test(app): unit tests for repository layer, crypto/cloudFront utils and session services

[devin-ai-integration]

Description

Coverage analysis of packages/app showed the repository layer was the weakest area by far (35.5% statements), with utils at 74.77% and parts of services untested. This PR adds unit tests for those modules; no production code changed.

App coverage (statements): 81.3% → 89.45%; repositories 35.5% → 100%; utils 74.77% → 86.28%; services 82.19% → 85.61%.

New tests (16 files) mock Mongoose models with a chainable query stub, so they assert both the returned value and the exact query/aggregation pipeline built:

const query = { select, session, sort, skip, limit, then: (res, rej) => Promise.resolve(result).then(res, rej) };
// each chain method returns `query`

Covered: repositories/ base CRUD + soft delete, users, images (incl. CloudFront signing/invalidation), keys, request, contactus, rewards, rewardTransactions, milestoneConfig, subscriptions, userSession, usertoken; services/userSession (session id generation, UA parsing, 7-day expiry, 5-session cap) and services/passwordReset; utils/crypto (AES-256-GCM round trips, tampered tag and wrong-key rejection) and utils/cloudFront.

It also fixes a pre-existing leak in 9 existing controller suites (milestones, rewards): they mock validateSession with session objects that have no lastActiveAt, so the auth middleware's fire-and-forget userSessionService.touchSession() hit a real, unconnected Mongoose model and logged a usersessions.findOneAndUpdate() buffering timed out error after teardown. That made jest exit 1 even with every suite passing — i.e. the pre-commit hook failed on a clean checkout. Those suites now stub touchSession, and pnpm --filter app test exits 0 (88 suites, 772 tests).

What type of PR is this? (Check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📄 Documentation Update
• 👨‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🛠️ CI/CD

Screenshots (if applicable)

N/A

Checklist

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Link to Devin session: https://app.devin.ai/sessions/1cafa20b6a42458f86ca66f8e5b6d3ae
Requested by: @sunnykgupta

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openlogo-prod-web	Ready	Preview	Aug 26, 2026 6:37am
openlogo-staging-web	Ready	Preview	Aug 26, 2026 6:37am

[github-actions]

No linked issues found. Please add the corresponding issues in the pull request description.
Use GitHub automation to close the issue when a PR is merged

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud