chore: implement unit test

src/apps/v1/auth/auth_controller_test.rs

@@ -0,0 +1,601 @@
+use crate::{
+	apps::v1::auth::auth_router, create_mock_app_state, create_test_user,
+	encode_refresh_token, AuthOtpSchema, OtpManager, ResourceEnum,
+};
+use axum::{http::StatusCode, Extension};
+use axum_test::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn test_login_should_fail_with_invalid_user() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "nonexistent@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	println!("🧪 Response Body: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_with_wrong_password() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("user@example.com", "User Satu", true);
+	user.password = crate::hash_password("correctpassword").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "user@example.com",
+		"password": "wrongpassword"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Wrong password: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_user_not_active() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("inactive@example.com", "Inactive User", false);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "inactive@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	println!("🧪 Not active user: {}", body);
+}
+
+#[tokio::test]
+async fn test_login_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("active@example.com", "Active User", true);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"email": "active@example.com",
+		"password": "secret"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert!(json["data"]["token"]["access_token"].is_string());
+	assert!(json["data"]["user"]["email"] == "active@example.com");
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test@test.com",
+			"password": ""
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_login_should_fail_if_email_not_valid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "test",
+			"password": "test123"
+	});
+	let res = server.post("/v1/auth/login").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+			"email": "validuser@example.com",
+			"password": "Validpass1!",
+			"fullname": "Valid User",
+			"student_type": "regular",
+			"phone_number": "0812345678",
+						"reffered_by": "Facebook",
+						"refferal_code": "KFNB"
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::CREATED);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_already_taken() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user("duplicate@example.com", "User Exists", false);
+	user.password = crate::hash_password("secret").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let payload = json!({
+		"fullname": "User Exists",
+		"email": "duplicate@example.com",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"fullname": "Invalid Email",
+		"email": "invalid-email",
+		"password": "secret",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_password_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({
+		"fullname": "No Password",
+		"email": "nopass@example.com",
+		"password": "",
+		"student_type": "general",
+		"phone_number": "081234567890",
+		"referral_code": null,
+		"referred_by": null
+	});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn test_register_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/register").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"email": "user@example.com"
+	});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "OTP resent successfully");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_email_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email cannot be empty, Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_with_invalid_email_format() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+
+	let payload = json!({ "email": "not-an-email" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let json = res.json::<serde_json::Value>();
+	assert_eq!(json["message"], "Email not valid");
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_payload_empty() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_send_otp_should_fail_if_otp_store_fails() {
+	let mut state = create_mock_app_state().await;
+	state.surrealdb_mem = surrealdb::Surreal::new::<surrealdb::engine::local::Mem>(())
+		.await
+		.expect("failed to create mock surrealdb_mem");
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = serde_json::json!({ "email": "fail-store@example.com" });
+	let res = server.post("/v1/auth/send-otp").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Specify a namespace to use") || body.contains("Failed store otp"),
+		"Expected namespace setup error or store failure, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state.clone()));
+	let server = TestServer::new(app).unwrap();
+	let mut user = create_test_user("forgot@example.com", "Forgot User", true);
+	user.password = crate::hash_password("secret").unwrap();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	user_repo.query_create_user(user).await.unwrap();
+	let payload = json!({ "email": "forgot@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(
+		body.contains("Reset Password request send"),
+		"Unexpected response: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "notfound@example.com" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("User not found"),
+		"Expected 'User not found', got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_forgot_password_should_fail_if_email_invalid() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({ "email": "" });
