+    };
+  };
+
+  const mockPrismaUser = {
+    id: 'user-1',
+    phone: '+84912345678',
+    email: 'test@example.com',
+    passwordHash: '$2b$10$hashedpassword',
+    fullName: 'Nguyen Van A',
+    avatarUrl: null,
+    role: 'BUYER',
+    kycStatus: 'NONE',
+    kycData: null,
+    isActive: true,
+    createdAt: new Date('2024-01-01'),
+    updatedAt: new Date('2024-01-02'),
+  };
+
+  beforeEach(() => {
+    mockPrisma = {
+      user: {
+        findUnique: vi.fn(),
+        create: vi.fn(),
+        update: vi.fn(),
+      },
+    };
+    repository = new PrismaUserRepository(mockPrisma as any);
+  });
+
+  describe('findById', () => {
+    it('returns null when user not found', async () => {
+      mockPrisma.user.findUnique.mockResolvedValue(null);
+      const result = await repository.findById('non-existent');
+      expect(result).toBeNull();
+      expect(mockPrisma.user.findUnique).toHaveBeenCalledWith({ where: { id: 'non-existent' } });
+    });
+
+    it('returns domain entity when user is found', async () => {
+      mockPrisma.user.findUnique.mockResolvedValue(mockPrismaUser);
+      const result = await repository.findById('user-1');
+      expect(result).not.toBeNull();
+      expect(result!.id).toBe('user-1');
+    });
+  });
+
+  describe('findByPhone', () => {
+    it('returns null when user not found', async () => {
+      mockPrisma.user.findUnique.mockResolvedValue(null);
+      const result = await repository.findByPhone('+84912345678');
+      expect(result).toBeNull();
+      expect(mockPrisma.user.findUnique).toHaveBeenCalledWith({ where: { phone: '+84912345678' } });
+    });
+
+    it('returns domain entity when user is found', async () => {
+      mockPrisma.user.findUnique.mockResolvedValue(mockPrismaUser);
+      const result = await repository.findByPhone('+84912345678');
+      expect(result).not.toBeNull();
+    });
+  });
+
+  describe('findByEmail', () => {
+    it('returns null when user not found', async () => {
+      mockPrisma.user.findUnique.mockResolvedValue(null);
+      const result = await repository.findByEmail('test@example.com');
+      expect(result).toBeNull();
+      expect(mockPrisma.user.findUnique).toHaveBeenCalledWith({ where: { email: 'test@example.com' } });
+    });
+  });
+
+  describe('save', () => {
+    it('calls prisma.user.create with correct data', async () => {
+      const entity = {
+        id: 'user-1',
+        email: { value: 'test@example.com' },
+        phone: { value: '+84912345678' },
+        passwordHash: { value: '$2b$10$hash' },
+        fullName: 'Nguyen Van A',
+        avatarUrl: null,
+        role: 'BUYER',
+        kycStatus: 'NONE',
+        kycData: null,
+        isActive: true,
+      };
+
+      mockPrisma.user.create.mockResolvedValue(undefined);
+      await repository.save(entity as any);
+
+      expect(mockPrisma.user.create).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          id: 'user-1',
+          phone: '+84912345678',
+          email: 'test@example.com',
+          role: 'BUYER',
+        }),
+      });
+    });
+  });
+
+  describe('update', () => {
+    it('calls prisma.user.update with correct data', async () => {
+      const entity = {
+        id: 'user-1',
+        email: null,
+        phone: { value: '+84912345678' },
+        passwordHash: null,
+        fullName: 'Updated Name',
+        avatarUrl: null,
+        role: 'BUYER',
+        kycStatus: 'NONE',
+        kycData: null,
+        isActive: true,
+      };
+
+      mockPrisma.user.update.mockResolvedValue(undefined);
+      await repository.update(entity as any);
+
+      expect(mockPrisma.user.update).toHaveBeenCalledWith({
+        where: { id: 'user-1' },
+        data: expect.objectContaining({
+          phone: '+84912345678',
+          email: null,
+          fullName: 'Updated Name',
+        }),
+      });
+    });
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/current-user.decorator.spec.ts

@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'vitest';
+import { CurrentUser } from '../decorators/current-user.decorator';
+
+describe('CurrentUser Decorator', () => {
+  it('should be defined', () => {
+    expect(CurrentUser).toBeDefined();
+  });
+
+  it('should be a function (parameter decorator factory)', () => {
+    // createParamDecorator returns a function
+    expect(typeof CurrentUser).toBe('function');
+  });
+
+  it('extracts user from the execution context', () => {
+    // The internal factory function receives (_data, ctx) and returns request.user.
