feat: microservice ready

tests/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "tests"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+imphnen-libs = { version = "0.1.0", path = "../imphnen-libs" }
+imphnen-utils = { version = "0.1.0", path = "../imphnen-utils" }
+imphnen-entities = { version = "0.1.0", path = "../imphnen-entities" }
+imphnen-iam-service = { version = "0.1.0", path = "../imphnen-iam-service" }
+axum.workspace = true
+axum-test.workspace = true
+chrono.workspace = true
+surrealdb.workspace = true
+tokio.workspace = true
+serde_json.workspace = true

tests/src/iam_service/auth/auth_controller_test.rs

@@ -0,0 +1,667 @@
+use crate::{
+	AuthOtpSchema, AuthRepository, OtpManager, ResourceEnum, RolesRepository,
+	UsersRepository, auth::auth_router, create_mock_app_state, create_test_user,
+	encode_refresh_token,
+};
+use axum::{Extension, http::StatusCode};
+use axum_test::TestServer;
+use serde_json::json;
+use surrealdb::Uuid;
+
+#[tokio::test]
+async fn test_login_should_fail_with_invalid_user() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "nonexistent@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	println!("🧪 Response Body: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_with_wrong_password() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = UsersRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user = create_test_user("user@example.com", "User Satu", true, &role_id);
+	user.password = crate::hash_password("correctpassword").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "user@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Wrong password: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_user_not_active() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = UsersRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user = create_test_user(
+		"inactive-again@example.com",
+		"Inactive User",
+		false,
+		&role_id,
+	);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "inactive-again@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Not active user: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = UsersRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user =
+		create_test_user("active@example.com", "Active User", true, &role_id);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "active@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert!(json["data"]["token"]["access_token"].is_string());
+	assert!(json["data"]["user"]["email"] == "active@example.com");
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test@test.com",
+			"password": ""
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_email_not_valid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test",
+			"password": "test123"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let random_email = format!("validuser+{}@example.com", Uuid::new_v4());
+	let payload = json!({
+		"email": random_email,
+		"password": "Validpass1!",
+		"fullname": "Valid User",
+		"student_type": "regular",
+		"phone_number": "0812345678",
+		"reffered_by": "Facebook",
+		"refferal_code": "KFNB"
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_already_taken() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = UsersRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user =
+		create_test_user("duplicate@example.com", "User Exists", false, &role_id);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"fullname": "User Exists",
+		"email": "duplicate@example.com",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"fullname": "Invalid Email",
+		"email": "invalid-email",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({
+		"fullname": "No Password",
+		"email": "nopass@example.com",
+		"password": "",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "user@example.com"
+	});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "OTP resent successfully");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_email_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email cannot be empty, Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_with_invalid_email_format() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({ "email": "not-an-email" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_otp_store_fails() {
+	let mut state = create_mock_app_state().await;
+	state.surrealdb_mem = surrealdb::Surreal::new::<surrealdb::engine::local::Mem>(())
+		.await
+		.expect("failed to create mock surrealdb_mem");
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = serde_json::json!({ "email": "fail-store@example.com" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Specify a namespace to use") || body.contains("Failed store otp"),
+		"Expected namespace setup error or store failure, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user =
+		create_test_user("forgot@example.com", "Forgot User", true, &role_id);
+	user.password = crate::hash_password("secret").unwrap();
+	let user_repo = UsersRepository::new(&state);
+	user_repo.query_create_user(user).await.unwrap();
+	let payload = json!({ "email": "forgot@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(
+		body.contains("Reset Password request send"),
+		"Unexpected response: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "notfound@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("User not found"),
+		"Expected 'User not found', got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Email not valid") || body.contains("User not found"),
+		"Expected email error, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_refresh_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let valid_token = encode_refresh_token("refreshme@example.com".into()).unwrap();
+	let payload = json!({
+		"refresh_token": valid_token
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.json::<serde_json::Value>();
+	assert!(body["data"]["access_token"].is_string());
+	assert!(body["data"]["refresh_token"].is_string());
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_invalid_token() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"refresh_token": "invalid.token.value"
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	assert!(body.contains("Invalid refresh token"));
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_verify_email_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let user = create_test_user("verify@example.com", "Verify User", false, &role_id);
+	let otp = OtpManager::generate_otp();
+	let user_repo = UsersRepository::new(&state);
+	let auth_repo = AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": otp
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Email verified successfully"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_wrong_otp() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let user = create_test_user("wrongotp@example.com", "Wrong OTP", false, &role_id);
+	let otp = OtpManager::generate_otp();
+	let user_repo = UsersRepository::new(&state);
+	let auth_repo = AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 999_999
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("Failed to verify OTP"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_if_otp_expired() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let user = create_test_user("expired@example.com", "Expired OTP", false, &role_id);
+	let user_repo = UsersRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	use chrono::{Duration, Utc};
+	let expired_otp = AuthOtpSchema {
+		otp: 123456,
+		expires_at: Utc::now() - Duration::minutes(1),
+	};
+	let _: Option<AuthOtpSchema> = state
+		.surrealdb_mem
+		.create((ResourceEnum::OtpCache.to_string(), user.email.clone()))
+		.content(expired_otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 123456
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("OTP expired"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let res = server.post("/v1/auth/verify-email").json(&json!({})).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_new_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let email = "resetme@example.com";
+	let repo = UsersRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let role_id = role_repo
+		.query_role_by_name("Student".to_string())
+		.await
+		.unwrap()
+		.id;
+	let mut user = create_test_user(email, "Reset User", true, &role_id);
+	user.password = crate::hash_password("oldpass123!").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Success update password user"));
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_token_is_empty() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let payload = json!({
+		"token": "",
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Invalid or missing token"),
+		"Gagal deteksi token kosong: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_password_is_weak() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let email = "weakpass@example.com";
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "123"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Password must have at least")
+			|| body.contains("Password must include"),
+		"Pesan error nggak sesuai: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let token =
+		crate::encode_reset_password_token("ghost@example.com".into()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Validpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}