+	let res = server.post("/v1/auth/forgot").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Email not valid") || body.contains("User not found"),
+		"Expected email error, got: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_refresh_should_succeed() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let valid_token = encode_refresh_token("refreshme@example.com".into()).unwrap();
+	let payload = json!({
+		"refresh_token": valid_token
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.json::<serde_json::Value>();
+	assert!(body["data"]["access_token"].is_string());
+	assert!(body["data"]["refresh_token"].is_string());
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_invalid_token() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({
+		"refresh_token": "invalid.token.value"
+	});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNAUTHORIZED);
+	let body = res.text();
+	assert!(body.contains("Invalid refresh token"));
+}
+
+#[tokio::test]
+async fn test_refresh_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let app = axum::Router::new()
+		.nest("/v1/auth", auth_router())
+		.layer(Extension(state));
+	let server = TestServer::new(app).unwrap();
+	let payload = json!({});
+	let res = server.post("/v1/auth/refresh").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_verify_email_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("verify@example.com", "Verify User", false);
+	let otp = OtpManager::generate_otp();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let auth_repo = crate::apps::v1::auth::AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": otp
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Email verified successfully"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_wrong_otp() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("wrongotp@example.com", "Wrong OTP", false);
+	let otp = OtpManager::generate_otp();
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let auth_repo = crate::apps::v1::auth::AuthRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	auth_repo
+		.query_store_otp(user.email.clone(), otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 999_999
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("Failed to verify OTP"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_if_otp_expired() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let user = create_test_user("expired@example.com", "Expired OTP", false);
+	let user_repo = crate::apps::v1::users::UsersRepository::new(&state);
+	user_repo.query_create_user(user.clone()).await.unwrap();
+	use chrono::{Duration, Utc};
+	let expired_otp = crate::apps::v1::auth::AuthOtpSchema {
+		otp: 123456,
+		expires_at: Utc::now() - Duration::minutes(1),
+	};
+	let _: Option<AuthOtpSchema> = state
+		.surrealdb_mem
+		.create((ResourceEnum::OtpCache.to_string(), user.email.clone()))
+		.content(expired_otp)
+		.await
+		.unwrap();
+	let payload = json!({
+		"email": user.email,
+		"otp": 123456
+	});
+	let res = server.post("/v1/auth/verify-email").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("OTP expired"));
+}
+
+#[tokio::test]
+async fn test_verify_email_should_fail_with_empty_payload() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let res = server.post("/v1/auth/verify-email").json(&json!({})).await;
+	assert_eq!(res.status_code(), StatusCode::UNPROCESSABLE_ENTITY);
+}
+
+#[tokio::test]
+async fn test_new_password_should_succeed() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state.clone())),
+	)
+	.unwrap();
+	let email = "resetme@example.com";
+	let repo = crate::apps::v1::users::UsersRepository::new(&state);
+	let mut user = create_test_user(email, "Reset User", true);
+	user.password = crate::hash_password("oldpass123!").unwrap();
+	repo.query_create_user(user).await.unwrap();
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::OK);
+	let body = res.text();
+	assert!(body.contains("Success update password user"));
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_token_is_empty() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let payload = json!({
+		"token": "",
+		"password": "Newpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Invalid or missing token"),
+		"Gagal deteksi token kosong: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_password_is_weak() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let email = "weakpass@example.com";
+	let token = crate::encode_reset_password_token(email.to_string()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "123"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(
+		body.contains("Password must have at least")
+			|| body.contains("Password must include"),
+		"Pesan error nggak sesuai: {body}"
+	);
+}
+
+#[tokio::test]
+async fn test_new_password_should_fail_if_user_not_found() {
+	let state = create_mock_app_state().await;
+	let server = TestServer::new(
+		axum::Router::new()
+			.nest("/v1/auth", auth_router())
+			.layer(Extension(state)),
+	)
+	.unwrap();
+	let token =
+		crate::encode_reset_password_token("ghost@example.com".into()).unwrap();
+	let payload = json!({
+		"token": token,
+		"password": "Validpass123!"
+	});
+	let res = server.post("/v1/auth/new-password").json(&payload).await;
+	assert_eq!(res.status_code(), StatusCode::BAD_REQUEST);
+	let body = res.text();
+	assert!(body.contains("User not found"));
+}

