Backend and frontend testing stacks (pytest + vitest) and a few initial tests.

backend/apps/accounts/tests/test_otp_limits.py

@@ -0,0 +1,13 @@
+import pytest
+from django.test import override_settings
+
+from apps.accounts.models import OtpChannel
+from apps.accounts.services.otp import OtpRateLimitError, create_and_send_otp
+
+
+@pytest.mark.django_db
+@override_settings(OTP_MAX_PER_WINDOW=1, OTP_WINDOW_MINUTES=15, OTP_RESEND_COOLDOWN_SECONDS=0)
+def test_otp_rate_limit():
+    create_and_send_otp("+966512345678", OtpChannel.SMS)
+    with pytest.raises(OtpRateLimitError):
+        create_and_send_otp("+966512345678", OtpChannel.SMS)

backend/apps/accounts/tests/test_phone.py

@@ -0,0 +1,21 @@
+import pytest
+
+from apps.accounts.services.phone import normalize_phone_number
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        ("+966512345678", "+966512345678"),
+        ("0512345678", "+966512345678"),
+        ("512345678", "+966512345678"),
+        ("00966512345678", "+966512345678"),
+    ],
+)
+def test_normalize_phone_number_valid(raw, expected):
+    assert normalize_phone_number(raw) == expected
+
+
+def test_normalize_phone_number_invalid():
+    with pytest.raises(ValueError):
+        normalize_phone_number("12345")

backend/apps/accounts/tests/test_phone_auth.py

@@ -0,0 +1,31 @@
+import pytest
+from django.urls import reverse
+
+from apps.accounts.models import PhoneOTP, User
+
+
+@pytest.mark.django_db
+def test_phone_auth_creates_user_and_issues_tokens(client):
+    request_url = reverse("phone_auth_request")
+    verify_url = reverse("phone_auth_verify")
+
+    response = client.post(
+        request_url,
+        {"phone_number": "0512345678", "channel": "sms", "first_name": "Sara"},
+        content_type="application/json",
+    )
+    assert response.status_code == 201
+    request_id = response.json()["request_id"]
+
+    otp = PhoneOTP.objects.filter(phone_number="+966512345678").order_by("-created_at").first()
+    assert otp is not None
+    assert str(otp.id) == request_id
+
+    bad = client.post(
+        verify_url,
+        {"request_id": request_id, "code": "000000"},
+        content_type="application/json",
+    )
+    assert bad.status_code == 400
+
+    assert User.objects.filter(phone_number="+966512345678").exists()