see comments

src/app/api/auth/register/employee/route.ts

@@ -92,8 +92,49 @@ export async function POST(request: Request) {
     });
 
     if (error) {
-      console.error("Supabase Auth Error:", error.message);
-      return NextResponse.json({ error: error.message }, { status: 400 });
+      // Ein Retry nach einem vorherigen Teilausfall (Auth-User wurde bereits
+      // angelegt, aber die anschließende `isOnboarded`-Markierung ist fehlgeschlagen)
+      // darf nicht an "email_exists" scheitern — sonst bleibt der Mitarbeiter
+      // dauerhaft in einem inkonsistenten Zustand hängen. Stattdessen wird der
+      // bereits existierende Auth-User wiederverwendet.
+      const isDuplicateEmail =
+        error.code === "email_exists" || /already been registered/i.test(error.message);
+
+      if (!isDuplicateEmail) {
+        console.error("Supabase Auth Error:", error.message);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+      }
+
+      const { data: existingUsers, error: listError } = await supabase.auth.admin.listUsers();
+      const existingUser = existingUsers?.users.find((u) => u.email === email);
+
+      if (listError || !existingUser) {
+        console.error("Supabase Auth Error:", error.message);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+      }
+
+      // Passwort/Metadaten auf den zuletzt übermittelten Stand bringen, falls der
+      // Mitarbeiter das Formular nach dem vorherigen Teilausfall erneut mit
+      // geänderten Daten abgeschickt hat.
+      const { error: updateError } = await supabase.auth.admin.updateUserById(existingUser.id, {
+        password,
+        email_confirm: true,
+        user_metadata: {
+          firstName,
+          lastName,
+          tel,
+          gender,
+          qualification,
+          role: "employee",
+        },
+      });
+
+      if (updateError) {
+        console.error("Supabase Auth Error:", updateError.message);
+        return NextResponse.json({ error: updateError.message }, { status: 400 });
+      }
+
+      return NextResponse.json({ success: true }, { status: 201 });
     }
 
     if (!data.user) {

tests/api/auth/register-employee.test.ts

@@ -15,7 +15,17 @@ import { createAdminClient } from "@/src/lib/supabase/admin";
 import { prisma } from "@/src/lib/prisma";
 
 const mockCreateUser = vi.fn();
-const mockSupabase = { auth: { admin: { createUser: mockCreateUser } } };
+const mockListUsers = vi.fn();
+const mockUpdateUserById = vi.fn();
+const mockSupabase = {
+  auth: {
+    admin: {
+      createUser: mockCreateUser,
+      listUsers: mockListUsers,
+      updateUserById: mockUpdateUserById,
+    },
+  },
+};
 
 const validToken = "valid-token-abc";
 const validEmployee = {
@@ -24,10 +34,23 @@ const validEmployee = {
   onboardingTokenExpiry: new Date(Date.now() + 3600000),
 };
 
+const validBodyWithExtras = {
+  token: "valid-token-abc",
+  email: "employee@example.com",
+  password: "Sicher!123",
+  firstName: "Anna",
+  lastName: "Schmidt",
+  tel: "0123456789",
+  gender: "female",
+  qualification: "Trainer B-Lizenz",
+};
+
 beforeEach(() => {
   vi.mocked(createAdminClient).mockReturnValue(mockSupabase as never);
   vi.mocked(prisma.employee.findUnique).mockReset();
   mockCreateUser.mockReset();
+  mockListUsers.mockReset();
+  mockUpdateUserById.mockReset();
 });
 
 const validBody = {
@@ -116,9 +139,74 @@ describe("POST /api/auth/register/employee", () => {
       error: null,
     });
 
+    const res = await POST(makeRequest(validBodyWithExtras));
+    expect(res.status).toBe(201);
+    const data = await res.json();
+    expect(data.success).toBe(true);
+
+    expect(mockCreateUser).toHaveBeenCalledWith(
+      expect.objectContaining({
+        email: validBodyWithExtras.email,
+        password: validBodyWithExtras.password,
+        email_confirm: true,
+        user_metadata: expect.objectContaining({
+          firstName: validBodyWithExtras.firstName,
+          lastName: validBodyWithExtras.lastName,
+          tel: validBodyWithExtras.tel,
+          gender: validBodyWithExtras.gender,
+          qualification: validBodyWithExtras.qualification,
+          role: "employee",
+        }),
+      })
+    );
+  });
+
+  it("verwendet den bestehenden Auth-User erneut, wenn dieser bereits existiert (Retry nach Teilausfall)", async () => {
+    vi.mocked(prisma.employee.findUnique).mockResolvedValue(validEmployee as never);
+    mockCreateUser.mockResolvedValue({
+      data: { user: null },
+      error: {
+        code: "email_exists",
+        message: "A user with this email address has already been registered",
+      },
+    });
+    mockListUsers.mockResolvedValue({
+      data: { users: [{ id: "emp-1", email: validBody.email }] },
+      error: null,
+    });
+    mockUpdateUserById.mockResolvedValue({
+      data: { user: { id: "emp-1" } },
+      error: null,
+    });
+
     const res = await POST(makeRequest(validBody));
     expect(res.status).toBe(201);
     const data = await res.json();
     expect(data.success).toBe(true);
+
+    expect(mockUpdateUserById).toHaveBeenCalledWith(
+      "emp-1",
+      expect.objectContaining({
+        password: validBody.password,
+        email_confirm: true,
+        user_metadata: expect.objectContaining({ role: "employee" }),
+      })
+    );
+  });
+
+  it("gibt 400 zurück wenn der Auth-User nach 'email_exists' nicht gefunden wird", async () => {
+    vi.mocked(prisma.employee.findUnique).mockResolvedValue(validEmployee as never);
+    mockCreateUser.mockResolvedValue({
+      data: { user: null },
+      error: {
+        code: "email_exists",
+        message: "A user with this email address has already been registered",
+      },
+    });
+    mockListUsers.mockResolvedValue({ data: { users: [] }, error: null });
+
+    const res = await POST(makeRequest(validBody));
+    expect(res.status).toBe(400);
+    expect(mockUpdateUserById).not.toHaveBeenCalled();
   });
 });