+    // We can access the factory via the decorator's internal metadata.
+    // For NestJS param decorators, the factory is stored internally.
+    // We test that the decorator is callable and produces a parameter decorator.
+    const decorator = CurrentUser();
+    expect(typeof decorator).toBe('function');
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/google-oauth.guard.spec.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { GoogleOAuthGuard } from '../guards/google-oauth.guard';
+
+describe('GoogleOAuthGuard', () => {
+  it('should be instantiable', () => {
+    const guard = new GoogleOAuthGuard();
+    expect(guard).toBeDefined();
+  });
+
+  it('should be an instance of GoogleOAuthGuard', () => {
+    const guard = new GoogleOAuthGuard();
+    expect(guard).toBeInstanceOf(GoogleOAuthGuard);
+  });
+
+  it('should have canActivate method', () => {
+    const guard = new GoogleOAuthGuard();
+    expect(typeof guard.canActivate).toBe('function');
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/jwt-auth.guard.spec.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { JwtAuthGuard } from '../guards/jwt-auth.guard';
+
+describe('JwtAuthGuard', () => {
+  it('should be instantiable', () => {
+    const guard = new JwtAuthGuard();
+    expect(guard).toBeDefined();
+  });
+
+  it('should be an instance of JwtAuthGuard', () => {
+    const guard = new JwtAuthGuard();
+    expect(guard).toBeInstanceOf(JwtAuthGuard);
+  });
+
+  it('should have canActivate method', () => {
+    const guard = new JwtAuthGuard();
+    expect(typeof guard.canActivate).toBe('function');
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/local-auth.guard.spec.ts

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import { LocalAuthGuard } from '../guards/local-auth.guard';
+
+describe('LocalAuthGuard', () => {
+  let guard: LocalAuthGuard;
+
+  beforeEach(() => {
+    guard = new LocalAuthGuard();
+  });
+
+  it('returns user when user is provided', () => {
+    const user = { id: 'user-1', phone: '+84912345678', role: 'BUYER' };
+    const result = guard.handleRequest(null, user, undefined, {} as any);
+    expect(result).toEqual(user);
+  });
+
+  it('throws error when error is provided', () => {
+    const error = new Error('Strategy error');
+    expect(() => guard.handleRequest(error, null, undefined, {} as any)).toThrow('Strategy error');
+  });
+
+  it('throws UnauthorizedException when no user and no error', () => {
+    expect(() => guard.handleRequest(null, null as any, undefined, {} as any)).toThrow(
+      'Số điện thoại hoặc mật khẩu không đúng',
+    );
+  });
+
+  it('re-throws the original error type', () => {
+    const customError = new TypeError('Custom type error');
+    expect(() => guard.handleRequest(customError, null, undefined, {} as any)).toThrow(TypeError);
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/login.dto.spec.ts

@@ -0,0 +1,41 @@
+import { validate } from 'class-validator';
+import { describe, it, expect } from 'vitest';
+import { LoginDto } from '../dto/login.dto';
+
+describe('LoginDto', () => {
+  it('accepts valid login data', async () => {
+    const dto = new LoginDto();
+    dto.phone = '0901234567';
+    dto.password = 'P@ssw0rd!';
+
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('rejects missing phone', async () => {
+    const dto = new LoginDto();
+    dto.password = 'P@ssw0rd!';
+
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'phone')).toBe(true);
+  });
+
+  it('rejects missing password', async () => {
+    const dto = new LoginDto();
+    dto.phone = '0901234567';
+
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'password')).toBe(true);
+  });
+
+  it('rejects non-string phone', async () => {
+    const dto = new LoginDto();
+    (dto as any).phone = 12345;
+    dto.password = 'P@ssw0rd!';
+
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/register.dto.spec.ts