src/apps/v1/auth/auth_dto.rs

@@ -6,10 +6,7 @@ use utoipa::ToSchema;
 use validator::Validate;
 
 lazy_static! {
-	static ref PASSWORD_REGEX: Regex = Regex::new(
-		r"^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$"
-	)
-	.unwrap();
+	static ref PASSWORD_REGEX: Regex = Regex::new(r"^[A-Za-z\d@$!%*?&]{8,}$").unwrap();
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema, Validate)]
@@ -106,10 +103,7 @@ pub struct AuthRefreshTokenRequestDto {
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema, Validate)]
 pub struct AuthNewPasswordRequestDto {
 	pub token: String,
-	#[validate(length(
-		min = 8,
-		message = "Password must have at least 8 characters"
-	))]
+	#[validate(length(min = 1, message = "Token cannot be empty"))]
 	#[validate(regex(
 		path = "PASSWORD_REGEX",
 		message = "Password must include uppercase, lowercase, number, and special character"

src/apps/v1/auth/auth_repository.rs

@@ -4,7 +4,7 @@ use anyhow::{anyhow, bail, Result};
 use chrono::{Duration, Utc};
 
 pub struct AuthRepository<'a> {
-	state: &'a AppState,
+	pub state: &'a AppState,
 }
 
 impl<'a> AuthRepository<'a> {
@@ -13,6 +13,9 @@ impl<'a> AuthRepository<'a> {
 	}
 
 	pub async fn query_store_user(&self, user: UsersSchema) -> Result<String> {
+		if user.email.trim().is_empty() {
+			bail!("Email is required");
+		}
 		let table = ResourceEnum::UsersCache.to_string();
 		let user_id = user.email.clone();
 		let id = make_thing(&table, &user_id);
@@ -43,7 +46,7 @@ impl<'a> AuthRepository<'a> {
 	}
 
 	pub async fn query_delete_stored_user(&self, email: String) -> Result<String> {
-		let record: Option<String> = self
+		let record: Option<UsersSchema> = self
 			.state
 			.surrealdb_mem
 			.delete((ResourceEnum::UsersCache.to_string(), email))

src/apps/v1/auth/auth_repository_test.rs

@@ -0,0 +1,166 @@
+#[cfg(test)]
+mod auth_repository_test {
+	use crate::{
+		create_mock_app_state, make_thing, AuthOtpSchema, AuthRepository, ResourceEnum,
+		UsersSchema,
+	};
+	use chrono::{Duration, Utc};
+	use surrealdb::Uuid;
+
+	fn create_mock_user(email: &str) -> UsersSchema {
+		UsersSchema {
+			id: make_thing("app_users", &Uuid::new_v4().to_string()),
+			email: email.to_string(),
+			fullname: "Test User".to_string(),
+			password: "password".to_string(),
+			is_deleted: false,
+			avatar: None,
+			phone_number: "081234567890".to_string(),
+			referral_code: None,
+			referred_by: None,
+			identity_number: None,
+			is_active: true,
+			student_type: "general".to_string(),
+			religion: None,
+			gender: None,
+			birthdate: None,
+			is_profile_completed: false,
+			role: make_thing("roles", "user"),
+			created_at: None,
+			updated_at: None,
+		}
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_user() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("store_user@example.com");
+		let store = repo.query_store_user(user.clone()).await;
+		assert!(store.is_ok());
+		let fetched = repo.query_get_stored_user(user.email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap().email, user.email);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_user() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("delete_user@example.com");
+		assert!(repo.query_store_user(user.clone()).await.is_ok());
+		let deleted = repo.query_delete_stored_user(user.email.clone()).await;
+		assert!(deleted.is_ok());
+		let result = repo.query_get_stored_user(user.email.clone()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_user@example.com".to_string();
+		let otp = 123456;
+		let stored = repo.query_store_otp(email.clone(), otp).await;
+		assert!(stored.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_ok());
+		assert_eq!(fetched.unwrap(), otp);
+	}
+
+	#[tokio::test]
+	async fn test_delete_stored_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "otp_del@example.com".to_string();
+		let otp = 654321;
+		repo.query_store_otp(email.clone(), otp).await.unwrap();
+		let deleted = repo.query_delete_stored_otp(email.clone()).await;
+		assert!(deleted.is_ok());
+		let fetched = repo.query_get_stored_otp(email.clone()).await;
+		assert!(fetched.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_expired_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com".to_string();
+		let otp = 789012;
+		let table = ResourceEnum::OtpCache.to_string();
+		let expires_at = Utc::now() - Duration::seconds(1);
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((table.clone(), email.as_str()))
+			.content(AuthOtpSchema { otp, expires_at })
+			.await
+			.unwrap();
+		let result = repo.query_get_stored_otp(email.clone()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_user_with_empty_email_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let user = create_mock_user("");
+		let result = repo.query_store_user(user).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_non_existent_stored_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_get_stored_user("not_found@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_delete_non_existent_user_should_fail() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let result = repo
+			.query_delete_stored_user("ghost@example.com".into())
+			.await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_get_expired_otp_should_fail() {
+		use chrono::Duration;
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "expired_otp@example.com";
+		let expired_time = chrono::Utc::now() - Duration::seconds(10);
+		let otp = 123456;
+		let _: Option<AuthOtpSchema> = repo
+			.state
+			.surrealdb_mem
+			.create((ResourceEnum::OtpCache.to_string(), email))
+			.content(AuthOtpSchema {
+				otp,
+				expires_at: expired_time,
+			})
+			.await
+			.unwrap();
+
+		let result = repo.query_get_stored_otp(email.into()).await;
+		assert!(result.is_err());
+	}
+
+	#[tokio::test]
+	async fn test_store_and_get_valid_otp() {
+		let app_state = create_mock_app_state().await;
+		let repo = AuthRepository::new(&app_state);
+		let email = "valid_otp@example.com";
+		let otp = 654321;
+		let store_result = repo.query_store_otp(email.into(), otp).await;
+		assert!(store_result.is_ok());
+		let get_result = repo.query_get_stored_otp(email.into()).await;
+		assert_eq!(get_result.unwrap(), otp);
+	}
+}

