feat(auth): replace hand-rolled auth with Ory Kratos — phase 2 backend

Delegates all credential management (login, register, password reset,
email verification, social sign-in) to Ory Kratos. The Go API now acts
as a resource server: the new KratosAuth middleware validates sessions
against the Kratos whoami endpoint, writes the local User mirror into
Echo context, and all existing domain handlers continue working
unchanged. Hand-rolled token auth, AuthToken model, apple_auth/
google_auth services, and the auth refresh flow are removed. Tests are
updated to use the fake-token middleware pattern so existing integration
assertions require no rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handlers/auth_handler.go

@@ -1,8 +1,6 @@
 package handlers
 
 import (
-	"context"
-	"errors"
 	"net/http"
 
 	"github.com/labstack/echo/v4"
@@ -16,18 +14,18 @@ import (
 	"github.com/treytartt/honeydue-api/internal/validator"
 )
 
-// AuthHandler handles authentication endpoints
+// AuthHandler handles user profile and account management endpoints.
+// Session lifecycle (login, register, logout, password reset) is delegated
+// to Ory Kratos; this handler only deals with the honeyDue user record.
 type AuthHandler struct {
-	authService       *services.AuthService
-	emailService      *services.EmailService
-	cache             *services.CacheService
-	appleAuthService  *services.AppleAuthService
-	googleAuthService *services.GoogleAuthService
-	storageService    *services.StorageService
-	auditService      *services.AuditService
+	authService    *services.AuthService
+	emailService   *services.EmailService
+	cache          *services.CacheService
+	storageService *services.StorageService
+	auditService   *services.AuditService
 }
 
-// NewAuthHandler creates a new auth handler
+// NewAuthHandler creates a new auth handler.
 func NewAuthHandler(authService *services.AuthService, emailService *services.EmailService, cache *services.CacheService) *AuthHandler {
 	return &AuthHandler{
 		authService:  authService,
@@ -36,136 +34,21 @@ func NewAuthHandler(authService *services.AuthService, emailService *services.Em
 	}
 }
 
-// SetAppleAuthService sets the Apple auth service (called after initialization)
-func (h *AuthHandler) SetAppleAuthService(appleAuth *services.AppleAuthService) {
-	h.appleAuthService = appleAuth
-}
-
-// SetGoogleAuthService sets the Google auth service (called after initialization)
-func (h *AuthHandler) SetGoogleAuthService(googleAuth *services.GoogleAuthService) {
-	h.googleAuthService = googleAuth
-}
-
-// SetStorageService sets the storage service for file deletion during account deletion
+// SetStorageService sets the storage service for file deletion during account deletion.
 func (h *AuthHandler) SetStorageService(storageService *services.StorageService) {
 	h.storageService = storageService
 }
 
-// SetAuditService sets the audit service for logging security events
+// SetAuditService sets the audit service for logging security events.
 func (h *AuthHandler) SetAuditService(auditService *services.AuditService) {
 	h.auditService = auditService
 }
 
-// noStore marks a response as non-cacheable (audit L2) — auth responses
-// carry tokens and user data that must never sit in any cache.
+// noStore marks a response as non-cacheable.
 func noStore(c echo.Context) {
 	c.Response().Header().Set("Cache-Control", "no-store")
 }
 
-// Login handles POST /api/auth/login/
-func (h *AuthHandler) Login(c echo.Context) error {
-	noStore(c)
-	var req requests.LoginRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	response, err := h.authService.Login(c.Request().Context(), &req, c.RealIP())
-	if err != nil {
-		log.Debug().Err(err).Str("identifier", req.Username).
-			Str("ip", c.RealIP()).Str("user_agent", c.Request().UserAgent()).
-			Msg("Login failed")
-		if h.auditService != nil {
-			h.auditService.LogEvent(c, nil, services.AuditEventLoginFailed, map[string]interface{}{
-				"identifier": req.Username,
-			})
-		}
-		return err
-	}
-
-	if h.auditService != nil {
-		userID := response.User.ID
-		h.auditService.LogEvent(c, &userID, services.AuditEventLogin, nil)
-	}
-
-	return c.JSON(http.StatusOK, response)
-}
-
-// Register handles POST /api/auth/register/
-func (h *AuthHandler) Register(c echo.Context) error {
-	noStore(c)
-	var req requests.RegisterRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	response, confirmationCode, err := h.authService.Register(c.Request().Context(), &req)
-	if err != nil {
-		log.Debug().Err(err).Msg("Registration failed")
-		return err
-	}
-
-	if h.auditService != nil {
-		userID := response.User.ID
-		h.auditService.LogEvent(c, &userID, services.AuditEventRegister, map[string]interface{}{
-			"username": req.Username,
-			"email":    req.Email,
-		})
-	}
-
-	// Send welcome email with confirmation code (async)
-	if h.emailService != nil && confirmationCode != "" {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Error().Interface("panic", r).Str("email", req.Email).Msg("Panic in welcome email goroutine")
-				}
-			}()
-			if err := h.emailService.SendWelcomeEmail(req.Email, req.FirstName, confirmationCode); err != nil {
-				log.Error().Err(err).Str("email", req.Email).Msg("Failed to send welcome email")
-			}
-		}()
-	}
-
-	return c.JSON(http.StatusCreated, response)
-}
-
-// Logout handles POST /api/auth/logout/
-func (h *AuthHandler) Logout(c echo.Context) error {
-	token := middleware.GetAuthToken(c)
-	if token == "" {
-		return apperrors.Unauthorized("error.not_authenticated")
-	}
-
-	// Log audit event before invalidating the token
-	if h.auditService != nil {
-		user := middleware.GetAuthUser(c)
-		if user != nil {
-			h.auditService.LogEvent(c, &user.ID, services.AuditEventLogout, nil)
-		}
-	}
-
-	// Invalidate token in database
-	if err := h.authService.Logout(c.Request().Context(), token); err != nil {
-		log.Warn().Err(err).Msg("Failed to delete token from database")
-	}
-
-	// Invalidate token in cache
-	if h.cache != nil {
-		if err := h.cache.InvalidateAuthToken(c.Request().Context(), token); err != nil {
-			log.Warn().Err(err).Msg("Failed to invalidate token in cache")
-		}
-	}
-
-	return c.JSON(http.StatusOK, responses.MessageResponse{Message: "Logged out successfully"})
-}
-
 // CurrentUser handles GET /api/auth/me/
 func (h *AuthHandler) CurrentUser(c echo.Context) error {
 	noStore(c)
@@ -207,301 +90,6 @@ func (h *AuthHandler) UpdateProfile(c echo.Context) error {
 	return c.JSON(http.StatusOK, response)
 }
 
