test('user creation flow', async () => {
  // Testing implementation details through integration test
  const result = await request(app)
    .post('/api/users')
    .send({ email: 'test@example.com', name: 'Alice' })

  // Checking database internals
  const dbRecord = await db.query('SELECT * FROM users WHERE email = $1', ['test@example.com'])
  expect(dbRecord.rows[0].password_hash).toMatch(/^\$2b\$/)  // bcrypt format
  expect(dbRecord.rows[0].created_at).toBeDefined()

  // Checking email service internals
  const sentEmails = mockEmailService.getSentEmails()
  expect(sentEmails[0].template).toBe('welcome-v2')
  expect(sentEmails[0].templateVars.activationLink).toMatch(/\/activate\//)
})

describe('POST /api/users', () => {
  it('returns created user with id', async () => {
    const response = await request(app)
      .post('/api/users')
      .send({ email: 'test@example.com', name: 'Alice' })

    // Test API contract, not implementation
    expect(response.status).toBe(201)
    expect(response.body).toMatchObject({
      id: expect.any(String),
      email: 'test@example.com',
      name: 'Alice'
    })
  })

  it('returns 400 for invalid email', async () => {
    const response = await request(app)
      .post('/api/users')
      .send({ email: 'invalid', name: 'Alice' })

    expect(response.status).toBe(400)
    expect(response.body.error).toBeDefined()
  })

  it('returns 409 for duplicate email', async () => {
    await createUser({ email: 'existing@example.com' })

    const response = await request(app)
      .post('/api/users')
      .send({ email: 'existing@example.com', name: 'Bob' })

    expect(response.status).toBe(409)
  })
})