tests/src/iam_service/auth/auth_repository_test.rs

@@ -0,0 +1,186 @@
+#[cfg(test)]
+mod auth_repository_test {
+	use crate::{
+		create_mock_app_state, get_iso_date, make_thing, AuthOtpSchema, AuthRepository,
+		ResourceEnum, RolesItemDtoRaw, UsersItemDtoRaw, UsersRepository, UsersSchema,
+	};
+	use chrono::{Duration, Utc};
+	use surrealdb::Uuid;
+
+	fn create_mock_user(email: &str) -> UsersSchema {
+		UsersSchema {
+			id: make_thing("app_users", &Uuid::new_v4().to_string()),
+			email: email.to_string(),
+			fullname: "Test User".to_string(),
+			password: "password".to_string(),
+			is_deleted: false,
+			avatar: None,
+			phone_number: "081234567890".to_string(),
+			is_active: true,
+			gender: None,
+			birthdate: None,
+			role: make_thing("roles", "user"),
+			created_at: get_iso_date(),
+			updated_at: get_iso_date(),
+		}
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_user() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("forgot@example.com");
+		let user_repo = UsersRepository::new(&app_state);
+		let user_data = user_repo
+			.query_user_by_email("forgot@example.com".to_string())
+			.await
+			.unwrap();
+		let store = repo.query_store_user(user_data.clone()).await;
+		assert!(store.is_ok());
+		let fetched = repo.query_get_stored_user(user.email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap().email, user.email);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_user() {
+		let state = create_mock_app_state().await;
+		let auth_repo = AuthRepository::new(&state);
+		let email = "delete_me@example.com".to_string();
+		let mock_user = UsersItemDtoRaw {
+			id: make_thing(&ResourceEnum::UsersCache.to_string(), &email),
+			fullname: "Test User".into(),
+			email: email.clone(),
+			avatar: None,
+			phone_number: "08123456789".into(),
+			is_active: true,
+			gender: None,
+			birthdate: None,
+			role: RolesItemDtoRaw {
+				id: make_thing("app_roles", &Uuid::new_v4().to_string()),
+				name: "Dummy Role".into(),
+				permissions: vec![],
+				is_deleted: false,
+				created_at: Some(get_iso_date()),
+				updated_at: Some(get_iso_date()),
+			},
+			is_deleted: false,
+			password: "".into(),
+			created_at: get_iso_date(),
+			updated_at: get_iso_date(),
+		};
+		let _: Option<UsersItemDtoRaw> = state
+			.surrealdb_mem
+			.create((ResourceEnum::UsersCache.to_string(), email.clone()))
+			.content(mock_user)
+			.await
+			.unwrap();
+		let result = auth_repo.query_delete_stored_user(email.clone()).await;
+		assert!(
+			result.is_ok(),
+			"Delete operation failed: {:?}",
+			result.err()
+		);
+		assert_eq!(result.unwrap(), "Success delete stored user");
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_user@example.com".to_string();
+		let otp = 123456;
+		let stored = repo.query_store_otp(email.clone(), otp).await;
+		assert!(stored.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap(), otp);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_del@example.com".to_string();
+		let otp = 654321;
+		repo.query_store_otp(email.clone(), otp).await.unwrap();
+		let deleted = repo.query_delete_stored_otp(email.clone()).await;
+		assert!(deleted.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_expired_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com".to_string();
+		let otp = 789012;
+		let table = ResourceEnum::OtpCache.to_string();
+		let expires_at = Utc::now() - Duration::seconds(1);
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((table.clone(), email.as_str()))
+			.content(AuthOtpSchema { otp, expires_at })
+			.await
+			.unwrap();
+		let result = repo.query_get_stored_otp(email.clone()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_non_existent_stored_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_get_stored_user("not_found@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_delete_non_existent_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_delete_stored_user("ghost@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_expired_otp_should_fail() {
+		use chrono::Duration;
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com";
+		let expired_time = chrono::Utc::now() - Duration::seconds(10);
+		let otp = 123456;
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((ResourceEnum::OtpCache.to_string(), email))
+			.content(AuthOtpSchema {
+				otp,
+				expires_at: expired_time,
+			})
+			.await
+			.unwrap();
+
+		let result = repo.query_get_stored_otp(email.into()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_valid_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "valid_otp@example.com";
+		let otp = 654321;
+		let store_result = repo.query_store_otp(email.into(), otp).await;
+		assert!(store_result.is_ok());
+		let get_result = repo.query_get_stored_otp(email.into()).await;
+		assert_eq!(get_result.unwrap(), otp);
+	}
+}

tests/src/iam_service/auth/mod.rs

@@ -0,0 +1,4 @@
+#[cfg(test)]
+pub mod auth_controller_test;
+#[cfg(test)]
+pub mod auth_repository_test;

tests/src/iam_service/mod.rs

@@ -0,0 +1,4 @@
+pub mod auth;
+pub mod permissions;
+pub mod roles;
+pub mod users;

tests/src/iam_service/permissions/mod.rs

@@ -0,0 +1,4 @@
+#[cfg(test)]
+pub mod permissions_controller_test;
+#[cfg(test)]
+pub mod permissions_repository_test;

