project-manager/tests/EmailVerificationTest.php

<?php

declare(strict_types=1);

namespace Tests;

final class EmailVerificationTest extends ApiTestCase
{
    public function test_the_magic_link_email_contains_a_verify_link(): void
    {
        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);

        $email = $this->lastEmail();
        self::assertSame('ada@example.com', $email['to']);
        self::assertStringContainsString('verify-email?token=', $email['body']);
        self::assertStringContainsString('https://app.test/verify-email?token=', $email['body']);
    }

    public function test_an_invalid_token_is_rejected(): void
    {
        $response = $this->request('POST', '/api/auth/verify-email', ['token' => 'not-a-real-token']);
        self::assertSame(400, $response->getStatusCode());
    }

    public function test_a_token_cannot_be_used_twice(): void
    {
        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
        $token = $this->tokenFromEmail();

        self::assertSame(200, $this->request('POST', '/api/auth/verify-email', ['token' => $token])->getStatusCode());

        $again = $this->request('POST', '/api/auth/verify-email', ['token' => $token]);
        self::assertSame(400, $again->getStatusCode());
        self::assertStringContainsString('already been used', $this->decode($again)['error']['message']);
    }

    public function test_an_expired_token_is_rejected(): void
    {
        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
        $token = $this->tokenFromEmail();

        $this->db()->prepare('UPDATE email_verifications SET expires_at = :past WHERE token_hash = :hash')->execute([
            'past' => gmdate('Y-m-d\TH:i:s\Z', time() - 60),
            'hash' => hash('sha256', $token),
        ]);

        $response = $this->request('POST', '/api/auth/verify-email', ['token' => $token]);
        self::assertSame(400, $response->getStatusCode());
        self::assertStringContainsString('expired', $this->decode($response)['error']['message']);
    }

    public function test_a_fresh_link_can_be_requested_once_the_interval_has_passed(): void
    {
        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
        $this->cooldownElapsed('ada@example.com');

        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);

        self::assertSame(202, $response->getStatusCode());
        self::assertCount(2, $this->sentEmails());
    }

    public function test_email_change_is_deferred_until_the_new_address_is_confirmed(): void
    {
        $auth = $this->authHeader('old@example.com');
        $this->cooldownElapsed('old@example.com');

        $change = $this->request('POST', '/api/email/change', ['email' => 'New@example.com'], $auth);

        self::assertSame(202, $change->getStatusCode());
        self::assertSame('new@example.com', $this->decode($change)['pending_email']);
        self::assertSame('new@example.com', $this->lastEmail()['to']);

        // Not applied yet.
        $me = $this->decode($this->request('GET', '/api/me', null, $auth));
        self::assertSame('old@example.com', $me['user']['email']);
        self::assertSame('new@example.com', $me['user']['pending_email']);

        // Open the link from the new inbox.
        $verified = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
        self::assertSame(200, $verified->getStatusCode());
        $body = $this->decode($verified);
        self::assertSame('new@example.com', $body['user']['email']);
        self::assertTrue($body['user']['email_verified']);
        self::assertNull($body['user']['pending_email']);
    }

    public function test_email_change_requires_authentication(): void
    {
        $response = $this->request('POST', '/api/email/change', ['email' => 'new@example.com']);
        self::assertSame(401, $response->getStatusCode());
    }

    public function test_email_change_validates_the_new_address(): void
    {
        $auth = $this->authHeader('old@example.com');
        $this->cooldownElapsed('old@example.com');

        $response = $this->request('POST', '/api/email/change', ['email' => 'not-an-email'], $auth);

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
    }

    public function test_email_change_rejects_an_address_already_in_use(): void
    {
        $this->authHeader('taken@example.com');
        $auth = $this->authHeader('mine@example.com');
        $this->cooldownElapsed('mine@example.com');

        $response = $this->request('POST', '/api/email/change', ['email' => 'taken@example.com'], $auth);

        self::assertSame(409, $response->getStatusCode());
    }

    public function test_email_change_rejects_the_current_address(): void
    {
        $auth = $this->authHeader('same@example.com');
        $this->cooldownElapsed('same@example.com');

        $response = $this->request('POST', '/api/email/change', ['email' => 'same@example.com'], $auth);

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
    }

    public function test_email_change_is_throttled_immediately_after_signing_in(): void
    {
        // authHeader() just sent this user a magic link, so the resend window
        // (shared with /email/change) hasn't elapsed yet.
        $auth = $this->authHeader('throttle@example.com');

        $response = $this->request('POST', '/api/email/change', ['email' => 'new@example.com'], $auth);

        self::assertSame(429, $response->getStatusCode());
        self::assertArrayHasKey('retry_after', $this->decode($response)['error']['details']);
    }

    /** Push the user's last-sent timestamp far enough back to clear the throttle. */
    private function cooldownElapsed(string $email): void
    {
        $this->db()
            ->prepare('UPDATE users SET verification_email_sent_at = :ts WHERE email = :email')
            ->execute(['ts' => gmdate('Y-m-d\TH:i:s\Z', time() - 120), 'email' => $email]);
    }
}