TDD WORKFLOW FOR AUTH MODULE:

1. TEST LAYER DESIGN
   Start with test names that express behavior, not implementation:
   • describe('UserAuthService', () => {)
   • it('rejects login with invalid email format')
   • it('hashes password before storage using bcrypt')
   • it('expires session token after 24 hours')
   • it('throws specific error for locked account')

2. RED PHASE - Write failing tests first
   Define the exact contract your auth module must fulfill before touching implementation code. Test names should read like requirements.

3. GREEN PHASE - Minimal implementation
   Add only the code needed to pass tests. Skip validation logic, error paths, and edge cases not yet tested.

4. REFACTOR PHASE - Improve without changing behavior
   Reduce duplication between tests. Extract test fixtures. Move mock setup to beforeEach blocks.

5. COVERAGE CHECKLIST
   Root cause bugs by testing inverted assumptions: test that password comparison fails with wrong hash, test that token expiry actually rejects expired tokens, not just accepts valid ones.

Priority sequence: auth happy path → security constraints → error messages → rate limiting.