tests/src/iam_service/permissions/permissions_controller_test.rs

@@ -0,0 +1,171 @@
+use crate::{
+	create_mock_app_state, permissions_router,
+	v1::{
+		permissions_dto::PermissionsRequestDto,
+		permissions_repository::PermissionsRepository,
+	},
+	AppState,
+};
+use axum::{http::StatusCode, Extension, Router};
+use axum_test::TestServer;
+
+pub fn create_test_app(state: AppState) -> TestServer {
+	let app = Router::new()
+		.nest("/v1/permissions", permissions_router())
+		.layer(Extension(state));
+	TestServer::new(app).unwrap()
+}
+
+async fn create_dummy_permission(
+	repo: &PermissionsRepository<'_>,
+	name: &str,
+) -> String {
+	let dto = crate::v1::permissions_schema::PermissionsSchema {
+		name: name.into(),
+		..Default::default()
+	};
+	let _ = repo.query_create_permission(dto.clone()).await.unwrap();
+	let found = repo.query_permission_by_name(name.into()).await.unwrap();
+	found.id.id.to_raw()
+}
+
+async fn delete_dummy_permission(repo: &PermissionsRepository<'_>, id: String) {
+	let _ = repo.query_delete_permission(id).await;
+}
+
+#[tokio::test]
+async fn test_create_permission_should_return_201() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let server = create_test_app(state.clone());
+	let payload = PermissionsRequestDto {
+		name: "Create Permission".into(),
+	};
+	let res = server.post("/v1/permissions/create").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+	let id = repo
+		.query_permission_by_name(payload.name.clone())
+		.await
+		.unwrap()
+		.id
+		.id
+		.to_raw();
+	delete_dummy_permission(&repo, id).await;
+}
+
+#[tokio::test]
+async fn test_get_permission_list_should_return_200() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.get("/v1/permissions?page=1&per_page=10").await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_get_permission_by_id_should_return_200() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let id = create_dummy_permission(&repo, "Get Permission").await;
+	let server = create_test_app(state.clone());
+	let res = server.get(&format!("/v1/permissions/detail/{}", id)).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+	delete_dummy_permission(&repo, id).await;
+}
+
+#[tokio::test]
+async fn test_update_permission_should_return_200() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let id = create_dummy_permission(&repo, "To Update").await;
+	let server = create_test_app(state.clone());
+	let payload = PermissionsRequestDto {
+		name: "Updated Permission".into(),
+	};
+	let res = server
+		.put(&format!("/v1/permissions/update/{}", id.clone()))
+		.json(&payload)
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+	delete_dummy_permission(&repo, id).await;
+}
+
+#[tokio::test]
+async fn test_delete_permission_should_return_200() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let id = create_dummy_permission(&repo, "To Delete").await;
+	let server = create_test_app(state);
+	let res = server
+		.delete(&format!("/v1/permissions/delete/{}", id))
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_create_duplicate_permission_should_return_409() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let name = "Duplicate Permission";
+	let id = create_dummy_permission(&repo, name).await;
+	let server = create_test_app(state.clone());
+	let payload = PermissionsRequestDto { name: name.into() };
+	let res = server.post("/v1/permissions/create").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::CONFLICT);
+	delete_dummy_permission(&repo, id).await;
+}
+
+#[tokio::test]
+async fn test_delete_nonexistent_permission_should_return_404() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.delete("/v1/permissions/delete/nonexistent-id").await;
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn test_create_permission_with_empty_name_should_return_400() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let payload = PermissionsRequestDto { name: "".into() };
+	let res = server.post("/v1/permissions/create").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_update_nonexistent_permission_should_return_404() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let payload = PermissionsRequestDto {
+		name: "Nonexistent".into(),
+	};
+	let res = server
+		.put("/v1/permissions/update/non-exist")
+		.json(&payload)
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn test_get_permission_by_invalid_id_should_return_404() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.get("/v1/permissions/detail/invalid-id").await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn test_get_permission_list_with_invalid_pagination_should_return_400() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.get("/v1/permissions?page=abc&per_page=xyz").await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}

tests/src/iam_service/permissions/permissions_repository_test.rs

@@ -0,0 +1,111 @@
+use crate::{
+	create_mock_app_state,
+	permissions::{PermissionsRepository, PermissionsSchema},
+};
+use chrono::Utc;
+
+fn create_dummy_permission(name: &str) -> PermissionsSchema {
+	PermissionsSchema {
+		name: name.to_string(),
+		..Default::default()
+	}
+}
+
+#[tokio::test]
+async fn test_create_permission_should_succeed() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let permission = create_dummy_permission("Test Permission");
+	let result = repo.query_create_permission(permission).await;
+	assert!(result.is_ok(), "Create failed: {:?}", result.err());
+}
+
+#[tokio::test]
+async fn test_query_permission_list_should_return_data() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+
+	let _ = repo
+		.query_create_permission(create_dummy_permission("View"))
+		.await;
+	let meta = crate::MetaRequestDto {
+		page: Some(1),
+		per_page: Some(10),
+		search: None,
+		sort_by: None,
+		order: None,
+		filter: None,
+		filter_by: None,
+	};
+
+	let result = repo.query_permission_list(meta).await;
+	assert!(result.is_ok(), "List failed: {:?}", result.err());
+	assert!(!result.unwrap().data.is_empty(), "Data should not be empty");
+}
+
+#[tokio::test]
+async fn test_query_permission_by_id_should_succeed() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let permission = create_dummy_permission("Detail");
+	let _ = repo.query_create_permission(permission.clone()).await;
+	let id = permission.id.id.to_raw();
+	let result = repo.query_permission_by_id(id).await;
+	assert!(result.is_ok(), "Get by id failed: {:?}", result.err());
+}
+
+#[tokio::test]
+async fn test_update_permission_should_succeed() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let mut permission = create_dummy_permission("Update This");
+	let _ = repo.query_create_permission(permission.clone()).await;
+	permission.name = "Updated Name".into();
+	permission.updated_at = Some(Utc::now().to_rfc3339());
+	let result = repo.query_update_permission(permission).await;
+	assert!(result.is_ok(), "Update failed: {:?}", result.err());
+}
+
+#[tokio::test]
+async fn test_delete_permission_should_succeed() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let permission = create_dummy_permission("To Be Deleted");
+	let _ = repo.query_create_permission(permission.clone()).await;
+	let id = permission.id.id.to_raw();
+	let result = repo.query_delete_permission(id).await;
+	assert!(result.is_ok(), "Delete failed: {:?}", result.err());
+}
+
+#[tokio::test]
+async fn test_delete_permission_should_fail_if_already_deleted() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let permission = create_dummy_permission("Delete Twice");
+	let _ = repo.query_create_permission(permission.clone()).await;
+	let id = permission.id.id.to_raw();
+	let _ = repo.query_delete_permission(id.clone()).await;
+	let second = repo.query_delete_permission(id).await;
+	assert!(second.is_err(), "Should fail on second delete");
+}
+
+#[tokio::test]
+async fn test_update_permission_should_fail_if_deleted() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let mut permission = create_dummy_permission("To Be Updated Then Deleted");
+	let _ = repo.query_create_permission(permission.clone()).await;
+	let id = permission.id.id.to_raw();
+	let _ = repo.query_delete_permission(id.clone()).await;
+	permission.name = "Try Update".into();
+	let result = repo.query_update_permission(permission).await;
+	assert!(result.is_err(), "Update on deleted should fail");
+}
+
+#[tokio::test]
+async fn test_query_permission_by_id_should_fail_if_not_found() {
+	let state = create_mock_app_state().await;
+	let repo = PermissionsRepository::new(&state);
+	let result = repo.query_permission_by_id("non-existent-id".into()).await;
+	assert!(result.is_err(), "Expected error for not found id");
+}

