From bfb14dccdd11b4521dc166dc38beddc545f036ec Mon Sep 17 00:00:00 2001
From: OpenClaw <openclaw@example.com>
Date: Fri, 6 Mar 2026 20:38:57 +0000
Subject: [PATCH] auto(agent): enhance address change request and verification
 tests with edge cases

---
 backend/src/__tests__/addresses.test.js | 75 +++++++++++++++++++++++++
 docs/runtime/pick_next_task_state.env   |  4 +-
 2 files changed, 77 insertions(+), 2 deletions(-)

diff --git a/backend/src/__tests__/addresses.test.js b/backend/src/__tests__/addresses.test.js
index 8f63329..8986916 100644
--- a/backend/src/__tests__/addresses.test.js
+++ b/backend/src/__tests__/addresses.test.js
@@ -89,4 +89,79 @@ test('POST /addresses/verify - invalid verification code', async () => {
   assert.strictEqual(res.status, 400);
   const data = await res.json();
   assert.ok(data.error);
+});
+
+test('POST /addresses/change-request - no existing address', async () => {
+  // Ensure no existing address for this user
+  await pool.query(
+    `DELETE FROM addresses WHERE user_id = ?`,
+    [mockUser.userId]
+  );
+
+  const req = createTestRequest('/addresses/change-request', 'POST', {
+    newAddress: 'New Address'
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 400);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - request not found', async () => {
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 999,
+    code: '123456'
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 404);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - wrong user', async () => {
+  // Mock a change request first
+  const code = '123456';
+  const codeHash = 'hashed_code';
+  await pool.query(
+    `INSERT INTO address_change_requests (user_id, new_address_encrypted, verification_code_hash, status)
+     VALUES (?, ?, ?, 'pending_letter')`,
+    [999, encryptText('New Address'), codeHash] // Different user ID
+  );
+
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 1,
+    code
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 403);
+  const data = await res.json();
+  assert.ok(data.error);
+});
+
+test('POST /addresses/verify - request not pending', async () => {
+  // Mock a change request first with status 'verified'
+  const code = '123456';
+  const codeHash = 'hashed_code';
+  await pool.query(
+    `INSERT INTO address_change_requests (user_id, new_address_encrypted, verification_code_hash, status)
+     VALUES (?, ?, ?, 'verified')`,
+    [mockUser.userId, encryptText('New Address'), codeHash]
+  );
+
+  const req = createTestRequest('/addresses/verify', 'POST', {
+    requestId: 1,
+    code
+  });
+
+  const res = await app.request(req);
+
+  assert.strictEqual(res.status, 409);
+  const data = await res.json();
+  assert.ok(data.error);
 });
\ No newline at end of file
diff --git a/docs/runtime/pick_next_task_state.env b/docs/runtime/pick_next_task_state.env
index ea168ef..cd78ea9 100644
--- a/docs/runtime/pick_next_task_state.env
+++ b/docs/runtime/pick_next_task_state.env
@@ -1,2 +1,2 @@
-LAST_ROUTE=reviews.js
-UPDATED_AT=2026-03-06T20:37:06Z
+LAST_ROUTE=addresses.js
+UPDATED_AT=2026-03-06T20:38:06Z