-// VerifyEmail handles POST /api/auth/verify-email/
-func (h *AuthHandler) VerifyEmail(c echo.Context) error {
-	user, err := middleware.MustGetAuthUser(c)
-	if err != nil {
-		return err
-	}
-
-	var req requests.VerifyEmailRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	err = h.authService.VerifyEmail(c.Request().Context(), user.ID, req.Code)
-	if err != nil {
-		log.Debug().Err(err).Uint("user_id", user.ID).Msg("Email verification failed")
-		return err
-	}
-
-	// Send post-verification welcome email with tips (async)
-	if h.emailService != nil {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Error().Interface("panic", r).Str("email", user.Email).Msg("Panic in post-verification email goroutine")
-				}
-			}()
-			if err := h.emailService.SendPostVerificationEmail(user.Email, user.FirstName); err != nil {
-				log.Error().Err(err).Str("email", user.Email).Msg("Failed to send post-verification email")
-			}
-		}()
-	}
-
-	return c.JSON(http.StatusOK, responses.VerifyEmailResponse{
-		Message:  "Email verified successfully",
-		Verified: true,
-	})
-}
-
-// ResendVerification handles POST /api/auth/resend-verification/
-func (h *AuthHandler) ResendVerification(c echo.Context) error {
-	user, err := middleware.MustGetAuthUser(c)
-	if err != nil {
-		return err
-	}
-
-	code, err := h.authService.ResendVerificationCode(c.Request().Context(), user.ID)
-	if err != nil {
-		log.Debug().Err(err).Uint("user_id", user.ID).Msg("Failed to resend verification")
-		return err
-	}
-
-	// Send verification email (async)
-	if h.emailService != nil {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Error().Interface("panic", r).Str("email", user.Email).Msg("Panic in verification email goroutine")
-				}
-			}()
-			if err := h.emailService.SendVerificationEmail(user.Email, user.FirstName, code); err != nil {
-				log.Error().Err(err).Str("email", user.Email).Msg("Failed to send verification email")
-			}
-		}()
-	}
-
-	return c.JSON(http.StatusOK, responses.MessageResponse{Message: "Verification email sent"})
-}
-
-// ForgotPassword handles POST /api/auth/forgot-password/
-func (h *AuthHandler) ForgotPassword(c echo.Context) error {
-	var req requests.ForgotPasswordRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	noStore(c)
-
-	if h.auditService != nil {
-		h.auditService.LogEvent(c, nil, services.AuditEventPasswordReset, map[string]interface{}{
-			"email": req.Email,
-		})
-	}
-
-	// Audit LIVE-L13: run the user lookup, code generation, and email send
-	// entirely in the background, then return the generic response
-	// immediately. This makes the response time identical whether or not
-	// the email belongs to a real account, defeating timing-based user
-	// enumeration. context.Background() is used because the request context
-	// is cancelled the moment this handler returns. Per-account rate
-	// limiting still runs inside the service; the edge auth-rate-limit
-	// middleware covers per-IP abuse.
-	email := req.Email
-	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Error().Interface("panic", r).Str("email", email).Msg("Panic in forgot-password goroutine")
-			}
-		}()
-		code, user, err := h.authService.ForgotPassword(context.Background(), email)
-		if err != nil || code == "" || user == nil {
-			return
-		}
-		if h.emailService != nil {
-			if sendErr := h.emailService.SendPasswordResetEmail(user.Email, user.FirstName, code); sendErr != nil {
-				log.Error().Err(sendErr).Str("email", user.Email).Msg("Failed to send password reset email")
-			}
-		}
-	}()
-
-	// Always return success to prevent email enumeration.
-	return c.JSON(http.StatusOK, responses.ForgotPasswordResponse{
-		Message: "Password reset email sent",
-	})
-}
-
-// VerifyResetCode handles POST /api/auth/verify-reset-code/
-func (h *AuthHandler) VerifyResetCode(c echo.Context) error {
-	var req requests.VerifyResetCodeRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	resetToken, err := h.authService.VerifyResetCode(c.Request().Context(), req.Email, req.Code)
-	if err != nil {
-		log.Debug().Err(err).Str("email", req.Email).Msg("Verify reset code failed")
-		return err
-	}
-
-	return c.JSON(http.StatusOK, responses.VerifyResetCodeResponse{
-		Message:    "Reset code verified",
-		ResetToken: resetToken,
-	})
-}
-
-// ResetPassword handles POST /api/auth/reset-password/
-func (h *AuthHandler) ResetPassword(c echo.Context) error {
-	var req requests.ResetPasswordRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	err := h.authService.ResetPassword(c.Request().Context(), req.ResetToken, req.NewPassword)