tests/src/iam_service/roles/mod.rs

@@ -0,0 +1,4 @@
+#[cfg(test)]
+pub mod roles_controller_test;
+#[cfg(test)]
+pub mod roles_repository_test;

tests/src/iam_service/roles/roles_controller_test.rs

@@ -0,0 +1,172 @@
+use crate::AppState;
+use crate::{
+	create_mock_app_state, roles_router, v1::roles_repository::RolesRepository,
+	RolesRequestCreateDto, RolesRequestUpdateDto,
+};
+use axum::http::StatusCode;
+use axum::Extension;
+use axum::Router;
+use axum_test::TestServer;
+
+pub fn create_test_app(state: AppState) -> TestServer {
+	let app = Router::new()
+		.nest("/v1/roles", roles_router())
+		.layer(Extension(state));
+
+	TestServer::new(app).unwrap()
+}
+
+async fn delete_dummy_role(state: AppState, id: String) {
+	let repo = RolesRepository::new(&state);
+	let _ = repo.query_delete_role(id).await;
+}
+
+#[tokio::test]
+async fn test_get_role_list_should_return_200() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/roles", roles_router())
+		.layer(axum::Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/roles?page=1&per_page=10").await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_post_create_role_should_return_201() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/roles", roles_router())
+		.layer(axum::Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = RolesRequestCreateDto {
+		name: "Test Role #1".into(),
+		permissions: vec![],
+	};
+	let res = server.post("/v1/roles/create").json(&payload).await;
+	let repo = RolesRepository::new(&state);
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+	let id = repo
+		.query_role_by_name(payload.name.clone())
+		.await
+		.unwrap()
+		.id;
+	delete_dummy_role(state, id).await;
+}
+
+#[tokio::test]
+async fn test_put_update_role_should_return_200() {
+	let state = create_mock_app_state().await;
+	let repo = RolesRepository::new(&state);
+	let _ = repo
+		.query_create_role(RolesRequestCreateDto {
+			name: "Role To Update".into(),
+			permissions: vec![],
+		})
+		.await
+		.unwrap();
+	let existing = repo
+		.query_role_by_name("Role To Update".into())
+		.await
+		.unwrap();
+	let id = existing.id.clone();
+	let server = create_test_app(state.clone());
+	let payload = RolesRequestUpdateDto {
+		name: Some("Updated Role".into()),
+		permissions: Some(vec![]),
+	};
+	let res = server
+		.put(&format!("/v1/roles/update/{}", id))
+		.json(&payload)
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let id = repo
+		.query_role_by_name(payload.name.clone().unwrap())
+		.await
+		.unwrap()
+		.id;
+	delete_dummy_role(state.clone(), id).await;
+}
+
+#[tokio::test]
+async fn test_delete_role_should_return_200() {
+	let state = create_mock_app_state().await;
+	let repo = RolesRepository::new(&state);
+	let _ = repo
+		.query_create_role(RolesRequestCreateDto {
+			name: "Role To Delete".into(),
+			permissions: vec![],
+		})
+		.await
+		.unwrap();
+	let existing = repo
+		.query_role_by_name("Role To Delete".into())
+		.await
+		.unwrap();
+	let id = existing.id;
+	let server = create_test_app(state);
+	let res = server.delete(&format!("/v1/roles/delete/{}", id)).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_post_create_role_with_empty_name_should_return_400() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let payload = RolesRequestCreateDto {
+		name: "".into(),
+		permissions: vec![],
+	};
+	let res = server.post("/v1/roles/create").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_put_update_nonexistent_role_should_return_404() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let payload = RolesRequestUpdateDto {
+		name: Some("Does Not Exist".into()),
+		permissions: Some(vec![]),
+	};
+	let res = server
+		.put("/v1/roles/update/nonexistent-id")
+		.json(&payload)
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn test_delete_nonexistent_role_should_return_404() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.delete("/v1/roles/delete/nonexistent-id").await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn test_get_role_list_with_invalid_page_params_should_return_400() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let res = server.get("/v1/roles?page=abc&per_page=xyz").await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_create_duplicate_role_should_return_409() {
+	let state = create_mock_app_state().await;
+	let server = create_test_app(state);
+	let payload = RolesRequestCreateDto {
+		name: "Admin".into(),
+		permissions: vec![],
+	};
+	let res = server.post("/v1/roles/create").json(&payload).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::CONFLICT);
+}

