From dd79dbc90b5bd4a4620e171e8b608d97a5ca1b98 Mon Sep 17 00:00:00 2001
From: Vlad Stan <stan.v.vlad@gmail.com>
Date: Wed, 4 Feb 2026 13:57:46 +0200
Subject: [PATCH] test: invalid code, reusable code

---
 tests/api/test_auth.py | 65 ++++++++++++++++++++++++++++++++++++++++++
 tests/conftest.py      |  1 +
 2 files changed, 66 insertions(+)

diff --git a/tests/api/test_auth.py b/tests/api/test_auth.py
index cf50e575a..90d11a9fc 100644
--- a/tests/api/test_auth.py
+++ b/tests/api/test_auth.py
@@ -333,6 +333,71 @@ async def test_register_no_activation_code(
     assert response.json().get("detail") == "Invitation code cannot be empty."
 
 
+@pytest.mark.anyio
+async def test_register_invalid_activation_code(
+    http_client: AsyncClient, settings: Settings
+):
+    settings.lnbits_require_user_activation = True
+    settings.lnbits_user_activation_by_invitation_code = True
+    settings.lnbits_register_reusable_activation_code = "foo"
+    settings.lnbits_register_one_time_activation_codes = ["baz", "qux"]
+
+    tiny_id = shortuuid.uuid()[:8]
+    response = await http_client.post(
+        "/api/v1/auth/register",
+        json={
+            "username": f"u21.{tiny_id}",
+            "password": "secret1234",
+            "password_repeat": "secret1234",
+            "email": f"u21.{tiny_id}@lnbits.com",
+            "invitation_code": "bar",
+        },
+    )
+
+    assert response.status_code == 400
+    assert response.json().get("detail") == "Invalid invitation code."
+
+
+@pytest.mark.anyio
+async def test_register_reusable_activation_code(
+    http_client: AsyncClient, settings: Settings
+):
+    settings.lnbits_require_user_activation = True
+    settings.lnbits_user_activation_by_invitation_code = True
+    settings.lnbits_register_reusable_activation_code = "foo"
+
+    tiny_id = shortuuid.uuid()[:8]
+    response = await http_client.post(
+        "/api/v1/auth/register",
+        json={
+            "username": f"u21.{tiny_id}",
+            "password": "secret1234",
+            "password_repeat": "secret1234",
+            "email": f"u21.{tiny_id}@lnbits.com",
+            "invitation_code": "foo",
+        },
+    )
+
+    assert response.status_code == 200, "User created with reusable code."
+    assert response.json().get("access_token") is not None
+
+    # Register again with the same code
+    tiny_id = shortuuid.uuid()[:8]
+    response = await http_client.post(
+        "/api/v1/auth/register",
+        json={
+            "username": f"u21.{tiny_id}",
+            "password": "secret1234",
+            "password_repeat": "secret1234",
+            "email": f"u21.{tiny_id}@lnbits.com",
+            "invitation_code": "foo",
+        },
+    )
+
+    assert response.status_code == 200, "User created with reusable code."
+    assert response.json().get("access_token") is not None
+
+
 @pytest.mark.anyio
 async def test_register_email_twice(http_client: AsyncClient):
     tiny_id = shortuuid.uuid()[:8]
diff --git a/tests/conftest.py b/tests/conftest.py
index a677a225b..889e9b533 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -343,3 +343,4 @@ def _settings_cleanup(settings: Settings):
     settings.stripe_limits = FiatProviderLimits()
     settings.lnbits_require_user_activation = False
     settings.lnbits_user_activation_by_invitation_code = False
+    settings.lnbits_register_one_time_activation_codes = []