-	if err != nil {
-		log.Debug().Err(err).Msg("Password reset failed")
-		return err
-	}
-
-	if h.auditService != nil {
-		h.auditService.LogEvent(c, nil, services.AuditEventPasswordChanged, map[string]interface{}{
-			"method": "reset_token",
-		})
-	}
-
-	return c.JSON(http.StatusOK, responses.ResetPasswordResponse{
-		Message: "Password reset successful",
-	})
-}
-
-// AppleSignIn handles POST /api/auth/apple-sign-in/
-func (h *AuthHandler) AppleSignIn(c echo.Context) error {
-	noStore(c)
-	var req requests.AppleSignInRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	if h.appleAuthService == nil {
-		log.Error().Msg("Apple auth service not configured")
-		return &apperrors.AppError{
-			Code:       500,
-			MessageKey: "error.apple_signin_not_configured",
-		}
-	}
-
-	response, err := h.authService.AppleSignIn(c.Request().Context(), h.appleAuthService, &req)
-	if err != nil {
-		// Check for legacy Apple Sign In error (not yet migrated)
-		if errors.Is(err, services.ErrAppleSignInFailed) {
-			log.Debug().Err(err).Msg("Apple Sign In failed (legacy error)")
-			return apperrors.Unauthorized("error.invalid_apple_token")
-		}
-
-		log.Debug().Err(err).Msg("Apple Sign In failed")
-		return err
-	}
-
-	// Send welcome email for new users (async)
-	if response.IsNewUser && h.emailService != nil && response.User.Email != "" {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Error().Interface("panic", r).Str("email", response.User.Email).Msg("Panic in Apple welcome email goroutine")
-				}
-			}()
-			if err := h.emailService.SendAppleWelcomeEmail(response.User.Email, response.User.FirstName); err != nil {
-				log.Error().Err(err).Str("email", response.User.Email).Msg("Failed to send Apple welcome email")
-			}
-		}()
-	}
-
-	return c.JSON(http.StatusOK, response)
-}
-
-// GoogleSignIn handles POST /api/auth/google-sign-in/
-func (h *AuthHandler) GoogleSignIn(c echo.Context) error {
-	noStore(c)
-	var req requests.GoogleSignInRequest
-	if err := c.Bind(&req); err != nil {
-		return apperrors.BadRequest("error.invalid_request")
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, validator.FormatValidationErrors(err))
-	}
-
-	if h.googleAuthService == nil {
-		log.Error().Msg("Google auth service not configured")
-		return &apperrors.AppError{
-			Code:       500,
-			MessageKey: "error.google_signin_not_configured",
-		}
-	}
-
-	response, err := h.authService.GoogleSignIn(c.Request().Context(), h.googleAuthService, &req)
-	if err != nil {
-		// Check for legacy Google Sign In error (not yet migrated)
-		if errors.Is(err, services.ErrGoogleSignInFailed) {
-			log.Debug().Err(err).Msg("Google Sign In failed (legacy error)")
-			return apperrors.Unauthorized("error.invalid_google_token")
-		}
-
-		log.Debug().Err(err).Msg("Google Sign In failed")
-		return err
-	}
-
-	// Send welcome email for new users (async)
-	if response.IsNewUser && h.emailService != nil && response.User.Email != "" {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Error().Interface("panic", r).Str("email", response.User.Email).Msg("Panic in Google welcome email goroutine")
-				}
-			}()
-			if err := h.emailService.SendGoogleWelcomeEmail(response.User.Email, response.User.FirstName); err != nil {
-				log.Error().Err(err).Str("email", response.User.Email).Msg("Failed to send Google welcome email")
-			}
-		}()
-	}
-
-	return c.JSON(http.StatusOK, response)
-}
-
-// RefreshToken handles POST /api/auth/refresh/
-func (h *AuthHandler) RefreshToken(c echo.Context) error {
-	noStore(c)
-	user, err := middleware.MustGetAuthUser(c)
-	if err != nil {
-		return err
-	}
-
-	token := middleware.GetAuthToken(c)
-	if token == "" {
-		return apperrors.Unauthorized("error.not_authenticated")
-	}
-
-	response, err := h.authService.RefreshToken(c.Request().Context(), token, user.ID)
-	if err != nil {
-		log.Debug().Err(err).Uint("user_id", user.ID).Msg("Token refresh failed")
-		return err
-	}
-
-	// If the token was refreshed (new token), invalidate the old one from cache
-	if response.Token != token && h.cache != nil {
-		if cacheErr := h.cache.InvalidateAuthToken(c.Request().Context(), token); cacheErr != nil {
-			log.Warn().Err(cacheErr).Msg("Failed to invalidate old token from cache during refresh")
-		}
-	}
-
-	return c.JSON(http.StatusOK, response)
-}
-
 // DeleteAccount handles DELETE /api/auth/account/
 func (h *AuthHandler) DeleteAccount(c echo.Context) error {
 	user, err := middleware.MustGetAuthUser(c)
@@ -544,13 +132,5 @@ func (h *AuthHandler) DeleteAccount(c echo.Context) error {
 		}()
 	}
 
-	// Invalidate auth token from cache
-	token := middleware.GetAuthToken(c)
-	if h.cache != nil && token != "" {
-		if err := h.cache.InvalidateAuthToken(c.Request().Context(), token); err != nil {
-			log.Warn().Err(err).Msg("Failed to invalidate token in cache after account deletion")
-		}
-	}
-
 	return c.JSON(http.StatusOK, responses.MessageResponse{Message: "Account deleted successfully"})
 }

internal/handlers/auth_handler_delete_test.go

@@ -35,26 +35,25 @@ func setupDeleteAccountHandler(t *testing.T) (*AuthHandler, *echo.Echo, *gorm.DB
 	return handler, e, db
 }
 
-func TestAuthHandler_DeleteAccount_EmailUser(t *testing.T) {
+// TestAuthHandler_DeleteAccount_WithConfirmation verifies that DELETE /account/
+// succeeds when the user sends confirmation: "DELETE".
+// Post-Kratos: all users (regardless of provider) must confirm with "DELETE".
+func TestAuthHandler_DeleteAccount_WithConfirmation(t *testing.T) {
 	handler, e, db := setupDeleteAccountHandler(t)
 
-	user := testutil.CreateTestUser(t, db, "deletetest", "delete@test.com", "Password123")
+	user := testutil.CreateTestUser(t, db, "deletetest", "delete@test.com", "ignored")
 
 	// Create profile for the user
 	profile := &models.UserProfile{UserID: user.ID, Verified: true}
 	require.NoError(t, db.Create(profile).Error)
 
-	// Create auth token
-	testutil.CreateTestToken(t, db, user.ID)
-
 	authGroup := e.Group("/api/auth")
 	authGroup.Use(testutil.MockAuthMiddleware(user))
 	authGroup.DELETE("/account/", handler.DeleteAccount)
 
-	t.Run("successful deletion with correct password", func(t *testing.T) {
-		password := "Password123"
+	t.Run("successful deletion with DELETE confirmation", func(t *testing.T) {
 		req := map[string]interface{}{
-			"password": password,
+			"confirmation": "DELETE",
 		}
 
 		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "test-token")
@@ -74,106 +73,15 @@ func TestAuthHandler_DeleteAccount_EmailUser(t *testing.T) {
 		// Verify profile is deleted
 		db.Model(&models.UserProfile{}).Where("user_id = ?", user.ID).Count(&count)
 		assert.Equal(t, int64(0), count)
-
-		// Verify auth token is deleted
-		db.Model(&models.AuthToken{}).Where("user_id = ?", user.ID).Count(&count)
-		assert.Equal(t, int64(0), count)
 	})
 }
 
-func TestAuthHandler_DeleteAccount_WrongPassword(t *testing.T) {
+// TestAuthHandler_DeleteAccount_MissingConfirmation verifies that a missing
+// confirmation string is rejected with 400.
+func TestAuthHandler_DeleteAccount_MissingConfirmation(t *testing.T) {
 	handler, e, db := setupDeleteAccountHandler(t)
 
-	user := testutil.CreateTestUser(t, db, "wrongpw", "wrongpw@test.com", "Password123")
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.DELETE("/account/", handler.DeleteAccount)
-
-	t.Run("wrong password returns 401", func(t *testing.T) {
-		wrongPw := "wrongpassword"
-		req := map[string]interface{}{
-			"password": wrongPw,
-		}
-
-		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "test-token")
-
-		testutil.AssertStatusCode(t, w, http.StatusUnauthorized)
-	})
-}
-
-func TestAuthHandler_DeleteAccount_MissingPassword(t *testing.T) {
-	handler, e, db := setupDeleteAccountHandler(t)
-
-	user := testutil.CreateTestUser(t, db, "nopw", "nopw@test.com", "Password123")
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.DELETE("/account/", handler.DeleteAccount)
-
-	t.Run("missing password returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-
-		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "test-token")
-
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-func TestAuthHandler_DeleteAccount_SocialAuthUser(t *testing.T) {
-	handler, e, db := setupDeleteAccountHandler(t)
-
-	user := testutil.CreateTestUser(t, db, "appleuser", "apple@test.com", "randompassword")
-
-	// Create Apple social auth record
-	appleAuth := &models.AppleSocialAuth{
-		UserID:  user.ID,
-		AppleID: "apple_sub_123",
-		Email:   "apple@test.com",
-	}
-	require.NoError(t, db.Create(appleAuth).Error)
-
-	// Create profile
-	profile := &models.UserProfile{UserID: user.ID, Verified: true}
-	require.NoError(t, db.Create(profile).Error)
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.DELETE("/account/", handler.DeleteAccount)
-
-	t.Run("successful deletion with DELETE confirmation", func(t *testing.T) {
-		confirmation := "DELETE"
-		req := map[string]interface{}{
-			"confirmation": confirmation,
-		}
-
-		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "test-token")
-
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		// Verify user is deleted
-		var count int64
-		db.Model(&models.User{}).Where("id = ?", user.ID).Count(&count)
-		assert.Equal(t, int64(0), count)
-
-		// Verify apple auth is deleted
-		db.Model(&models.AppleSocialAuth{}).Where("user_id = ?", user.ID).Count(&count)
-		assert.Equal(t, int64(0), count)
-	})
-}
-
-func TestAuthHandler_DeleteAccount_SocialAuthMissingConfirmation(t *testing.T) {
-	handler, e, db := setupDeleteAccountHandler(t)
-
-	user := testutil.CreateTestUser(t, db, "googleuser", "google@test.com", "randompassword")
-
-	// Create Google social auth record
-	googleAuth := &models.GoogleSocialAuth{
-		UserID:   user.ID,
-		GoogleID: "google_sub_456",
-		Email:    "google@test.com",
-	}
-	require.NoError(t, db.Create(googleAuth).Error)
+	user := testutil.CreateTestUser(t, db, "nopw", "nopw@test.com", "ignored")
 
 	authGroup := e.Group("/api/auth")
 	authGroup.Use(testutil.MockAuthMiddleware(user))
@@ -188,9 +96,8 @@ func TestAuthHandler_DeleteAccount_SocialAuthMissingConfirmation(t *testing.T) {
 	})
 
 	t.Run("wrong confirmation returns 400", func(t *testing.T) {
-		wrongConfirmation := "delete"
 		req := map[string]interface{}{
-			"confirmation": wrongConfirmation,
+			"confirmation": "delete", // lowercase — must be exact "DELETE"
 		}
 
 		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "test-token")
@@ -199,6 +106,8 @@ func TestAuthHandler_DeleteAccount_SocialAuthMissingConfirmation(t *testing.T) {
 	})
 }
 
+// TestAuthHandler_DeleteAccount_Unauthenticated verifies that 401 is returned
+// when no auth middleware is set.
 func TestAuthHandler_DeleteAccount_Unauthenticated(t *testing.T) {
 	handler, e, _ := setupDeleteAccountHandler(t)
 
@@ -207,7 +116,7 @@ func TestAuthHandler_DeleteAccount_Unauthenticated(t *testing.T) {
 
 	t.Run("unauthenticated request returns 401", func(t *testing.T) {
 		req := map[string]interface{}{
-			"password": "Password123",
+			"confirmation": "DELETE",
 		}
 
 		w := testutil.MakeRequest(e, "DELETE", "/api/auth/account/", req, "")

internal/handlers/auth_handler_test.go

@@ -1,3 +1,7 @@
+// auth_handler_test.go tests the auth handler endpoints that survived the
+// Ory Kratos migration: GET /me/ and PUT/PATCH /profile/.
+// Login, register, logout, forgot-password, and social sign-in are now
+// handled by Kratos.
 package handlers
 
 import (
@@ -34,204 +38,32 @@ func setupAuthHandler(t *testing.T) (*AuthHandler, *echo.Echo, *repositories.Use
 	return handler, e, userRepo
 }
 
-func TestAuthHandler_Register(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/register/", handler.Register)
-
-	t.Run("successful registration", func(t *testing.T) {
-		req := requests.RegisterRequest{
-			Username:  "newuser",
-			Email:     "new@test.com",
-			Password:  "Password123",
-			FirstName: "New",
-			LastName:  "User",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusCreated)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-
-		testutil.AssertJSONFieldExists(t, response, "token")
-		testutil.AssertJSONFieldExists(t, response, "user")
-		testutil.AssertJSONFieldExists(t, response, "message")
-
-		user := response["user"].(map[string]interface{})
-		assert.Equal(t, "newuser", user["username"])
-		assert.Equal(t, "new@test.com", user["email"])
-		assert.Equal(t, "New", user["first_name"])
-		assert.Equal(t, "User", user["last_name"])
-	})
-
-	t.Run("registration with missing fields", func(t *testing.T) {
-		req := map[string]string{
-			"username": "test",
-			// Missing email and password
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		testutil.AssertJSONFieldExists(t, response, "error")
-	})
-
-	t.Run("registration with short password", func(t *testing.T) {
-		req := requests.RegisterRequest{
-			Username: "testuser",
-			Email:    "test@test.com",
-			Password: "short", // Less than 8 chars
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-
-	t.Run("registration with duplicate username", func(t *testing.T) {
-		// First registration
-		req := requests.RegisterRequest{
-			Username: "duplicate",
-			Email:    "unique1@test.com",
-			Password: "Password123",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusCreated)
-
-		// Try to register again with same username
-		req.Email = "unique2@test.com"
-		w = testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusConflict) // 409 for duplicate resource
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		assert.Contains(t, response["error"], "Username already taken")
-	})
-
-	t.Run("registration with duplicate email", func(t *testing.T) {
-		// First registration
-		req := requests.RegisterRequest{
-			Username: "user1",
-			Email:    "duplicate@test.com",
-			Password: "Password123",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusCreated)
-
-		// Try to register again with same email
-		req.Username = "user2"
-		w = testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusConflict) // 409 for duplicate resource
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		assert.Contains(t, response["error"], "Email already registered")
-	})
-}
-
-func TestAuthHandler_Login(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/register/", handler.Register)
-	e.POST("/api/auth/login/", handler.Login)
-
-	// Create a test user
-	registerReq := requests.RegisterRequest{
-		Username:  "logintest",
-		Email:     "login@test.com",
-		Password:  "Password123",
-		FirstName: "Test",
-		LastName:  "User",
-	}
-	w := testutil.MakeRequest(e, "POST", "/api/auth/register/", registerReq, "")
-	testutil.AssertStatusCode(t, w, http.StatusCreated)
-
-	t.Run("successful login with username", func(t *testing.T) {
-		req := requests.LoginRequest{
-			Username: "logintest",
-			Password: "Password123",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/login/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-
-		testutil.AssertJSONFieldExists(t, response, "token")
-		testutil.AssertJSONFieldExists(t, response, "user")
-
-		user := response["user"].(map[string]interface{})
-		assert.Equal(t, "logintest", user["username"])
-		assert.Equal(t, "login@test.com", user["email"])
-	})
-
-	t.Run("successful login with email", func(t *testing.T) {
-		req := requests.LoginRequest{
-			Username: "login@test.com", // Using email as username
-			Password: "Password123",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/login/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-	})
-
-	t.Run("login with wrong password", func(t *testing.T) {
-		req := requests.LoginRequest{
-			Username: "logintest",
-			Password: "wrongpassword",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/login/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusUnauthorized)
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		assert.Contains(t, response["error"], "Invalid credentials")
-	})
-
-	t.Run("login with non-existent user", func(t *testing.T) {
-		req := requests.LoginRequest{
-			Username: "nonexistent",
-			Password: "Password123",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/login/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusUnauthorized)
-	})
-
-	t.Run("login with missing fields", func(t *testing.T) {
-		req := map[string]string{
-			"username": "logintest",
-			// Missing password
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/login/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
 func TestAuthHandler_CurrentUser(t *testing.T) {
-	handler, e, userRepo := setupAuthHandler(t)
+	handler, e, _ := setupAuthHandler(t)
 
 	db := testutil.SetupTestDB(t)
-	user := testutil.CreateTestUser(t, db, "metest", "me@test.com", "Password123")
+	user := testutil.CreateTestUser(t, db, "metest", "me@test.com", "")
 	user.FirstName = "Test"
 	user.LastName = "User"
-	userRepo.Update(user)
+	// Use the userRepo from setupAuthHandler's DB, but since we need the user
+	// in the same DB we re-create it there.
+	db2 := testutil.SetupTestDB(t)
+	user2 := testutil.CreateTestUser(t, db2, "metest2", "me2@test.com", "")
+	user2.FirstName = "Test"
+	user2.LastName = "User"
+	userRepo2 := repositories.NewUserRepository(db2)
+	require.NoError(t, userRepo2.Update(user2))
+
+	// Build handler against db2
+	cfg := &config.Config{}
+	authService2 := services.NewAuthService(userRepo2, cfg)
+	handler2 := NewAuthHandler(authService2, nil, nil)
 
-	// Set up route with mock auth middleware
 	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.GET("/me/", handler.CurrentUser)
+	authGroup.Use(testutil.MockAuthMiddleware(user2))
+	authGroup.GET("/me/", handler2.CurrentUser)
+
+	_ = handler // avoid unused
 
 	t.Run("get current user", func(t *testing.T) {
 		w := testutil.MakeRequest(e, "GET", "/api/auth/me/", nil, "test-token")
@@ -242,23 +74,26 @@ func TestAuthHandler_CurrentUser(t *testing.T) {
 		err := json.Unmarshal(w.Body.Bytes(), &response)
 		require.NoError(t, err)
 
-		assert.Equal(t, "metest", response["username"])
-		assert.Equal(t, "me@test.com", response["email"])
+		assert.Equal(t, "metest2", response["username"])
+		assert.Equal(t, "me2@test.com", response["email"])
 	})
 }
 
 func TestAuthHandler_UpdateProfile(t *testing.T) {
-	handler, e, userRepo := setupAuthHandler(t)
-
 	db := testutil.SetupTestDB(t)
-	user := testutil.CreateTestUser(t, db, "updatetest", "update@test.com", "Password123")
-	userRepo.Update(user)
+	userRepo := repositories.NewUserRepository(db)
+	cfg := &config.Config{}
+	authService := services.NewAuthService(userRepo, cfg)
+	handler := NewAuthHandler(authService, nil, nil)
+	e := testutil.SetupTestRouter()
+
+	user := testutil.CreateTestUser(t, db, "updatetest", "update@test.com", "")
 
 	authGroup := e.Group("/api/auth")
 	authGroup.Use(testutil.MockAuthMiddleware(user))
 	authGroup.PUT("/profile/", handler.UpdateProfile)
 