tests/src/iam_service/roles/roles_repository_test.rs

@@ -0,0 +1,192 @@
+use crate::{
+	ResourceEnum, create_mock_app_state, get_iso_date, make_thing,
+	permissions::{
+		permissions_repository::PermissionsRepository,
+		permissions_schema::PermissionsSchema,
+	},
+	roles::{
+		roles_dto::{RolesRequestCreateDto, RolesRequestUpdateDto},
+		roles_repository::RolesRepository,
+	},
+};
+use surrealdb::Uuid;
+use surrealdb::sql::Thing;
+
+#[tokio::test]
+async fn test_query_create_role_should_succeed() {
+	let state = create_mock_app_state().await;
+	let perm_repo = PermissionsRepository::new(&state);
+	let role_repo = RolesRepository::new(&state);
+	let perm_id = Uuid::new_v4().to_string();
+	let permission = PermissionsSchema {
+		id: Thing::from((ResourceEnum::Permissions.to_string(), perm_id.clone())),
+		name: "Read Quiz".into(),
+		is_deleted: false,
+		created_at: Some(get_iso_date()),
+		updated_at: None,
+	};
+	perm_repo.query_create_permission(permission).await.unwrap();
+	let payload = RolesRequestCreateDto {
+		name: "Student".into(),
+		permissions: vec![perm_id.clone()],
+	};
+	let result = role_repo.query_create_role(payload).await;
+	assert!(result.is_ok());
+}
+
+#[tokio::test]
+async fn test_query_role_by_name_should_return_data() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let payload = RolesRequestCreateDto {
+		name: "Viewer".into(),
+		permissions: vec![],
+	};
+	role_repo.query_create_role(payload.clone()).await.unwrap();
+	let role = role_repo.query_role_by_name("Viewer".into()).await.unwrap();
+	assert_eq!(role.name, "Viewer");
+}
+
+#[tokio::test]
+async fn test_query_role_by_id_should_return_data() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let payload = RolesRequestCreateDto {
+		name: "Tester".into(),
+		permissions: vec![],
+	};
+	role_repo.query_create_role(payload.clone()).await.unwrap();
+	let role = role_repo.query_role_by_name("Tester".into()).await.unwrap();
+	let result = role_repo.query_role_by_id(role.id).await.unwrap();
+	assert_eq!(result.name, "Tester");
+}
+
+#[tokio::test]
+async fn test_query_update_role_should_update_name_and_permissions() {
+	let state = create_mock_app_state().await;
+	let repo = RolesRepository::new(&state);
+	let perm_repo = PermissionsRepository::new(&state);
+	let original_perm_id = Uuid::new_v4().to_string();
+	let original_perm = PermissionsSchema {
+		id: make_thing(&ResourceEnum::Permissions.to_string(), &original_perm_id),
+		name: "Original Permission".into(),
+		is_deleted: false,
+		created_at: Some(crate::get_iso_date()),
+		updated_at: None,
+	};
+	perm_repo
+		.query_create_permission(original_perm)
+		.await
+		.unwrap();
+	let create_payload = RolesRequestCreateDto {
+		name: "Role For Update".into(),
+		permissions: vec![original_perm_id.clone()],
+	};
+	repo.query_create_role(create_payload).await.unwrap();
+	let existing_role = repo
+		.query_role_by_name("Role For Update".into())
+		.await
+		.unwrap();
+	let existing_role_id = existing_role.id.clone();
+	let new_perm_id = Uuid::new_v4().to_string();
+	let new_perm = PermissionsSchema {
+		id: make_thing(&ResourceEnum::Permissions.to_string(), &new_perm_id),
+		name: "New Permission".into(),
+		is_deleted: false,
+		created_at: Some(crate::get_iso_date()),
+		updated_at: None,
+	};
+	perm_repo.query_create_permission(new_perm).await.unwrap();
+	let update_payload = RolesRequestUpdateDto {
+		name: Some("Updated Role Name".into()),
+		permissions: Some(vec![new_perm_id.clone()]),
+	};
+	let update_result = repo
+		.query_update_role(existing_role_id.clone(), update_payload)
+		.await;
+	assert!(update_result.is_ok());
+	let updated = repo
+		.query_role_by_id(existing_role_id.clone())
+		.await
+		.unwrap();
+	assert_eq!(updated.name, "Updated Role Name");
+}
+
+#[tokio::test]
+async fn test_query_delete_role_should_soft_delete() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let payload = RolesRequestCreateDto {
+		name: "Temporary".into(),
+		permissions: vec![],
+	};
+	role_repo.query_create_role(payload.clone()).await.unwrap();
+	let role = role_repo
+		.query_role_by_name("Temporary".into())
+		.await
+		.unwrap();
+	let result = role_repo.query_delete_role(role.id.clone()).await;
+	assert!(result.is_ok());
+	let deleted = role_repo.query_role_by_id(role.id).await;
+	assert!(deleted.is_err());
+}
+#[tokio::test]
+async fn test_query_update_role_should_fallback_to_existing_permissions_if_none_provided()
+ {
+	let state = create_mock_app_state().await;
+	let repo = RolesRepository::new(&state);
+	let perm_repo = PermissionsRepository::new(&state);
+	let perm_id = Uuid::new_v4().to_string();
+	let permission = PermissionsSchema {
+		id: make_thing(&ResourceEnum::Permissions.to_string(), &perm_id),
+		name: "Permission for Fallback".into(),
+		is_deleted: false,
+		created_at: Some(crate::get_iso_date()),
+		updated_at: None,
+	};
+	perm_repo.query_create_permission(permission).await.unwrap();
+	let create_payload = RolesRequestCreateDto {
+		name: "Role With Permission".into(),
+		permissions: vec![perm_id.clone()],
+	};
+	repo.query_create_role(create_payload).await.unwrap();
+	let existing = repo
+		.query_role_by_name("Role With Permission".into())
+		.await
+		.unwrap();
+	let existing_id = existing.id.clone();
+	let update_payload = RolesRequestUpdateDto {
+		name: Some("Updated Role Name".into()),
+		permissions: None,
+	};
+	let update_res = repo
+		.query_update_role(existing_id.clone(), update_payload)
+		.await;
+	assert!(update_res.is_ok());
+}
+
+#[tokio::test]
+async fn test_query_role_by_name_should_fail_if_not_found() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let result = role_repo.query_role_by_name("ghost-role".into()).await;
+	assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_query_delete_role_should_fail_if_already_deleted() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let payload = RolesRequestCreateDto {
+		name: "SoftDeleteTest".into(),
+		permissions: vec![],
+	};
+	role_repo.query_create_role(payload.clone()).await.unwrap();
+	let role = role_repo
+		.query_role_by_name("SoftDeleteTest".into())
+		.await
+		.unwrap();
+	role_repo.query_delete_role(role.id.clone()).await.unwrap();
+	let result = role_repo.query_delete_role(role.id);
+	assert!(result.await.is_err());
+}

tests/src/iam_service/users/mod.rs

@@ -0,0 +1,4 @@
+#[cfg(test)]
+pub mod users_controller_test;
+#[cfg(test)]
+pub mod users_repository_test;

