Unit Tests

@repo/auth, apps/web, and @repo/database have co-located *.test.{ts,tsx} files. pnpm test (turbo test) runs those three. Setup CLI tests are pnpm test:cli (root vitest.config.mts → scripts/**/*.test.ts) and are not in the turbo graph.

Other test files

File	Tests	Covers
`packages/auth/billing-authorize.test.ts`	22	`isOrgMember`, `canManageBilling`, `authorizeBillingAction` — the allow/deny matrix from Billing Authorization across member/admin/owner roles, plus the unknown-action fallback
`packages/auth/helpers.test.ts`	21	`isSubscriptionPendingCancel`, `isAlreadyCancelingError`, `isSubscriptionActive` across all 8 Stripe subscription statuses, `getCurrentPlan`, and `getStatusDisplayText`
`packages/auth/admin-bootstrap.test.ts`	7	`isBootstrapAdminEmail` — the `ADMIN_EMAILS` bootstrap allowlist (case-insensitivity, CSV parsing with spaces, partial-match rejection, empty/undefined list)
`packages/auth/ba-i18n.test.ts`	9	`baErrorTranslations`, `localeFromPathname`, `localeFromReferer` — Better Auth error-code localization and locale-detection helpers
`packages/auth/two-factor-hooks.test.ts`	2	TOTP secret rotation — a re-issued secret stays unusable for sign-in until verified, then activates once the user proves possession in session
`packages/auth/server-wiring.test.ts`	1	The shipped `auth` instance registers `twoFactorAfterHook` — the rotation fix is one deletable line in `server.ts`, and no other test builds the shipped instance
`apps/web/lib/routes.test.ts`	13	`orgRoutes`, `accountRoutes`, `resolveCallbackUrl`, and the `AUTH_ROUTE_PREFIXES`/`PUBLIC_ROUTE_EXACT`/`PUBLIC_ROUTE_PREFIXES` middleware allowlists
`apps/web/lib/parsers.test.ts`	5	`sortingStateParser` (table sort-state URL serialization)
`apps/web/app/[locale]/(app)/admin/users/guards.test.ts`	3	`guardUserMutation` — blocks self-targeting admin mutations, allows the same mutation against another user, always allows revoke-sessions
`apps/web/hooks/use-action-result.test.ts`	15	`useActionResult` — idle-state skip, success/error dispatch, silence on `fieldErrors`-only failures, and the replay guard under StrictMode
`apps/web/lib/auth/action-error.test.ts`	6	`toActionError`, `actionError` — server-action error normalization and i18n fallback
`apps/web/lib/billing/checkout-queries.test.ts`	9	`verifyCheckoutSession` — the independent post-checkout verification described in Subscribe & Checkout
`apps/web/lib/seo-config.test.ts`	2	Site config carries no kit branding and derives the name from `NEXT_PUBLIC_APP_NAME`
`packages/database/redact.test.ts`	10	`argShape` — redacts tokens, passwords, emails, and nested Prisma args so query logs stay diagnosable

Auth Permissions — 21 tests

`packages/auth/permissions.test.ts`

Tests the dual RBAC system (platform-level admin roles + organization-scoped roles) via canOrg, canAdmin, and isAdminAreaRole.

Organization team permissions — 3 tests

#	Test Case
1	Owner should be able to create, update, and delete teams
2	Admin should be able to create, update, and delete teams
3	Member should not be able to manage teams

canOrg — 7 tests

#	Test Case
4	Should gate `organization:update` to owner and admin only
5	Should allow only the owner to delete the organization
6	Should require every action listed for a resource
7	Should require every resource listed
8	Should deny an unknown resource rather than throwing
9	Should deny an unknown role rather than throwing
10	Should grant when any role in a comma-separated list allows it

canAdmin — 8 tests

#	Test Case
11	Should grant every user/session mutation to admin
12	Should deny every user/session mutation to moderator
13	Should deny every user/session mutation to user
14	Should deny `impersonate-admins` even to admin
15	Should let admin read organizations and moderator read but not delete
16	Should treat null/undefined/empty role as the default user role
17	Should OR across a comma-separated role list
18	Should deny an unknown role or resource rather than throwing

isAdminAreaRole — 3 tests

#	Test Case
19	Should admit admin and moderator, reject user
20	Should reject null, undefined, and empty as non-staff
21	Should admit a comma-separated list containing a staff role

Coverage Gaps

Package	Config	Tests	Suggested Test Areas
`storage`	none	0	No vitest config at all — quota validation, MIME checking, provider logic
`utils`	none	0	Slug generation/validation, date helpers, payment utils

High-Value Unit Test Candidates

These are pure functions with no external dependencies — ideal for unit testing:

Function	Location	Why
`getPlanLimits()`	`packages/auth/plans.ts`	Core billing logic, multiple plan tiers
`isPlanHigherTier()`	`packages/auth/plans.ts`	Upgrade/downgrade decisions
`getAnnualSavingsPercent()`	`packages/auth/plans.ts`	Pricing display
`checkOrgCreationEligibility()`	`packages/utils/payment.ts`	Org creation eligibility
`generateSlug()`	`packages/utils/slug.ts`	Used across org creation
`slugSchema`	`packages/utils/slug.ts`	Reserved slug validation

Running Unit Tests

pnpm test
pnpm test:cli
pnpm --filter app test
pnpm --filter @repo/database test
pnpm --filter @repo/auth test -- --watch
pnpm --filter @repo/auth test -- --testNamePattern "canOrg"

On this page