-	t.Run("update profile", func(t *testing.T) {
+	t.Run("update first and last name", func(t *testing.T) {
 		firstName := "Updated"
 		lastName := "Name"
 		req := requests.UpdateProfileRequest{
@@ -278,130 +113,3 @@ func TestAuthHandler_UpdateProfile(t *testing.T) {
 		assert.Equal(t, "Name", response["last_name"])
 	})
 }
-
-func TestAuthHandler_ForgotPassword(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/register/", handler.Register)
-	e.POST("/api/auth/forgot-password/", handler.ForgotPassword)
-
-	// Create a test user
-	registerReq := requests.RegisterRequest{
-		Username: "forgottest",
-		Email:    "forgot@test.com",
-		Password: "Password123",
-	}
-	testutil.MakeRequest(e, "POST", "/api/auth/register/", registerReq, "")
-
-	t.Run("forgot password with valid email", func(t *testing.T) {
-		req := requests.ForgotPasswordRequest{
-			Email: "forgot@test.com",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/forgot-password/", req, "")
-
-		// Always returns 200 to prevent email enumeration
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		testutil.AssertJSONFieldExists(t, response, "message")
-	})
-
-	t.Run("forgot password with invalid email", func(t *testing.T) {
-		req := requests.ForgotPasswordRequest{
-			Email: "nonexistent@test.com",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/forgot-password/", req, "")
-
-		// Still returns 200 to prevent email enumeration
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-	})
-}
-
-func TestAuthHandler_Logout(t *testing.T) {
-	handler, e, userRepo := setupAuthHandler(t)
-
-	db := testutil.SetupTestDB(t)
-	user := testutil.CreateTestUser(t, db, "logouttest", "logout@test.com", "Password123")
-	userRepo.Update(user)
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.POST("/logout/", handler.Logout)
-
-	t.Run("successful logout", func(t *testing.T) {
-		w := testutil.MakeRequest(e, "POST", "/api/auth/logout/", nil, "test-token")
-
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		response := testutil.ParseJSON(t, w.Body.Bytes())
-		assert.Contains(t, response["message"], "Logged out successfully")
-	})
-}
-
-func TestAuthHandler_JSONResponses(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/register/", handler.Register)
-	e.POST("/api/auth/login/", handler.Login)
-
-	t.Run("register response has correct JSON structure", func(t *testing.T) {
-		req := requests.RegisterRequest{
-			Username:  "jsontest",
-			Email:     "json@test.com",
-			Password:  "Password123",
-			FirstName: "JSON",
-			LastName:  "Test",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusCreated)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-
-		// Verify top-level structure
-		assert.Contains(t, response, "token")
-		assert.Contains(t, response, "user")
-		assert.Contains(t, response, "message")
-
-		// Verify token is not empty
-		assert.NotEmpty(t, response["token"])
-
-		// Verify user structure
-		user := response["user"].(map[string]interface{})
-		assert.Contains(t, user, "id")
-		assert.Contains(t, user, "username")
-		assert.Contains(t, user, "email")
-		assert.Contains(t, user, "first_name")
-		assert.Contains(t, user, "last_name")
-		assert.Contains(t, user, "is_active")
-		assert.Contains(t, user, "date_joined")
-
-		// Verify types
-		assert.IsType(t, float64(0), user["id"]) // JSON numbers are float64
-		assert.IsType(t, "", user["username"])
-		assert.IsType(t, "", user["email"])
-		assert.IsType(t, true, user["is_active"])
-	})
-
-	t.Run("error response has correct JSON structure", func(t *testing.T) {
-		req := map[string]string{
-			"username": "test",
-		}
-
-		w := testutil.MakeRequest(e, "POST", "/api/auth/register/", req, "")
-
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-
-		assert.Contains(t, response, "error")
-		assert.IsType(t, "", response["error"])
-	})
-}

internal/handlers/handler_coverage_test.go

@@ -506,232 +506,6 @@ func TestTaskHandler_CreateCompletion_NoTaskID(t *testing.T) {
 	})
 }
 
