fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

features/request_password_reset.qa.md

@@ -27,6 +27,17 @@ Package: `test` (black-box), extending `test/user_test.go` (`mockUserRepo`, `stu
    can call `stubHasher{}.Compare(repo.users[id].PasswordResetCode, "code-1")` and expect an error,
    then `.Compare(..., secondRawCode)` and expect `nil`.
 
+## Capturing logged failures
+
+8a. `RequestPasswordReset` now logs a hash, store or mail-send failure via the stdlib `log`
+    package instead of only swallowing it. Any scenario that asserts on this redirects the
+    global logger's output for the duration of the call: `var buf bytes.Buffer`,
+    `log.SetOutput(&buf)`, then `t.Cleanup(func() { log.SetOutput(os.Stderr) })` before invoking
+    `RequestPasswordReset`. After the call, assert `buf.String()` is non-empty and contains a
+    substring identifying which failure occurred (e.g. `"hash"`, `"UpdatePasswordResetCode"` /
+    `"store"`, or `"Send"` / `"mail"`) — the exact wording is an implementation detail, only that
+    a line was written and it's distinguishable per failure kind.
+
 ## Setup shared by every case
 
 5. Call `validator.InitValidator()` once.
@@ -61,12 +72,23 @@ Package: `test` (black-box), extending `test/user_test.go` (`mockUserRepo`, `stu
     `nil`. Assert `UpdatePasswordResetCode`'s call counter is still 0. Assert `mailRepo.SentEmails` is
     empty.
 11. Repo pre-populated with user id 3, email "alice@example.com". Set `mailRepo.fail.failNext("Send")`.
-    Call `RequestPasswordReset("alice@example.com")`. Assert the return value is `nil` (not the mail
-    repository's failure). Assert `UpdatePasswordResetCode` was still invoked exactly once (the store
-    happens before the send).
+    Using the log-capture setup from step 8a, call `RequestPasswordReset("alice@example.com")`.
+    Assert the return value is `nil` (not the mail repository's failure). Assert
+    `UpdatePasswordResetCode` was still invoked exactly once (the store happens before the send).
+    Assert the captured log buffer is non-empty and its content identifies a mail-send failure.
 12. Repo pre-populated with two unverified users, "alice" and "bob" (`IsVerified: false`). Call
     `RequestPasswordReset` for alice's email. Assert the return value is `nil` and exactly one email
     was sent, showing IsVerified plays no role in the use case's behavior.
+12a. Repo pre-populated with user id 3, email "alice@example.com". Build the use case with a
+    `stubHasher{hashErr: errStubHashFailure}` so `Hash` fails. Using the log-capture setup from
+    step 8a, call `RequestPasswordReset("alice@example.com")`. Assert the return value is `nil`,
+    `UpdatePasswordResetCode`'s call counter is 0, `mailRepo.SentEmails` is empty, and the captured
+    log buffer is non-empty and identifies a hashing failure.
+12b. Repo pre-populated with user id 3, email "alice@example.com". Set
+    `repo.fail.failNext("UpdatePasswordResetCode")`. Using the log-capture setup from step 8a, call
+    `RequestPasswordReset("alice@example.com")`. Assert the return value is `nil`,
+    `mailRepo.SentEmails` is empty, and the captured log buffer is non-empty and identifies a
+    storage failure.
 
 ## HTTP-level checks (fakes, per the shared setup above)
 
@@ -88,9 +110,10 @@ Package: `test` (black-box), extending `test/user_test.go` (`mockUserRepo`, `stu
     `VerificationCode` data values differ. Assert the repo's stored `PasswordResetCode` no longer
     matches the first email's raw code via `stubHasher{}.Compare` (expect an error) but does match
     the second email's raw code (expect `nil`).
-18. Seed a user "alice", email "alice@example.com". Set `mailRepo.fail.failNext("Send")`.
-    `POST /v1/auth/password-reset` with her email → assert status `200`, body identical to step 13's
-    body, and no `Set-Cookie: jwt=...` header present.
+18. Seed a user "alice", email "alice@example.com". Set `mailRepo.fail.failNext("Send")`. Using the
+    log-capture setup from step 8a, `POST /v1/auth/password-reset` with her email → assert status
+    `200`, body identical to step 13's body, no `Set-Cookie: jwt=...` header present, and the
+    captured log buffer is non-empty and identifies a mail-send failure.
 19. Seed a user "bob", email "bob@example.com", `IsVerified: false`. `POST /v1/auth/password-reset`
     with his email → assert status `200`, body identical to step 13's body, and exactly one email was
     sent to "bob@example.com" with template "passwordReset".