project-manager/tests/AuthTest.php

<?php

declare(strict_types=1);

namespace Tests;

final class AuthTest extends ApiTestCase
{
    public function test_registration_returns_a_user_and_token(): void
    {
        $response = $this->request('POST', '/api/auth/register', [
            'email' => 'Ada@example.com',
            'password' => 'correct horse battery',
        ]);

        self::assertSame(201, $response->getStatusCode());

        $body = $this->decode($response);
        self::assertSame('ada@example.com', $body['user']['email']);
        self::assertFalse($body['user']['email_verified']);
        self::assertNull($body['user']['email_verified_at']);
        self::assertNull($body['user']['pending_email']);
        self::assertArrayNotHasKey('password_hash', $body['user']);
        self::assertNotEmpty($body['token']);
    }

    public function test_registration_rejects_a_duplicate_email(): void
    {
        $payload = ['email' => 'dupe@example.com', 'password' => 'password123'];

        $this->request('POST', '/api/auth/register', $payload);
        $response = $this->request('POST', '/api/auth/register', $payload);

        self::assertSame(409, $response->getStatusCode());
    }

    public function test_registration_validates_input(): void
    {
        $response = $this->request('POST', '/api/auth/register', [
            'email' => 'not-an-email',
            'password' => 'short',
        ]);

        self::assertSame(422, $response->getStatusCode());

        $body = $this->decode($response);
        self::assertArrayHasKey('email', $body['error']['details']);
        self::assertArrayHasKey('password', $body['error']['details']);
    }

    public function test_login_succeeds_with_correct_password(): void
    {
        $this->request('POST', '/api/auth/register', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        $response = $this->request('POST', '/api/auth/login', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        self::assertSame(200, $response->getStatusCode());
        self::assertNotEmpty($this->decode($response)['token']);
    }

    public function test_login_fails_with_wrong_password(): void
    {
        $this->request('POST', '/api/auth/register', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        $response = $this->request('POST', '/api/auth/login', [
            'email' => 'grace@example.com',
            'password' => 'wrong-password',
        ]);

        self::assertSame(401, $response->getStatusCode());
    }

    public function test_me_requires_a_valid_token(): void
    {
        $unauthorised = $this->request('GET', '/api/me');
        self::assertSame(401, $unauthorised->getStatusCode());

        $token = $this->decode($this->request('POST', '/api/auth/register', [
            'email' => 'linus@example.com',
            'password' => 'password123',
        ]))['token'];

        $response = $this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $token]);

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
    }
}