tests/src/iam_service/users/users_controller_test.rs

@@ -0,0 +1,602 @@
+use crate::{
+	RolesEnum, RolesRepository, UsersActiveInactiveRequestDto, UsersCreateRequestDto,
+	UsersRepository, UsersUpdateRequestDto, users_router,
+};
+use axum::{Extension, http::StatusCode};
+use axum_test::TestServer;
+use imphnen_utils::create_mock_app_state;
+use surrealdb::Uuid;
+
+#[tokio::test]
+async fn test_get_user_list_should_return_200() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users?page=1&per_page=10").await;
+	let status = res.status_code();
+	assert_eq!(status, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_list_users_should_fail_with_invalid_per_page() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users?page=1&per_page=0").await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_list_users_should_fail_with_invalid_page() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users?page=0&per_page=10").await;
+	dbg!(res.text());
+	dbg!(res.status_code());
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_list_users_should_ignore_invalid_sort_field() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&sort_by=invalid_field")
+		.await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_list_users_with_search_no_match_should_return_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&search=nonexistinguserxyz")
+		.await;
+	let body: serde_json::Value = res.json();
+	assert_eq!(res.status_code(), StatusCode::OK);
+	assert_eq!(body["data"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn test_list_users_should_return_empty_on_invalid_filter() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&filter_by=is_active&filter=maybe")
+		.await;
+	let body: serde_json::Value = res.json();
+	assert_eq!(res.status_code(), StatusCode::OK);
+	assert_eq!(body["data"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn test_get_user_list_with_search_should_return_200() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&search=maulana")
+		.await;
+	let status = res.status_code();
+	dbg!(res.text());
+	assert_eq!(status, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_create_user_should_return_201() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "Create Data #1".into(),
+		email: format!("test-{}@create.com", Uuid::new_v4()).into(),
+		role_id,
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	let res = server.post("/v1/users/create").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+}
+
+#[tokio::test]
+async fn test_get_user_detail_should_return_200() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id;
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "Detail User".into(),
+		email: "detail@test.com".into(),
+		role_id,
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	server.post("/v1/users/create").json(&payload).await;
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	let user_id = user.id.id.to_raw();
+	let res = server.get(&format!("/v1/users/detail/{}", user_id)).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_delete_user_should_return_200() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.expect("Failed to get role");
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "Test Delete Me".into(),
+		email: "test@delete-me.com".into(),
+		password: "Password1!".into(),
+		role_id: role.id.clone(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	let create_res = server.post("/v1/users/create").json(&payload).await;
+	assert_eq!(create_res.status_code(), StatusCode::CREATED);
+	let detail_res = repo.query_user_by_email(payload.email.clone()).await;
+	assert!(detail_res.is_ok(), "User not found after creation");
+	let user = detail_res.unwrap();
+	let user_id_for_delete = user.id.id.to_raw();
+	let delete_res = server
+		.delete(&format!("/v1/users/delete/{}", user_id_for_delete))
+		.await;
+	assert_eq!(delete_res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_activate_user_should_return_200() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id;
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "Inactive User".into(),
+		email: format!("inactive-{}@test.com", Uuid::new_v4()).into(),
+		password: "Password1!".into(),
+		role_id,
+		phone_number: "081234567890".into(),
+		is_active: false,
+	};
+	let res_create = server.post("/v1/users/create").json(&payload).await;
+	dbg!(res_create.text());
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	dbg!(user.fullname);
+	let user_id = user.id.id.to_raw();
+	let res = server
+		.put(&format!("/v1/users/activate/{}", user_id))
+		.json(&UsersActiveInactiveRequestDto { is_active: true })
+		.await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_update_user_should_return_200() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let unique_email = format!("update_{}@test.com", Uuid::new_v4());
+	let payload = UsersCreateRequestDto {
+		fullname: "Old Name".into(),
+		email: unique_email.clone(),
+		password: "Password1!".into(),
+		role_id: role_id.clone(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	let create_res = server.post("/v1/users/create").json(&payload).await;
+	assert_eq!(create_res.status_code(), StatusCode::CREATED);
+	let user = repo.query_user_by_email(unique_email).await.unwrap();
+	let user_id = user.id.id.to_raw();
+	let update_payload = UsersUpdateRequestDto {
+		fullname: "Updated Name".into(),
+		email: payload.email.clone(),
+		phone_number: "081234567890".into(),
+		role_id: user.role.id.id.to_raw(),
+		is_active: true,
+		gender: Some("Laki-laki".into()),
+		birthdate: Some("2000-01-01".into()),
+		avatar: None,
+	};
+	let res = server
+		.put(&format!("/v1/users/update/{}", user_id))
+		.json(&update_payload)
+		.await;
+	let status = res.status_code();
+	let body = res.text();
+	assert_eq!(status, StatusCode::OK, "Response body: {}", body);
+}
+
+#[tokio::test]
+async fn test_create_user_should_fail_if_email_taken() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let email = format!("test_{}@example.com", Uuid::new_v4());
+	let payload = UsersCreateRequestDto {
+		fullname: "User Satu".into(),
+		email: email.clone(),
+		password: "Password1!".into(),
+		role_id,
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	let res1 = server.post("/v1/users/create").json(&payload).await;
+	assert_eq!(res1.status_code(), StatusCode::CREATED);
+	let res2 = server.post("/v1/users/create").json(&payload).await;
+	let body2 = res2.text();
+	assert_eq!(res2.status_code(), StatusCode::BAD_REQUEST);
+	assert!(body2.contains("User already exists"));
+}
+
