test(api): 인증과 조직 API 테스트 추가

[meteorqz6]

요약

• 인증 API의 signup/login/refresh/logout/me 요청·응답을 Supertest로 검증합니다.
• 조직 API의 인증, 검증 실패, 생성, 중복 생성, 조회, 수정 흐름을 검증합니다.
• 테스트 DB 없이 route/service 흐름을 확인할 수 있도록 in-memory fake Prisma helper를 추가했습니다.

검증

• pnpm test
• pnpm --filter @fragment/api lint
• pnpm --filter @fragment/api typecheck
• pnpm format:check

참고

• 이 PR은 test/infra 위에 쌓인 stacked PR입니다. test/infra 머지 후 develop 기준으로 재정렬할 예정입니다.

[coderabbitai]

Warning

Review limit reached

@meteorqz6, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 42 minutes and 11 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d90eaa34-e8f5-4acb-909e-a1172e7d1418

📥 Commits

Reviewing files that changed from the base of the PR and between 80565cc and e3584cb.

📒 Files selected for processing (4)

• apps/api/test/auth.routes.test.ts
• apps/api/test/helpers/fake-prisma.ts
• apps/api/test/helpers/organization-fixtures.ts
• apps/api/test/organization.routes.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/api-auth-organization

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[meteorqz6]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[ehlung]

테스트 로컬에서 정상 통과했고, 현재 추가된 케이스들도 PR 목적에 맞게 동작하는 것으로 확인했습니다!
아래는 추가 검토해볼만한 사항을 우선순위에 따라 작성했습니다.

이 PR에서 추가 검토해볼만한 사항

• 같은 refresh cookie를 두 번 사용했을 때 두 번째 /api/auth/refresh가 401이 되는지
  • 현재는 refresh 성공만 검증하고 있어, 기존 refresh token이 revoke되어 재사용 불가능한지는 직접 확인하지 않습니다.
  • refresh token rotation은 인증 보안 흐름이라 가능하면 이 PR에서 같이 커버하면 좋겠습니다.

후속으로 추가 검토해볼만한 사항

• /refresh, /logout의 wrong Origin 403
• GET/PATCH /api/organization 미인증 401
• 조직 없는 사용자의 GET/PATCH /api/organization 404