Well, it looks like you can't. The key thing to know is that jest.spyOn is just sugar for the basic jest.fn() usage. We can achieve the same goal by storing the original implementation, setting the mock implementation to to original, and re-assigning the original later:

import * as app from "./app";
import * as math from "./math";

test("calls math.add", () => {
  // store the original implementation
  const originalAdd = math.add;

  // mock add with the original implementation
  math.add = jest.fn(originalAdd);

  // spy the calls to add
  expect(app.doAdd(1, 2)).toEqual(3);
  expect(math.add).toHaveBeenCalledWith(1, 2);

  // override the implementation
  math.add.mockImplementation(() => "mock");
  expect(app.doAdd(1, 2)).toEqual("mock");
  expect(math.add).toHaveBeenCalledWith(1, 2);

  // restore the original implementation
  math.add = originalAdd;
  expect(app.doAdd(1, 2)).toEqual(3);
});

The need for this will be addressed by https://github.com/facebook/jest/issues/6180 When we can conditionally return different values from mocks.

If you look at the jest.spyOn docs you can see this:

Note: By default, jest.spyOn also calls the spied method. This is different behavior from most other test libraries. If you want to overwrite the original function, you can use jest.spyOn(object, methodName).mockImplementation(() => customImplementation) or object[methodName] = jest.fn(() => customImplementation);

So this explains why adding a mock makes your tests pass.

Depending on what version of jest you are running, there is a very useful helper method that you can now use, jest.mocked:

jest.mocked<T>(item: T, deep = false)

In your case you could:

1. Add a mockImplementation to your spyOn:

const spy = jest.spyOn(middleware, 'verifyUser').mockImplementation(jest.fn((req, _res, next) => {
    req.user = {
      id: '1',
      email: '[email protected]',
      fullName: null
    };
    next();
  });

  // ...

2. Remove the spyOn entirely and refactor as follows:

import * as middleware from '../../middlewares/auth.middleware';

jest.mock('../../middlewares/auth.middleware');

const mockMiddleware = jest.mocked(middleware);
const mockVerifyUser = jest.fn(async (req, _res, next) => {
        req.user = {
          id: '1',
          email: '[email protected]',
          fullName: null,
        };
        next();
      });

describe('POST /api/users', () => {
  test('when the user has ONLY been created in external auth', async () => {
    mockMiddleware.mockImplementation(() => ({
         verifyUser: mockVerifyUser,
    });

// ...

But the two approaches are equivalent.