auto(agent): enhance address change request and verification tests with edge cases

backend/src/__tests__/addresses.test.js

@@ -89,4 +89,79 @@ test('POST /addresses/verify - invalid verification code', async () => {
   assert.strictEqual(res.status, 400);
   const data = await res.json();
   assert.ok(data.error);
+});
+
+test('POST /addresses/change-request - no existing address', async () => {
+  // Ensure no existing address for this user
+  await pool.query(
+    `DELETE FROM addresses WHERE user_id = ?`,
+    [mockUser.userId]
+  );
+
+  const req = createTestRequest('/addresses/change-request', 'POST', {
+    newAddress: 'New Address'
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 400);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - request not found', async () => {
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 999,
+    code: '123456'
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 404);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - wrong user', async () => {
+  // Mock a change request first
+  const code = '123456';
+  const codeHash = 'hashed_code';
+  await pool.query(
+    `INSERT INTO address_change_requests (user_id, new_address_encrypted, verification_code_hash, status)
+     VALUES (?, ?, ?, 'pending_letter')`,
+    [999, encryptText('New Address'), codeHash] // Different user ID
+  );
+
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 1,
+    code
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 403);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - request not pending', async () => {
+  // Mock a change request first with status 'verified'
+  const code = '123456';
+  const codeHash = 'hashed_code';
+  await pool.query(
+    `INSERT INTO address_change_requests (user_id, new_address_encrypted, verification_code_hash, status)
+     VALUES (?, ?, ?, 'verified')`,
+    [mockUser.userId, encryptText('New Address'), codeHash]
+  );
+
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 1,
+    code
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 409);
+  const data = await res.json();
+  assert.ok(data.error);
 });

docs/runtime/pick_next_task_state.env

@@ -1,2 +1,2 @@
-LAST_ROUTE=reviews.js
-UPDATED_AT=2026-03-06T20:37:06Z
+LAST_ROUTE=addresses.js
+UPDATED_AT=2026-03-06T20:38:06Z