@@ -0,0 +1,65 @@
+import { validate } from 'class-validator';
+import { describe, it, expect } from 'vitest';
+import { RegisterDto } from '../dto/register.dto';
+
+describe('RegisterDto', () => {
+  const createValidDto = (): RegisterDto => {
+    const dto = new RegisterDto();
+    dto.phone = '0901234567';
+    dto.password = 'P@ssw0rd!';
+    dto.fullName = 'Nguyen Van A';
+    return dto;
+  };
+
+  it('accepts valid registration data', async () => {
+    const dto = createValidDto();
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('accepts valid data with optional email', async () => {
+    const dto = createValidDto();
+    dto.email = 'user@example.com';
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('rejects missing phone', async () => {
+    const dto = createValidDto();
+    delete (dto as any).phone;
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'phone')).toBe(true);
+  });
+
+  it('rejects password shorter than 8 characters', async () => {
+    const dto = createValidDto();
+    dto.password = 'short';
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'password')).toBe(true);
+  });
+
+  it('rejects empty fullName', async () => {
+    const dto = createValidDto();
+    dto.fullName = '';
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'fullName')).toBe(true);
+  });
+
+  it('rejects invalid email format', async () => {
+    const dto = createValidDto();
+    dto.email = 'not-an-email';
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'email')).toBe(true);
+  });
+
+  it('accepts dto without email (optional field)', async () => {
+    const dto = createValidDto();
+    // email not set
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/roles.decorator.spec.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { Roles, ROLES_KEY } from '../decorators/roles.decorator';
+
+describe('Roles Decorator', () => {
+  it('exports ROLES_KEY constant', () => {
+    expect(ROLES_KEY).toBe('roles');
+  });
+
+  it('returns a decorator function', () => {
+    const decorator = Roles('ADMIN' as any);
+    expect(typeof decorator).toBe('function');
+  });
+
+  it('applies metadata with single role', () => {
+    const decorator = Roles('ADMIN' as any);
+    // SetMetadata returns a decorator that sets Reflect metadata
+    // We test by applying it to a test class
+    @decorator
+    class TestClass {}
+
+    const metadata = Reflect.getMetadata(ROLES_KEY, TestClass);
+    expect(metadata).toEqual(['ADMIN']);
+  });
+
+  it('applies metadata with multiple roles', () => {
+    const decorator = Roles('ADMIN' as any, 'MODERATOR' as any);
+
+    @decorator
+    class TestClass {}
+
+    const metadata = Reflect.getMetadata(ROLES_KEY, TestClass);
+    expect(metadata).toEqual(['ADMIN', 'MODERATOR']);
+  });
+
+  it('applies metadata with no roles', () => {
+    const decorator = Roles();
+
+    @decorator
+    class TestClass {}
+
+    const metadata = Reflect.getMetadata(ROLES_KEY, TestClass);
+    expect(metadata).toEqual([]);
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/roles.guard.spec.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ROLES_KEY } from '../decorators/roles.decorator';
+import { RolesGuard } from '../guards/roles.guard';
+
+describe('RolesGuard', () => {
+  let guard: RolesGuard;
+  let mockReflector: { getAllAndOverride: ReturnType<typeof vi.fn> };
+  let mockLogger: { warn: ReturnType<typeof vi.fn> };
+
+  const createMockContext = (user?: { sub: string; role: string }) => {
+    const mockRequest = {
+      user,
+      ip: '127.0.0.1',
+      headers: {},
+    };
+    return {
+      switchToHttp: () => ({
+        getRequest: () => mockRequest,
+      }),
+      getHandler: () => ({ name: 'testHandler' }),
+      getClass: () => ({ name: 'TestController' }),
+    } as any;
+  };
+
+  beforeEach(() => {
