Fix SMS login code flow for phone relay

backend/internal/handler/auth_handler_link_test.go

@@ -6,6 +6,7 @@ import (
 	"baron-sso-backend/internal/testsupport"
 	"bytes"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -150,6 +151,56 @@ func TestEnchantedLinkFlow_Sms_Success(t *testing.T) {
 	assert.NotEmpty(t, initResp["userCode"])
 }
 
+func TestResolveUserfrontURL_DevLocalhostUsesConfiguredPort(t *testing.T) {
+	t.Setenv("APP_ENV", "dev")
+	t.Setenv("USERFRONT_URL", "http://localhost:5000")
+
+	h := &AuthHandler{}
+	app := fiber.New()
+	app.Get("/probe", func(c *fiber.Ctx) error {
+		return c.SendString(h.resolveUserfrontURL(c))
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "http://localhost/probe", nil)
+	resp, _ := app.Test(req, -1)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	body, _ := io.ReadAll(resp.Body)
+	assert.Equal(t, "http://localhost:5000", string(body))
+}
+
+func TestVerifyLoginCode_MapsSmsPhoneBeforeFlowLookup(t *testing.T) {
+	redis := &mockRedisRepo{data: map[string]string{
+		prefixLoginCode + "su-@samaneng.com":          "flow-123",
+		prefixLoginCodePending + "su-@samaneng.com":   "pending-123",
+		prefixLoginCodeSmsLookup + "+821041585840":    "su-@samaneng.com",
+		prefixLoginCodeSmsTarget + "su-@samaneng.com": "+821041585840",
+		prefixLoginCodeValue + "pending-123":          "569765",
+	}}
+	h := &AuthHandler{
+		RedisService: redis,
+		IdpProvider:  &mockIdpProvider{},
+	}
+	app := fiber.New()
+	app.Post("/api/v1/auth/login/code/verify", h.VerifyLoginCode)
+
+	body, _ := json.Marshal(map[string]interface{}{
+		"loginId":    "01041585840",
+		"code":       "569765",
+		"pendingRef": "pending-123",
+		"verifyOnly": true,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, _ := app.Test(req, -1)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	var got map[string]interface{}
+	_ = json.NewDecoder(resp.Body).Decode(&got)
+	assert.Equal(t, "approved", got["status"])
+	assert.Equal(t, "pending-123", got["pendingRef"])
+}
+
 func TestPollEnchantedLink_ExpiredToken_ReturnsCode(t *testing.T) {
 	redis := &mockRedisRepo{data: make(map[string]string)}
 	h := &AuthHandler{