Authentication

Verify that new users can successfully create an account using email registration. This is a critical flow as it is the entry point for all new customers and store owners into the platform.

Verify that existing users can log in with valid credentials. This is a critical flow that gates access to all authenticated features of the platform. Successful login returns JWT tokens for authentication.

Verify that users can sign in or register using their Google account. This flow handles both new user creation and existing user login via OAuth.

Verify the complete password reset flow: requesting a reset link, receiving the email, and setting a new password. This is essential for account recovery.

Verify that users can confirm their email address using the verification link sent during registration. Email verification is required before users can create a store.

Verify JWT token-based session management including token refresh and logout functionality. Tests the complete session lifecycle.

Verify that the system properly rejects login attempts with incorrect credentials and provides appropriate feedback without revealing which field is wrong (security best practice).

Verify that the system prevents creating multiple accounts with the same email address.

Verify that expired verification/reset tokens are properly rejected with a helpful message guiding users to request a new one.

Verify that users can request a new verification email if the original was not received or expired.

Verify that unauthenticated users cannot access protected routes and are redirected to login.