src/apps/v1/auth/auth_service.rs

@@ -72,9 +72,20 @@ impl AuthService {
 				let response = ResponseSuccessDto {
 					data: AuthLoginResponsetDto {
 						user: UsersItemDto {
+							id: user.id.id.to_raw(),
 							fullname: user.fullname.clone(),
 							email: user.email.clone(),
-							is_active: user.is_active,
+							is_active: user.is_active.clone(),
+							avatar: user.avatar.clone(),
+							phone_number: user.phone_number.clone(),
+							referral_code: user.referral_code.clone(),
+							referred_by: user.referred_by.clone(),
+							identity_number: user.identity_number.clone(),
+							student_type: user.student_type.clone(),
+							religion: user.religion.clone(),
+							gender: user.gender.clone(),
+							birthdate: user.birthdate.clone(),
+							is_profile_completed: user.is_profile_completed.clone(),
 						},
 						token: TokenDto {
 							access_token,
@@ -97,6 +108,10 @@ impl AuthService {
 		payload: AuthRegisterRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
+
 		let user_repo = UsersRepository::new(state);
 		let auth_repo = AuthRepository::new(state);
 
@@ -188,6 +203,9 @@ impl AuthService {
 		payload: AuthResendOtpRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let repository = AuthRepository::new(state);
 		let otp = generate_otp::OtpManager::generate_otp();
 		let message = format!("Your OTP code is {}", otp);
@@ -203,6 +221,9 @@ impl AuthService {
 	pub async fn mutation_refresh_token(
 		payload: AuthRefreshTokenRequestDto,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let email = match decode_refresh_token(&payload.refresh_token) {
 			Ok(token) => token.claims.sub,
 			Err(_) => {
@@ -244,6 +265,9 @@ impl AuthService {
 		payload: AuthResendOtpRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
 		if user_repo
 			.query_user_by_email(payload.email.clone())
@@ -278,6 +302,9 @@ impl AuthService {
 		payload: AuthVerifyEmailRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
 		let auth_repo = AuthRepository::new(state);
 		let email = payload.email.clone();
@@ -314,9 +341,25 @@ impl AuthService {
 		payload: AuthNewPasswordRequestDto,
 		state: &AppState,
 	) -> Response {
+		if let Err((status, message)) = validate_request(&payload) {
+			return common_response(status, &message);
+		}
 		let user_repo = UsersRepository::new(state);
-		let email = extract_email_token(payload.token).unwrap();
-		let password = hash_password(&payload.password).unwrap();
+		let email = match extract_email_token(payload.token.clone()) {
+			Some(email) => email,
+			None => {
+				return common_response(StatusCode::BAD_REQUEST, "Invalid or missing token");
+			}
+		};
+		let password = match hash_password(&payload.password) {
+			Ok(p) => p,
+			Err(_) => {
+				return common_response(
+					StatusCode::INTERNAL_SERVER_ERROR,
+					"Failed to hash password",
+				);
+			}
+		};
 		match user_repo
 			.query_update_password_user(email, UsersSetNewPasswordSchema { password })
 			.await

src/apps/v1/auth/mod.rs

@@ -7,6 +7,11 @@ pub mod auth_repository;
 pub mod auth_schema;
 pub mod auth_service;
 
