From 71c845ec8a983243cbcd8915de6363e3015ca449 Mon Sep 17 00:00:00 2001
From: imeepos <imeepos@outlook.com>
Date: Wed, 10 Jun 2026 03:19:32 -0700
Subject: [PATCH] test: cover auth password reset smoke

---
 tests/auth-worker.test.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tests/auth-worker.test.ts b/tests/auth-worker.test.ts
index bad941f..9e9b059 100644
--- a/tests/auth-worker.test.ts
+++ b/tests/auth-worker.test.ts
@@ -62,6 +62,24 @@ describe("cfw-auth worker", () => {
     expect(response.headers.get("access-control-allow-origin")).toBe("http://localhost:8787");
   });
 
+  it("handles password reset requests without exposing account existence", async () => {
+    const response = await worker.fetch(
+      new Request("http://auth.local/api/auth/request-password-reset", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Origin: "http://localhost:8787",
+        },
+        body: JSON.stringify({
+          email: "missing@example.com",
+          redirectTo: "http://localhost:8787/reset-password",
+        }),
+      }),
+      env,
+    );
+    expect([200, 400, 403]).toContain(response.status);
+  });
+
   it("does not route non-GET/POST auth requests to Better Auth", async () => {
     const response = await worker.fetch(
       new Request("http://auth.local/api/auth/session", {