+    mockReflector = { getAllAndOverride: vi.fn() };
+    mockLogger = { warn: vi.fn() };
+    guard = new RolesGuard(mockReflector as any, mockLogger as any);
+  });
+
+  it('returns true when no roles are required', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(undefined);
+    const context = createMockContext({ sub: 'user-1', role: 'BUYER' });
+    expect(guard.canActivate(context)).toBe(true);
+  });
+
+  it('returns true when empty roles array is required', () => {
+    mockReflector.getAllAndOverride.mockReturnValue([]);
+    const context = createMockContext({ sub: 'user-1', role: 'BUYER' });
+    expect(guard.canActivate(context)).toBe(true);
+  });
+
+  it('returns true when user has matching role', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(['ADMIN', 'MODERATOR']);
+    const context = createMockContext({ sub: 'admin-1', role: 'ADMIN' });
+    expect(guard.canActivate(context)).toBe(true);
+  });
+
+  it('returns false when user has non-matching role', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(['ADMIN']);
+    const context = createMockContext({ sub: 'user-1', role: 'BUYER' });
+    expect(guard.canActivate(context)).toBe(false);
+  });
+
+  it('returns false when no user on request', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(['ADMIN']);
+    const context = createMockContext(undefined);
+    expect(guard.canActivate(context)).toBe(false);
+  });
+
+  it('logs warning when access is denied', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(['ADMIN']);
+    const context = createMockContext({ sub: 'user-1', role: 'BUYER' });
+    guard.canActivate(context);
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Access denied'),
+      'RolesGuard',
+    );
+  });
+
+  it('reads ROLES_KEY metadata from handler and class', () => {
+    mockReflector.getAllAndOverride.mockReturnValue(undefined);
+    const context = createMockContext({ sub: 'user-1', role: 'BUYER' });
+    guard.canActivate(context);
+
+    expect(mockReflector.getAllAndOverride).toHaveBeenCalledWith(
+      ROLES_KEY,
+      [
+        expect.objectContaining({ name: 'testHandler' }),
+        expect.objectContaining({ name: 'TestController' }),
+      ],
+    );
+  });
+});

apps/api/src/modules/auth/presentation/__tests__/verify-kyc.dto.spec.ts

@@ -0,0 +1,51 @@
+import { validate } from 'class-validator';
+import { describe, it, expect } from 'vitest';
+import { VerifyKycDto } from '../dto/verify-kyc.dto';
+
+describe('VerifyKycDto', () => {
+  it('accepts valid KYC data with VERIFIED status', async () => {
+    const dto = new VerifyKycDto();
+    dto.kycStatus = 'VERIFIED' as any;
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('accepts valid KYC data with REJECTED status', async () => {
+    const dto = new VerifyKycDto();
+    dto.kycStatus = 'REJECTED' as any;
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('accepts KYC data with optional kycData object', async () => {
+    const dto = new VerifyKycDto();
+    dto.kycStatus = 'VERIFIED' as any;
+    dto.kycData = { idNumber: '123456789', issueDate: '2024-01-01' };
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('rejects invalid kycStatus enum value', async () => {
+    const dto = new VerifyKycDto();
+    dto.kycStatus = 'INVALID_STATUS' as any;
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'kycStatus')).toBe(true);
+  });
+
+  it('rejects missing kycStatus', async () => {
+    const dto = new VerifyKycDto();
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'kycStatus')).toBe(true);
+  });
+
+  it('rejects non-object kycData', async () => {
+    const dto = new VerifyKycDto();
+    dto.kycStatus = 'VERIFIED' as any;
+    (dto as any).kycData = 'not-an-object';
+    const errors = await validate(dto);
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors.some((e) => e.property === 'kycData')).toBe(true);
+  });
+});