+#[cfg(test)]
+pub mod auth_controller_test;
+#[cfg(test)]
+pub mod auth_repository_test;
+
 pub use auth_dto::*;
 pub use auth_repository::*;
 pub use auth_schema::*;

src/apps/v1/users/mod.rs

@@ -2,6 +2,9 @@ pub mod users_dto;
 pub mod users_repository;
 pub mod users_schema;
 
+#[cfg(test)]
+pub mod users_repository_test;
+
 pub use users_dto::*;
 pub use users_repository::*;
 pub use users_schema::*;

src/apps/v1/users/users_dto.rs

@@ -10,7 +10,18 @@ pub struct UsersCreateRequestDto {
 
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema)]
 pub struct UsersItemDto {
-	pub email: String,
+	pub id: String,
 	pub fullname: String,
+	pub email: String,
+	pub avatar: Option<String>,
+	pub phone_number: String,
+	pub referral_code: Option<String>,
+	pub referred_by: Option<String>,
+	pub identity_number: Option<String>,
 	pub is_active: bool,
+	pub student_type: String,
+	pub religion: Option<String>,
+	pub gender: Option<String>,
+	pub birthdate: Option<String>,
+	pub is_profile_completed: bool,
 }

src/apps/v1/users/users_repository.rs

@@ -1,5 +1,8 @@
 use super::{UsersActiveInactiveSchema, UsersSchema, UsersSetNewPasswordSchema};
-use crate::{get_id, AppState, ResourceEnum};
+use crate::{
+	get_id, AppState, CountResult, MetaRequestDto, MetaResponseDto, ResourceEnum,
+	ResponseListSuccessDto,
+};
 use anyhow::{bail, Result};
 
 pub struct UsersRepository<'a> {
@@ -11,10 +14,99 @@ impl<'a> UsersRepository<'a> {
 		Self { state }
 	}
 
+	pub async fn query_user_list(
+		&self,
+		meta: MetaRequestDto,
+	) -> Result<ResponseListSuccessDto<Vec<UsersSchema>>> {
+		let db = &self.state.surrealdb_ws;
+		let table = ResourceEnum::Users.to_string();
+
+		let page = meta.page.unwrap_or(1);
+		let per_page = meta.per_page.unwrap_or(10);
+		let start = (page - 1) * per_page;
+
+		let mut sql = format!("SELECT * FROM {}", table);
+		let mut conditions = vec!["is_deleted = false".to_string()];
+
+		if meta.search.is_some() {
+			conditions.push("string::contains(fullname, $search)".to_string());
+		}
+
+		if meta.filter_by.is_some() && meta.filter.is_some() {
+			let filter_by = meta.filter_by.as_ref().unwrap();
+			conditions.push(format!("{} = $filter", filter_by));
+		}
+
+		if !conditions.is_empty() {
+			sql.push_str(" WHERE ");
+			sql.push_str(&conditions.join(" AND "));
+		}
+
+		if let Some(sort_by) = &meta.sort_by {
+			let order = meta.order.clone().unwrap_or_else(|| "ASC".to_string());
+			sql.push_str(&format!(" ORDER BY {} {}", sort_by, order));
+		}
+
+		sql.push_str(" LIMIT $per_page START $start");
+
+		let mut query = db.query(sql);
+
+		if let Some(search) = meta.search.clone() {
+			query = query.bind(("search", search));
+		}
+
+		if let Some(filter_val) = meta.filter.clone() {
+			if let Ok(b) = filter_val.parse::<bool>() {
+				query = query.bind(("filter", b));
+			} else if let Ok(i) = filter_val.parse::<i64>() {
+				query = query.bind(("filter", i));
+			} else {
+				query = query.bind(("filter", filter_val));
+			}
+		}
+
+		query = query.bind(("per_page", per_page)).bind(("start", start));
+
+		let users: Vec<UsersSchema> = query.await?.take(0)?;
+
+		let mut count_sql =
+			format!("SELECT count() FROM {} WHERE is_deleted = false", table);
+		if meta.filter_by.is_some() && meta.filter.is_some() {
+			let filter_by = meta.filter_by.as_ref().unwrap();
+			count_sql.push_str(&format!(" AND {} = $filter", filter_by));
+		}
+
+		let mut count_query = db.query(count_sql);
+
+		if let Some(filter_val) = meta.filter.clone() {
+			if let Ok(b) = filter_val.parse::<bool>() {
+				count_query = count_query.bind(("filter", b));
+			} else if let Ok(i) = filter_val.parse::<i64>() {
+				count_query = count_query.bind(("filter", i));
+			} else {
+				count_query = count_query.bind(("filter", filter_val));
+			}
+		}
+
+		let count_result: Vec<CountResult> = count_query.await?.take(0)?;
+		let total = count_result.first().map(|c| c.count);
+
+		let meta_res = MetaResponseDto {
+			page: Some(page),
+			per_page: Some(per_page),
+			total,
+		};
+
+		Ok(ResponseListSuccessDto {
+			data: users,
+			meta: Some(meta_res),
+		})
+	}
+
 	pub async fn query_user_by_email(&self, email: String) -> Result<UsersSchema> {
 		let db = &self.state.surrealdb_ws;
 		let sql = format!(
-			"SELECT * FROM {} WHERE email = $email",
+			"SELECT * FROM {} WHERE email = $email AND is_deleted = false",
 			ResourceEnum::Users.to_string()
 		);
 		let mut response: Vec<UsersSchema> = db
@@ -22,22 +114,20 @@ impl<'a> UsersRepository<'a> {
 			.bind(("email", email.clone()))
 			.await?
 			.take(0)?;
-
-		if let Some(user) = response.pop() {
-			Ok(user)
-		} else {
-			bail!("User not found")
+		match response.pop() {
+			Some(user) => Ok(user),
+			None => bail!("User not found"),
 		}
 	}
 
