fix(auth,users): address second round of CodeRabbit review

- Use centralized mails.isConfigured() instead of duplicated logic
- Add getBaseUrl() helper for defensive cors.origin access
- Add @returns {void} to auth route registrar JSDoc
- Add full JSDoc for optionalJwt middleware
- Add .exec() to findByEmail for consistency with other repo methods

Author: PierreBrisorgueil

modules/auth/controllers/auth.controller.js

@@ -26,10 +26,23 @@ const tokenCookieOptions = {
 };
 
 /**
- * @desc Check whether the mailer is configured with a real sender address
+ * @desc Check whether the mailer is configured with a real sender address.
+ * Delegates to the centralized helper in lib/helpers/mailer.
  * @returns {boolean} true when SMTP mail sending is available
  */
-const isMailerConfigured = () => !!(config.mailer && config.mailer.from && !config.mailer.from.startsWith('DEVKIT_NODE_'));
+const isMailerConfigured = () => mails.isConfigured();
+
+/**
+ * @desc Resolve the first CORS origin as a base URL string.
+ * Handles both array and string forms of config.cors.origin.
+ * @returns {string} The base URL for building client-facing links.
+ */
+const getBaseUrl = () => {
+  const origin = config.cors?.origin;
+  if (Array.isArray(origin) && origin.length > 0) return origin[0];
+  if (typeof origin === 'string') return origin;
+  return '';
+};
 
 /**
  * @desc Send a verification email to the user with a signed token link
@@ -44,7 +57,7 @@ const sendVerificationEmail = async (user, verificationToken) => {
     subject: 'Verify your email address',
     params: {
       displayName: `${user.firstName} ${user.lastName}`,
-      url: `${config.cors.origin[0]}/verify-email?token=${verificationToken}`,
+      url: `${getBaseUrl()}/verify-email?token=${verificationToken}`,
       appName: config.app.title,
       appContact: config.app.contact,
     },

modules/auth/routes/auth.routes.js

@@ -12,11 +12,19 @@ import authPassword from '../controllers/auth.password.controller.js';
 /**
  * Register authentication routes on the Express application.
  * @param {Object} app - Express application instance
+ * @returns {void}
  */
 export default (app) => {
   const authLimiter = limiters.auth;
 
   // Auth config — optional JWT: public fields for everyone, org details for authenticated users
+  /**
+   * @desc Middleware that optionally authenticates via JWT, attaching user if valid but allowing unauthenticated requests.
+   * @param {Object} req - Express request object
+   * @param {Object} res - Express response object
+   * @param {Function} next - Express next middleware function
+   * @returns {void}
+   */
   const optionalJwt = (req, res, next) => {
     passport.authenticate('jwt', { session: false }, (err, user) => {
       if (user) req.user = user;

modules/users/repositories/users.repository.js

@@ -154,7 +154,7 @@ const searchByNameOrEmail = (search) => {
  * @param {String} email - The email to search for
  * @returns {Promise<Object|null>} The matching user or null
  */
-const findByEmail = (email) => User.findOne({ email });
+const findByEmail = (email) => User.findOne({ email }).exec();
 
 /**
  * @desc Function to update a user by ID with a partial update object