test(otp): prove rejected verify requests never spend the code against real storage

Replace the mock-asserting authorization unit tests with integration cases:
with email auth disabled or the address removed from the allow list, five
requests carrying the correct code are refused without a cookie, and the
code still works once the chat is restored.

Author: waleedlatif1

apps/sim/app/api/chat/[identifier]/otp/route.integration.ts

@@ -7,7 +7,7 @@ import { createMockRequest } from '@sim/testing/mocks/request.mock'
 import { generateId } from '@sim/utils/id'
 import { eq, like } from 'drizzle-orm'
 import Redis from 'ioredis'
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { storage, redisClient } = vi.hoisted(() => ({
   storage: { backend: 'database' as 'database' | 'redis' },
@@ -108,6 +108,35 @@ describe.each(['database', 'redis'] as const)('%s chat OTP verification', (backe
       storage.backend = backend
       await storeOTP('chat', chatId, email, CODE)
     })
+    afterEach(async () => {
+      await db
+        .update(chat)
+        .set({ authType: 'email', allowedEmails: [email] })
+        .where(eq(chat.id, chatId))
+    })
+
+    it.each([
+      {
+        rejection: 'the chat no longer uses email auth',
+        change: { authType: 'public' },
+        response: { status: 400, error: 'This chat does not use email authentication' },
+      },
+      {
+        rejection: 'the email is no longer allowed',
+        change: { allowedEmails: ['someone-else@otp.invalid'] },
+        response: { status: 403, error: 'Email not authorized' },
+      },
+    ])('rejects without spending the code when $rejection', async ({ change, response }) => {
+      await db.update(chat).set(change).where(eq(chat.id, chatId))
+      for (let attempt = 0; attempt < MAX_OTP_ATTEMPTS; attempt++) {
+        expect(await verify(CODE)).toMatchObject({ ...response, cookie: null })
+      }
+      await db
+        .update(chat)
+        .set({ authType: 'email', allowedEmails: [email] })
+        .where(eq(chat.id, chatId))
+      expect(await verify(CODE)).toMatchObject({ status: 200 })
+    })
 
     it('compares at most the attempt limit of guesses however many arrive concurrently', async () => {
       const results = await Promise.all(wrongGuesses(30).map(verify))

apps/sim/app/api/chat/[identifier]/otp/route.test.ts

@@ -24,7 +24,6 @@ import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockRedisSet,
-  mockRedisEval,
   mockRedisClient,
   mockSetChatAuthCookie,
   mockIsEmailAllowed,
@@ -33,10 +32,8 @@ const {
   mockAfterResponse,
 } = vi.hoisted(() => {
   const mockRedisSet = vi.fn()
-  const mockRedisEval = vi.fn()
   const mockRedisClient = {
     set: mockRedisSet,
-    eval: mockRedisEval,
   }
   const mockSetChatAuthCookie = vi.fn()
   const mockIsEmailAllowed = vi.fn((email: string, allowedEmails: string[]) => {
@@ -50,7 +47,6 @@ const {
 
   return {
     mockRedisSet,
-    mockRedisEval,
     mockRedisClient,
     mockSetChatAuthCookie,
     mockIsEmailAllowed,
@@ -127,7 +123,7 @@ vi.mock('zod', () => {
   }
 })
 
-import { PUT, POST as routePost } from './route'
+import { POST as routePost } from './route'
 
 const mockCheckRateLimitDirect = rateLimiterMockFns.mockCheckRateLimitDirect
 const { mockSendEmail } = emailMailerMockFns
@@ -144,7 +140,6 @@ describe('Chat OTP API Route', () => {
   const mockEmail = 'test@example.com'
   const mockChatId = 'chat-123'
   const mockIdentifier = 'test-chat'
-  const mockOTP = '123456'
 
   /** Queues the chat-deployment row the route reads before touching OTP storage. */
   const queueDeployment = (row: Record<string, unknown>) => {
@@ -297,51 +292,4 @@ describe('Chat OTP API Route', () => {
       )
     })
   })
-
-  describe('PUT - Verify OTP (authType re-check)', () => {
-    beforeEach(() => {
-      mockGetStorageMethod.mockReturnValue('redis')
-      mockRedisEval.mockResolvedValue(`${mockOTP}:1`)
-    })
-
-    it('rejects verification when the chat has switched away from email auth', async () => {
-      queueDeployment({
-        id: mockChatId,
-        authType: 'password',
-        password: 'encrypted-password',
-      })
-
-      const request = createMockRequest({
-        method: 'PUT',
-        url: 'http://localhost:3000/api/chat/test/otp',
-        rawBody: JSON.stringify({ email: mockEmail, otp: mockOTP }),
-      })
-
-      await PUT(request, createRouteContext({ identifier: mockIdentifier }))
-
-      expect(mockCreateCodedErrorResponse).toHaveBeenCalledWith(
-        'This chat does not use email authentication',
-        400
-      )
-      expect(mockRedisEval).not.toHaveBeenCalled()
-      expect(mockSetChatAuthCookie).not.toHaveBeenCalled()
-    })
-
-    it('rejects verification when the email is no longer allowed', async () => {
-      mockIsEmailAllowed.mockReturnValueOnce(false)
-      queueDeployment({ id: mockChatId, authType: 'email' })
-
-      const request = createMockRequest({
-        method: 'PUT',
-        url: 'http://localhost:3000/api/chat/test/otp',
-        rawBody: JSON.stringify({ email: mockEmail, otp: mockOTP }),
-      })
-
-      await PUT(request, createRouteContext({ identifier: mockIdentifier }))
-
-      expect(mockCreateCodedErrorResponse).toHaveBeenCalledWith('Email not authorized', 403)
-      expect(mockRedisEval).not.toHaveBeenCalled()
-      expect(mockSetChatAuthCookie).not.toHaveBeenCalled()
-    })
-  })
 })