+#[tokio::test]
+async fn test_get_user_detail_should_fail_if_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users/detail/non-existent-id").await;
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}
+
+#[tokio::test]
+async fn test_delete_user_should_fail_if_already_deleted() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "To Be Deleted".into(),
+		email: "delete-me@example.com".into(),
+		role_id,
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	server.post("/v1/users/create").json(&payload).await;
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	let id = user.id.id.to_raw();
+	let res1 = server.delete(&format!("/v1/users/delete/{}", id)).await;
+	assert_eq!(res1.status_code(), StatusCode::OK);
+	let res2 = server.delete(&format!("/v1/users/delete/{}", id)).await;
+	assert_eq!(res2.status_code(), StatusCode::BAD_REQUEST);
+	let body = res2.text();
+	assert!(body.contains("User already deleted"));
+}
+
+#[tokio::test]
+async fn test_update_user_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let update_payload = UsersUpdateRequestDto {
+		fullname: "Does Not Exist".into(),
+		email: "nonexistent@test.com".into(),
+		phone_number: "081234567890".into(),
+		role_id,
+		is_active: true,
+		gender: Some("Laki-laki".into()),
+		birthdate: Some("2000-01-01".into()),
+		avatar: None,
+	};
+	let res = server
+		.put("/v1/users/update/non-existent-id")
+		.json(&update_payload)
+		.await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}
+
+#[tokio::test]
+async fn test_activate_user_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersActiveInactiveRequestDto { is_active: true };
+	let res = server
+		.put("/v1/users/activate/non-existent-id")
+		.json(&payload)
+		.await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}
+
+#[tokio::test]
+async fn test_create_user_should_fail_if_payload_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let invalid_payload = serde_json::json!({});
+	let res = server.post("/v1/users/create").json(&invalid_payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_list_users_should_fail_with_invalid_pagination() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users?page=0&per_page=0").await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Invalid pagination") || body.contains("per_page"),
+		"Expected pagination error, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_list_users_should_fallback_on_invalid_order() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&sort_by=email&order=invalid")
+		.await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn test_list_users_with_invalid_filter_by_should_return_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server
+		.get("/v1/users?page=1&per_page=10&filter_by=unknown_field&filter=value")
+		.await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body: serde_json::Value = res.json();
+	assert_eq!(body["data"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn test_user_detail_should_fail_with_invalid_id_format() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users/detail/!@#invalid-id").await;
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+	let body = res.text();
+	assert!(body.contains("User not found") || body.contains("not found"));
+}
+
+#[tokio::test]
+async fn test_user_detail_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let res = server.get("/v1/users/detail/random-id-123456").await;
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}
+
+#[tokio::test]
+async fn test_user_detail_should_fail_if_user_is_soft_deleted() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		role_id,
+		fullname: "Soft Deleted".into(),
+		email: "softdeleted@test.com".into(),
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	server.post("/v1/users/create").json(&payload).await;
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	let user_id = user.id.id.to_raw();
+	let _ = repo.query_delete_user(user_id.clone()).await.unwrap();
+	let res = server.get(&format!("/v1/users/detail/{}", user_id)).await;
+	dbg!(res.text());
+	assert_eq!(res.status_code(), StatusCode::NOT_FOUND);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}
+
+#[tokio::test]
+async fn test_update_user_should_fail_if_user_is_deleted() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		role_id: role_id.clone(),
+		fullname: "To Be Deleted".into(),
+		email: "deleteduser@test.com".into(),
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	server.post("/v1/users/create").json(&payload).await;
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	let user_id = user.id.id.to_raw();
+	let _ = repo.query_delete_user(user_id.clone()).await.unwrap();
+	let update_payload = UsersUpdateRequestDto {
+		role_id: role_id.clone(),
+		fullname: "Should Fail".into(),
+		email: "deleteduser@test.com".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+		gender: Some("Laki-laki".into()),
+		birthdate: Some("2000-01-01".into()),
+		avatar: None,
+	};
+	let res = server
+		.put(&format!("/v1/users/update/{}", user_id))
+		.json(&update_payload)
+		.await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User already deleted"));
+}
+
+#[tokio::test]
+async fn test_update_user_should_fail_if_payload_invalid() {
+	let state = create_mock_app_state().await;
+	let role_repo = RolesRepository::new(&state);
+	let role = role_repo
+		.query_role_by_name(RolesEnum::User.to_string())
+		.await
+		.unwrap();
+	let role_id = role.id.clone();
+	let repo = UsersRepository::new(&state);
+	let app = axum::Router::new()
+		.nest("/v1/users", users_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = UsersCreateRequestDto {
+		fullname: "Invalid Payload".into(),
+		email: "invalid@test.com".into(),
+		role_id: role_id.clone(),
+		password: "Password1!".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+	};
+	server.post("/v1/users/create").json(&payload).await;
+	let user = repo.query_user_by_email(payload.email).await.unwrap();
+	let user_id = user.id.id.to_raw();
+	let update_payload = UsersUpdateRequestDto {
+		fullname: "".into(),
+		email: "invalid@test.com".into(),
+		phone_number: "081234567890".into(),
+		is_active: true,
+		role_id: role_id.clone(),
+		gender: Some("Laki-laki".into()),
+		birthdate: Some("2000-01-01".into()),
+		avatar: None,
+	};
+	let res = server
+		.put(&format!("/v1/users/update/{}", user_id))
+		.json(&update_payload)
+		.await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Fullname") || body.contains("at least have 2 character"),
+		"Gagal validasi fullname: {body}"
+	);
+}