 	pub async fn query_user_by_id(&self, id: String) -> Result<UsersSchema> {
 		let db = &self.state.surrealdb_ws;
-		let result = db
+		let result: Option<UsersSchema> = db
 			.select((ResourceEnum::Users.to_string(), id.clone()))
 			.await?;
 		match result {
-			Some(response) => Ok(response),
-			None => bail!("User not found"),
+			Some(response) if !response.is_deleted => Ok(response),
+			_ => bail!("User not found"),
 		}
 	}
 
@@ -102,4 +192,18 @@ impl<'a> UsersRepository<'a> {
 			None => bail!("Failed to update password user"),
 		}
 	}
+
+	pub async fn query_delete_user(&self, email: String) -> Result<String> {
+		let db = &self.state.surrealdb_ws;
+		let user = self.query_user_by_email(email.clone()).await?;
+		let record_key = get_id(&user.id)?;
+		let record: Option<UsersSchema> = db
+			.update(record_key)
+			.merge(serde_json::json!({ "is_deleted": true }))
+			.await?;
+		match record {
+			Some(_) => Ok("Success delete user".into()),
+			None => bail!("Failed to delete user"),
+		}
+	}
 }

src/apps/v1/users/users_repository_test.rs

@@ -0,0 +1,196 @@
+use crate::create_mock_app_state;
+use crate::{
+	make_thing, MetaRequestDto, UsersActiveInactiveSchema, UsersRepository,
+	UsersSchema, UsersSetNewPasswordSchema,
+};
+use surrealdb::Uuid;
+
+fn create_test_user(email: &str, fullname: &str, is_active: bool) -> UsersSchema {
+	UsersSchema {
+		id: make_thing("app_users", &Uuid::new_v4().to_string()),
+		email: email.to_string(),
+		fullname: fullname.to_string(),
+		password: "password".to_string(),
+		is_deleted: false,
+		avatar: None,
+		phone_number: "081234567890".to_string(),
+		referral_code: None,
+		referred_by: None,
+		identity_number: None,
+		is_active,
+		student_type: "general".to_string(),
+		religion: None,
+		gender: None,
+		birthdate: None,
+		is_profile_completed: false,
+		role: make_thing("roles", "user"),
+		created_at: None,
+		updated_at: None,
+	}
+}
+
+#[tokio::test]
+async fn test_create_and_get_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let user = create_test_user("testuser@example.com", "Test User", true);
+	let create_result = repo.query_create_user(user.clone()).await;
+	assert!(create_result.is_ok());
+	let fetched = repo
+		.query_user_by_email("testuser@example.com".into())
+		.await;
+	assert!(fetched.is_ok());
+	assert_eq!(fetched.unwrap().email, "testuser@example.com");
+}
+
+#[tokio::test]
+async fn test_update_password_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "changepass@example.com";
+	let user = create_test_user(email, "Change Password", true);
+	repo.query_create_user(user).await.unwrap();
+	let result = repo
+		.query_update_password_user(
+			email.into(),
+			UsersSetNewPasswordSchema {
+				password: "newpass".into(),
+			},
+		)
+		.await;
+	assert!(result.is_ok());
+}
+
+#[tokio::test]
+async fn test_query_user_list_with_pagination_and_filter() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	for i in 0..10 {
+		let email = format!("user{}@example.com", i);
+		let fullname = format!("User {}", i);
+		let is_active = i % 2 == 0;
+		let user = create_test_user(&email, &fullname, is_active);
+		repo.query_create_user(user).await.unwrap();
+	}
+	let meta = MetaRequestDto {
+		page: Some(1),
+		per_page: Some(5),
+		search: None,
+		sort_by: Some("email".into()),
+		order: Some("ASC".into()),
+		filter: Some("true".into()),
