Bugfix(modeling-commons): treat legacy sign up as password reset

Author: omargfh

apps/modeling-commons-backend/src/server/plugins/auth.ts

@@ -112,7 +112,28 @@ async function authPlugin(fastify: FastifyInstance) {
           ...(request.body ? { body: JSON.stringify(request.body) } : {}),
         });
 
-        const response = await auth.handler(req);
+        const signUpEmailPath = `${auth.options.basePath}/sign-up/email`;
+
+        let response: Response;
+        if (url.pathname === signUpEmailPath && request.method === 'POST') {
+          const { email } = request.body as { email?: string };
+          const isLegacyUserWithNoAccount = email
+            ? await prisma.user.findFirst({
+                where: {
+                  email,
+                  legacyId: { not: null },
+                  accounts: { none: {} },
+                },
+              })
+            : null;
+
+          response =
+            isLegacyUserWithNoAccount && email
+              ? await auth.api.requestPasswordReset({ asResponse: true, body: { email } })
+              : await auth.handler(req);
+        } else {
+          response = await auth.handler(req);
+        }
 
         reply.status(response.status);
         response.headers.forEach((value, key) => reply.header(key, value));

apps/modeling-commons-backend/tests/api/auth.feature

@@ -22,3 +22,25 @@ Feature: Authentication
     Given a verified user with email "carol@test.local" and password "StrongPass1!"
     When I sign in with email "carol@test.local" and password "WrongPass1!"
     Then the signin should be rejected
+
+  @legacy-signup
+  Scenario: Legacy user without an account gets a password reset instead of a sign-up
+    Given a legacy user with email "legacy@test.local" and no linked account
+    When I sign up with name "Legacy" email "legacy@test.local" and password "StrongPass1!"
+    Then the response status should be 200
+    And the response body should not have property "user"
+    And the user "legacy@test.local" should still have no linked account
+
+  @legacy-signup
+  Scenario: Existing user with an account is handled normally on sign-up
+    Given a verified user with email "existing@test.local" and password "StrongPass1!"
+    When I sign up with name "Existing" email "existing@test.local" and password "StrongPass1!"
+    Then the response status should be 200
+    And the response body should have property "user"
+
+  @legacy-signup
+  Scenario: New user with no account is signed up normally
+    When I sign up with name "Newbie" email "newbie@test.local" and password "StrongPass1!"
+    Then the response status should be 200
+    And the response body should have property "user"
+    And the user "newbie@test.local" should have a linked account

apps/modeling-commons-backend/tests/api/auth.steps.ts

@@ -3,13 +3,42 @@ import { Given, When, Then } from '@cucumber/cucumber';
 import type { ICustomWorld } from '../support/custom-world.ts';
 import { signUp } from '../support/auth-helper.ts';
 
+interface PrismaCradle {
+  prisma: {
+    user: {
+      create: (args: { data: Record<string, unknown> }) => Promise<{ id: string }>;
+      findFirst: (args: {
+        where: Record<string, unknown>;
+        include?: Record<string, unknown>;
+      }) => Promise<{ id: string; accounts: unknown[] } | null>;
+    };
+  };
+}
+
+let legacyIdCounter = 0;
+
 Given(
   'a registered user with email {string}',
   async function (this: ICustomWorld, email: string) {
     await signUp(this.server, { email });
   },
 );
 
+Given(
+  'a legacy user with email {string} and no linked account',
+  async function (this: ICustomWorld, email: string) {
+    const { prisma } = this.server.diContainer.cradle as unknown as PrismaCradle;
+    await prisma.user.create({
+      data: {
+        name: 'Legacy User',
+        email,
+        emailVerified: true,
+        legacyId: ++legacyIdCounter,
+      },
+    });
+  },
+);
+
 Given(
   'a verified user with email {string} and password {string}',
   async function (this: ICustomWorld, email: string, password: string) {
@@ -64,3 +93,26 @@ Then(
     assert.ok(code >= 400, `Expected error status code, got ${code}`);
   },
 );
+
+async function findAccountCount(this: ICustomWorld, email: string): Promise<number> {
+  const { prisma } = this.server.diContainer.cradle as unknown as PrismaCradle;
+  const user = await prisma.user.findFirst({ where: { email }, include: { accounts: true } });
+  assert.ok(user, `Expected a user with email "${email}"`);
+  return user.accounts.length;
+}
+
+Then(
+  'the user {string} should still have no linked account',
+  async function (this: ICustomWorld, email: string) {
+    const count = await findAccountCount.call(this, email);
+    assert.strictEqual(count, 0, `Expected no linked account, found ${count}`);
+  },
+);
+
+Then(
+  'the user {string} should have a linked account',
+  async function (this: ICustomWorld, email: string) {
+    const count = await findAccountCount.call(this, email);
+    assert.ok(count > 0, 'Expected a linked account, found none');
+  },
+);