Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/tests/modules/auth/test_service_refresh.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from unittest.mock import patch
+
+import pytest
+
+from app.core.security import hash_password
+from app.modules.auth import repository as auth_repository
+from app.modules.auth.service import issue_refresh_token, refresh
+from app.modules.users.repository import create_user, get_user_by_id, update_user
+
+
+def test_refresh_returns_account_blocked_for_blocked_user():
+    user = create_user("blocked-svc@example.com", hash_password("Valid123"), status="active")
+    token = issue_refresh_token(user.id)
+    user.status = "blocked"
+    update_user(user)
+    auth_repository.revoke_user_families(user.id)
+
+    with pytest.raises(PermissionError, match="ACCOUNT_BLOCKED"):
+        refresh(token)
+
+
+def test_refresh_returns_email_not_verified_for_pending_user():
+    user = create_user("pending-svc@example.com", hash_password("Valid123"), status="pending")
+    token = issue_refresh_token(user.id)
+
+    with pytest.raises(PermissionError, match="EMAIL_NOT_VERIFIED"):
+        refresh(token)
+
+
+def test_refresh_rejects_revoked_token_for_active_user():
+    user = create_user("active-svc@example.com", hash_password("Valid123"), status="active")
+    token = issue_refresh_token(user.id)
+    auth_repository.revoke_user_families(user.id)
+
+    with patch.object(auth_repository, "revoke_family_tokens") as revoke_family:
+        with pytest.raises(PermissionError, match="INVALID_REFRESH"):
+            refresh(token)
+        revoke_family.assert_called_once()