+		filter_by: Some("is_active".into()),
+	};
+	let result = repo.query_user_list(meta).await.unwrap();
+	assert!(result.data.len() <= 5);
+	assert!(result.data.iter().all(|u| u.is_active));
+	assert!(result.meta.as_ref().unwrap().total.is_some());
+}
+
+#[tokio::test]
+async fn test_query_user_list_basic() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	for i in 0..10 {
+		let email = format!("basic{}@example.com", i);
+		let user = create_test_user(&email, &format!("Basic User {}", i), true);
+		repo.query_create_user(user).await.unwrap();
+	}
+	let meta = MetaRequestDto {
+		page: Some(1),
+		per_page: Some(5),
+		search: None,
+		sort_by: None,
+		order: None,
+		filter: None,
+		filter_by: None,
+	};
+	let result = repo.query_user_list(meta).await.unwrap();
+	assert!(result.meta.as_ref().unwrap().total.unwrap() >= 1);
+	assert_eq!(result.meta.as_ref().unwrap().page.unwrap(), 1);
+	assert_eq!(result.meta.as_ref().unwrap().per_page.unwrap(), 5);
+}
+
+#[tokio::test]
+async fn test_query_active_inactive_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "inactive@example.com";
+	let user = create_test_user(email, "Inactive User", false);
+	repo.query_create_user(user).await.unwrap();
+	let result = repo
+		.query_active_inactive_user(
+			email.into(),
+			UsersActiveInactiveSchema { is_active: true },
+		)
+		.await;
+	assert!(result.is_ok());
+	let updated = repo
+		.query_user_by_email("inactive@example.com".into())
+		.await
+		.unwrap();
+	assert_eq!(updated.is_active, true);
+}
+
+#[tokio::test]
+async fn test_query_user_by_invalid_email_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo
+		.query_user_by_email("nonexistent@example.com".into())
+		.await;
+	assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_query_update_password_for_nonexistent_user_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo
+		.query_update_password_user(
+			"ghost@example.com".into(),
+			UsersSetNewPasswordSchema {
+				password: "secret".into(),
+			},
+		)
+		.await;
+	assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_query_delete_user() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "deleteuser@example.com";
+	let user = create_test_user(email, "Delete User", true);
+	repo.query_create_user(user.clone()).await.unwrap();
+	let delete_result = repo.query_delete_user(email.to_string()).await;
+	assert!(delete_result.is_ok());
+	let fetch_result = repo.query_user_by_email(email.to_string()).await;
+	assert!(fetch_result.is_err());
+}
+
+#[tokio::test]
+async fn test_delete_non_existent_user_should_fail() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let result = repo
+		.query_delete_user("nonexistent@example.com".to_string())
+		.await;
+	assert!(result.is_err());
+	assert_eq!(result.unwrap_err().to_string(), "User not found");
+}
+
+#[tokio::test]
+async fn test_delete_user_twice_should_fail_on_second_attempt() {
+	let app_state = create_mock_app_state().await;
+	let repo = UsersRepository::new(&app_state);
+	let email = "twice@example.com";
+	let user = create_test_user(email, "Delete Twice", true);
+	repo.query_create_user(user.clone()).await.unwrap();
+	let first = repo.query_delete_user(email.to_string()).await;
+	assert!(first.is_ok());
+	let second = repo.query_delete_user(email.to_string()).await;
+	assert!(second.is_err());
+	assert_eq!(second.unwrap_err().to_string(), "User not found");
+}