tests/src/iam_service/users/users_repository_test.rs

@@ -0,0 +1,234 @@
+use crate::{create_mock_app_state, create_test_user, RolesRepository};
+use crate::{
+	MetaRequestDto, UsersActiveInactiveSchema, UsersRepository,
+	UsersSetNewPasswordSchema,
+};
+
+async fn get_role_id(state: &crate::AppState) -> String {
+	RolesRepository::new(state)
+		.query_role_by_name("Student".into())
+		.await
+		.expect("Role not found")
+		.id
+}
+
+#[tokio::test]
+async fn test_create_and_get_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let user = create_test_user(
+		"testuser@example.com",
+		"Test User",
+		true,
+		&get_role_id(&app_state).await,
+	);
+	let create_result = repo.query_create_user(user.clone()).await;
+	assert!(create_result.is_ok());
+	let fetched = repo
+		.query_user_by_email("testuser@example.com".into())
+		.await;
+	assert!(fetched.is_ok());
+	assert_eq!(fetched.unwrap().email, "testuser@example.com");
+}
+
+#[tokio::test]
+async fn test_update_password_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let role_repo = RolesRepository::new(&app_state);
+	let role_id = role_repo
+		.query_role_by_name("Student".into())
+		.await
+		.expect("Role not found")
+		.id;
+	let email = "changepass@example.com";
+	let user = create_test_user(email, "Change Password", true, &role_id);
+	repo.query_create_user(user).await.unwrap();
+	let result = repo
+		.query_update_password_user(
+			email.to_string(),
+			UsersSetNewPasswordSchema {
+				password: "newpass".into(),
+			},
+		)
+		.await;
+	assert!(
+		result.is_ok(),
+		"Update password failed with error: {:?}",
+		result.err()
+	);
+	dbg!(result.unwrap());
+}
+
+#[tokio::test]
+async fn test_query_user_list_with_pagination_and_filter() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	for i in 0..10 {
+		let email = format!("user{}@example.com", i);
+		let fullname = format!("User {}", i);
+		let is_active = i % 2 == 0;
+		let user =
+			create_test_user(&email, &fullname, is_active, &get_role_id(&app_state).await);
+		repo.query_create_user(user).await.unwrap();
+	}
+	let meta = MetaRequestDto {
+		page: Some(1),
+		per_page: Some(5),
+		search: None,
+		sort_by: Some("email".into()),
+		order: Some("ASC".into()),
+		filter: Some("true".into()),
+		filter_by: Some("is_active".into()),
+	};
+	let result = repo.query_user_list(meta).await.unwrap();
+	assert!(result.data.len() <= 5);
+	assert!(result.data.iter().all(|u| u.is_active));
+	assert!(result.meta.as_ref().unwrap().total.is_some());
+}
+
+#[tokio::test]
+async fn test_query_user_list_basic() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	for i in 0..10 {
+		let email = format!("basic{}@example.com", i);
+		let user = create_test_user(
+			&email,
+			&format!("Basic User {}", i),
+			true,
+			&get_role_id(&app_state).await,
+		);
+		repo.query_create_user(user).await.unwrap();
+	}
+	let meta = MetaRequestDto {
+		page: Some(1),
+		per_page: Some(5),
+		search: None,
+		sort_by: None,
+		order: None,
+		filter: None,
+		filter_by: None,
+	};
+	let result = repo.query_user_list(meta).await.unwrap();
+	assert!(result.meta.as_ref().unwrap().total.unwrap() >= 1);
+	assert_eq!(result.meta.as_ref().unwrap().page.unwrap(), 1);
+	assert_eq!(result.meta.as_ref().unwrap().per_page.unwrap(), 5);
+}
+
+#[tokio::test]
+async fn test_query_active_inactive_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "inactive@example.com";
+	let user = create_test_user(
+		email,
+		"Inactive User",
+		false,
+		&get_role_id(&app_state).await,
+	);
+	repo.query_create_user(user).await.unwrap();
+	let result = repo
+		.query_active_inactive_user(
+			email.into(),
+			UsersActiveInactiveSchema { is_active: true },
+		)
+		.await;
+	assert!(result.is_ok());
+	let updated = repo
+		.query_user_by_email("inactive@example.com".into())
+		.await
+		.unwrap();
+	assert_eq!(updated.is_active, true);
+}
+
+#[tokio::test]
+async fn test_query_user_by_invalid_email_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo
+		.query_user_by_email("nonexistent@example.com".into())
+		.await;
+	assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_query_update_password_for_nonexistent_user_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo
+		.query_update_password_user(
+			"ghost@example.com".into(),
+			UsersSetNewPasswordSchema {
+				password: "secret".into(),
+			},
+		)
+		.await;
+	assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_query_delete_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "deleteuser@example.com";
+	let user =
+		create_test_user(email, "Delete User", true, &get_role_id(&app_state).await);
+	repo.query_create_user(user.clone()).await.unwrap();
+	let user_detail = repo
+		.query_user_by_email(email.to_string().clone())
+		.await
+		.unwrap();
+	let delete_result = repo
+		.query_delete_user(user_detail.id.id.to_raw().clone())
+		.await;
+	assert!(delete_result.is_ok());
+	let fetch_result = repo
+		.query_user_by_email(user_detail.id.id.to_raw().clone())
+		.await;
+	assert!(fetch_result.is_err());
+}
+
+#[tokio::test]
+async fn test_delete_non_existent_user_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo.query_delete_user("lklklklk".to_string()).await;
+	assert!(result.is_err());
+	assert_eq!(result.unwrap_err().to_string(), "User not found");
+}
+
+#[tokio::test]
+async fn test_delete_user_twice_should_fail_on_second_attempt() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "twice@example.com";
+	let user =
+		create_test_user(email, "Delete Twice", true, &get_role_id(&app_state).await);
+	repo.query_create_user(user.clone()).await.unwrap();
+	let first = repo.query_delete_user(user.id.id.to_raw()).await;
+	assert!(first.is_ok());
+	let second = repo.query_delete_user(user.id.id.to_raw()).await;
+	assert!(second.is_err());
+	assert_eq!(second.unwrap_err().to_string(), "User already deleted");
+}
+
+#[tokio::test]
+async fn test_query_update_user_should_succeed() {
+	let state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&state);
+	let mut user = create_test_user(
+		"update@example.com",
+		"Old Name",
+		true,
+		&get_role_id(&state).await,
+	);
+	repo.query_create_user(user.clone()).await.unwrap();
+	user.fullname = "Updated Name".into();
+	user.phone_number = "089876543210".into();
+	let result = repo.query_update_user(user.clone()).await;
+	assert!(result.is_ok(), "Update failed: {:?}", result.err());
+	let updated = repo.query_user_by_id(user.id.id.to_raw()).await.unwrap();
+	assert_eq!(updated.fullname, "Updated Name");
+	assert_eq!(updated.phone_number, "089876543210");
+}

tests/src/lib.rs

@@ -0,0 +1,6 @@
+pub use imphnen_entities::*;
+pub use imphnen_iam_service::*;
+pub use imphnen_utils::*;
+
+#[cfg(test)]
+pub mod iam_service;