From 63625261686463ca3a0b871721fbf0a65142b5f2 Mon Sep 17 00:00:00 2001
From: keshav-005 <keshavchaudhary0005@gmail.com>
Date: Wed, 22 Apr 2026 23:16:01 +0530
Subject: [PATCH] Add password reset email tests

---
 __tests__/reset-password-email.test.ts | 58 ++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 __tests__/reset-password-email.test.ts

diff --git a/__tests__/reset-password-email.test.ts b/__tests__/reset-password-email.test.ts
new file mode 100644
index 0000000..323bd48
--- /dev/null
+++ b/__tests__/reset-password-email.test.ts
@@ -0,0 +1,58 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/nodemailer', () => ({
+    transporter: {
+        sendMail: vi.fn(),
+    },
+}));
+
+import { transporter } from '@/lib/nodemailer';
+import { sendPasswordResetEmail } from '@/lib/nodemailer/reset-password';
+
+describe('sendPasswordResetEmail', () => {
+    const originalEnv = { ...process.env };
+    const sendMailMock = vi.mocked(transporter.sendMail);
+
+    beforeEach(() => {
+        process.env = {
+            ...originalEnv,
+            NODEMAILER_EMAIL: 'sender@example.com',
+            NODEMAILER_PASSWORD: 'secret',
+        };
+        sendMailMock.mockReset();
+        sendMailMock.mockResolvedValue({ messageId: 'msg-123' } as never);
+    });
+
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+
+    it('escapes interpolated values before building the HTML email', async () => {
+        await sendPasswordResetEmail({
+            email: 'user@example.com',
+            name: '<Admin & Co.>',
+            resetUrl: 'https://example.com/reset-password?token=a b&next=<script>',
+        });
+
+        expect(sendMailMock).toHaveBeenCalledTimes(1);
+        const [mailOptions] = sendMailMock.mock.calls[0];
+
+        expect(mailOptions.html).toContain('Hi &lt;Admin,');
+        expect(mailOptions.html).toContain('href="https://example.com/reset-password?token=a%20b&amp;next=%3Cscript%3E"');
+        expect(mailOptions.html).not.toContain('<script>');
+        expect(mailOptions.text).toContain('https://example.com/reset-password?token=a%20b&next=%3Cscript%3E');
+    });
+
+    it('throws when reset email credentials are missing', async () => {
+        delete process.env.NODEMAILER_EMAIL;
+        delete process.env.NODEMAILER_PASSWORD;
+
+        await expect(
+            sendPasswordResetEmail({
+                email: 'user@example.com',
+                name: 'User',
+                resetUrl: 'https://example.com/reset-password?token=test',
+            })
+        ).rejects.toThrow('Email credentials not configured');
+    });
+});