src/apps/v1/users/users_schema.rs

@@ -17,6 +17,7 @@ pub struct UsersSchema {
 	pub referred_by: Option<String>,
 	pub identity_number: Option<String>,
 	pub is_active: bool,
+	pub is_deleted: bool,
 	pub student_type: String,
 	pub religion: Option<String>,
 	pub gender: Option<String>,
@@ -43,6 +44,7 @@ impl Default for UsersSchema {
 			referred_by: None,
 			identity_number: None,
 			is_active: false,
+			is_deleted: false,
 			student_type: String::new(),
 			religion: None,
 			gender: None,

src/entities/common_dto.rs

@@ -48,3 +48,8 @@ pub struct AppState {
 	pub surrealdb_ws: SurrealWsClient,
 	pub surrealdb_mem: SurrealMemClient,
 }
+
+#[derive(Debug, serde::Deserialize)]
+pub struct CountResult {
+	pub count: u64,
+}

src/utils/bind_filter.rs

@@ -0,0 +1 @@
+

src/utils/mock_test.rs

@@ -0,0 +1,81 @@
+use crate::{hash_password, AppState, UsersSchema};
+use surrealdb::{
+	engine::{local::Mem, remote::ws::Ws},
+	opt::auth::Root,
+	Surreal, Uuid,
+};
+
+use super::make_thing;
+
+pub async fn create_mock_app_state() -> AppState {
+	let db_mem = Surreal::new::<Mem>(()).await.unwrap();
+	let db_ws = Surreal::new::<Ws>("localhost:8000").await.unwrap();
+	db_mem.use_ns("test").use_db("test").await.unwrap();
+	db_ws
+		.signin(Root {
+			username: "root",
+			password: "root",
+		})
+		.await
+		.unwrap();
+	db_ws.use_ns("test").use_db("test").await.unwrap();
+
+	AppState {
+		surrealdb_mem: db_mem,
+		surrealdb_ws: db_ws,
+	}
+}
+
+pub async fn cleanup_db() {
+	let app_state = create_mock_app_state().await;
+	let _ = app_state
+		.surrealdb_mem
+		.query(
+			r#"
+    REMOVE TABLE app_users;
+    REMOVE TABLE app_roles;
+    REMOVE TABLE app_users_cache;
+    REMOVE TABLE app_otp_cache;
+"#,
+		)
+		.await;
+	let _ = app_state
+		.surrealdb_ws
+		.query(
+			r#"
+    REMOVE TABLE app_users;
+    REMOVE TABLE app_roles;
+    REMOVE TABLE app_users_cache;
+    REMOVE TABLE app_otp_cache;
+"#,
+		)
+		.await;
+}
+
+pub fn create_test_user(
+	email: &str,
+	fullname: &str,
+	is_active: bool,
+) -> UsersSchema {
+	UsersSchema {
+		id: make_thing("app_users", &Uuid::new_v4().to_string()),
+		email: email.to_string(),
+		fullname: fullname.to_string(),
+		password: hash_password("secret").unwrap(),
+		is_deleted: false,
+		avatar: None,
+		phone_number: "081234567890".to_string(),
+		referral_code: None,
+		referred_by: None,
+		identity_number: None,
+		is_active,
+		student_type: "general".to_string(),
+		religion: None,
+		gender: None,
+		birthdate: None,
+		is_profile_completed: false,
+		role: make_thing("roles", "user"),
+		created_at: None,
+		updated_at: None,
+	}
+}

src/utils/mod.rs

@@ -1,8 +1,10 @@
+pub mod bind_filter;
 pub mod extract_email;
 pub mod generate_date;
 pub mod generate_otp;
 pub mod get_id;
 pub mod make_thing;
+pub mod mock_test;
 pub mod response_format;
 pub mod validator;
 
@@ -11,5 +13,6 @@ pub use generate_date::*;
 pub use generate_otp::*;
 pub use get_id::*;
 pub use make_thing::*;
+pub use mock_test::*;
 pub use response_format::*;
 pub use validator::*;