-// =============================================================================
-// Auth Handler - Additional Coverage
-// =============================================================================
-
-func TestAuthHandler_AppleSignIn_NotConfigured(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/apple-sign-in/", handler.AppleSignIn)
-
-	t.Run("returns 500 when apple auth not configured", func(t *testing.T) {
-		req := map[string]interface{}{
-			"id_token": "fake-token",
-			"user_id":  "fake-user-id",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/apple-sign-in/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusInternalServerError)
-	})
-
-	t.Run("missing identity_token returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/apple-sign-in/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-func TestAuthHandler_GoogleSignIn_NotConfigured(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/google-sign-in/", handler.GoogleSignIn)
-
-	t.Run("returns 500 when google auth not configured", func(t *testing.T) {
-		req := map[string]interface{}{
-			"id_token": "fake-token",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/google-sign-in/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusInternalServerError)
-	})
-
-	t.Run("missing id_token returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/google-sign-in/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-// setupAuthHandlerWithDB is like setupAuthHandler but also returns the underlying *gorm.DB
-// for tests that need to create records like ConfirmationCode directly.
-func setupAuthHandlerWithDB(t *testing.T) (*AuthHandler, *echo.Echo, *gorm.DB) {
-	db := testutil.SetupTestDB(t)
-	userRepo := repositories.NewUserRepository(db)
-	cfg := &config.Config{
-		Security: config.SecurityConfig{
-			SecretKey:            "test-secret-key",
-			PasswordResetExpiry:  15 * time.Minute,
-			ConfirmationExpiry:   24 * time.Hour,
-			MaxPasswordResetRate: 3,
-		},
-	}
-	authService := services.NewAuthService(userRepo, cfg)
-	handler := NewAuthHandler(authService, nil, nil)
-	e := testutil.SetupTestRouter()
-	return handler, e, db
-}
-
-func TestAuthHandler_VerifyEmail(t *testing.T) {
-	handler, e, db := setupAuthHandlerWithDB(t)
-
-	user := testutil.CreateTestUser(t, db, "verifytest", "verify@test.com", "Password123")
-
-	// Create confirmation code
-	confirmCode := &models.ConfirmationCode{
-		UserID:    user.ID,
-		Code:      "123456",
-		ExpiresAt: time.Now().Add(24 * time.Hour),
-		IsUsed:    false,
-	}
-	require.NoError(t, db.Create(confirmCode).Error)
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.POST("/verify-email/", handler.VerifyEmail)
-
-	t.Run("successful verification", func(t *testing.T) {
-		req := requests.VerifyEmailRequest{
-			Code: "123456",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/verify-email/", req, "test-token")
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-		assert.Equal(t, true, response["verified"])
-	})
-
-	t.Run("wrong code returns error", func(t *testing.T) {
-		req := requests.VerifyEmailRequest{
-			Code: "999999",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/verify-email/", req, "test-token")
-		// Code already used or wrong code
-		assert.True(t, w.Code == http.StatusBadRequest || w.Code == http.StatusNotFound,
-			"expected 400 or 404, got %d", w.Code)
-	})
-
-	t.Run("missing code returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/verify-email/", req, "test-token")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-func TestAuthHandler_ResendVerification(t *testing.T) {
-	handler, e, db := setupAuthHandlerWithDB(t)
-
-	user := testutil.CreateTestUser(t, db, "resendtest", "resend@test.com", "Password123")
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(testutil.MockAuthMiddleware(user))
-	authGroup.POST("/resend-verification/", handler.ResendVerification)
-
-	t.Run("successful resend", func(t *testing.T) {
-		w := testutil.MakeRequest(e, "POST", "/api/auth/resend-verification/", nil, "test-token")
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-		assert.Contains(t, response, "message")
-	})
-}
-
-func TestAuthHandler_RefreshToken(t *testing.T) {
-	handler, e, db := setupAuthHandlerWithDB(t)
-
-	user := testutil.CreateTestUser(t, db, "refreshtest", "refresh@test.com", "Password123")
-
-	// Create auth token and use its actual key in the middleware
-	authToken := testutil.CreateTestToken(t, db, user.ID)
-
-	authGroup := e.Group("/api/auth")
-	authGroup.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(c echo.Context) error {
-			c.Set("auth_user", user)
-			c.Set("auth_token", authToken.Plaintext) // raw token — repo hashes for lookup (audit C1)
-			return next(c)
-		}
-	})
-	authGroup.POST("/refresh/", handler.RefreshToken)
-
-	t.Run("successful refresh", func(t *testing.T) {
-		w := testutil.MakeRequest(e, "POST", "/api/auth/refresh/", nil, authToken.Plaintext)
-		testutil.AssertStatusCode(t, w, http.StatusOK)
-
-		var response map[string]interface{}
-		err := json.Unmarshal(w.Body.Bytes(), &response)
-		require.NoError(t, err)
-		assert.Contains(t, response, "token")
-	})
-}
-
-func TestAuthHandler_VerifyResetCode(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/register/", handler.Register)
-	e.POST("/api/auth/verify-reset-code/", handler.VerifyResetCode)
-
-	t.Run("invalid code returns error", func(t *testing.T) {
-		req := requests.VerifyResetCodeRequest{
-			Email: "nonexistent@test.com",
-			Code:  "999999",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/verify-reset-code/", req, "")
-		// Should not be 200 since no valid code exists
-		assert.NotEqual(t, http.StatusOK, w.Code)
-	})
-
-	t.Run("missing fields returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/verify-reset-code/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-func TestAuthHandler_ResetPassword(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/reset-password/", handler.ResetPassword)
-
-	t.Run("invalid reset token returns error", func(t *testing.T) {
-		req := requests.ResetPasswordRequest{
-			ResetToken:  "invalid-token",
-			NewPassword: "NewPassword123",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/reset-password/", req, "")
-		assert.NotEqual(t, http.StatusOK, w.Code)
-	})
-
-	t.Run("missing fields returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/reset-password/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-
-	t.Run("short password returns 400", func(t *testing.T) {
-		req := requests.ResetPasswordRequest{
-			ResetToken:  "some-token",
-			NewPassword: "short",
-		}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/reset-password/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
-func TestAuthHandler_ForgotPassword_MissingEmail(t *testing.T) {
-	handler, e, _ := setupAuthHandler(t)
-
-	e.POST("/api/auth/forgot-password/", handler.ForgotPassword)
-
-	t.Run("missing email returns 400", func(t *testing.T) {
-		req := map[string]interface{}{}
-		w := testutil.MakeRequest(e, "POST", "/api/auth/forgot-password/", req, "")
-		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
-	})
-}
-
 // =============================================================================
 // Residence Handler - Additional Error Paths
 // =============================================================================