project-manager/tests/EmailVerificationTest.php

<?php

declare(strict_types=1);

namespace Tests;

final class EmailVerificationTest extends ApiTestCase
{
    public function test_registration_sends_a_verification_email(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);

        $email = $this->lastEmail();
        self::assertSame('ada@example.com', $email['to']);
        self::assertStringContainsString('verify-email?token=', $email['body']);
        self::assertStringContainsString('https://app.test/verify-email?token=', $email['body']);
    }

    public function test_opening_the_magic_link_verifies_and_logs_in(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);

        $response = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);

        self::assertSame(200, $response->getStatusCode());
        $body = $this->decode($response);
        self::assertTrue($body['user']['email_verified']);
        self::assertNotEmpty($body['token']);

        $me = $this->decode($this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $body['token']]));
        self::assertTrue($me['user']['email_verified']);
    }

    public function test_an_invalid_token_is_rejected(): void
    {
        $response = $this->request('POST', '/api/auth/verify-email', ['token' => 'not-a-real-token']);
        self::assertSame(400, $response->getStatusCode());
    }

    public function test_a_token_cannot_be_used_twice(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
        $token = $this->tokenFromEmail();

        self::assertSame(200, $this->request('POST', '/api/auth/verify-email', ['token' => $token])->getStatusCode());

        $again = $this->request('POST', '/api/auth/verify-email', ['token' => $token]);
        self::assertSame(400, $again->getStatusCode());
        self::assertStringContainsString('already been used', $this->decode($again)['error']['message']);
    }

    public function test_an_expired_token_is_rejected(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
        $token = $this->tokenFromEmail();

        $this->db()->prepare('UPDATE email_verifications SET expires_at = :past WHERE token_hash = :hash')->execute([
            'past' => gmdate('Y-m-d\TH:i:s\Z', time() - 60),
            'hash' => hash('sha256', $token),
        ]);

        $response = $this->request('POST', '/api/auth/verify-email', ['token' => $token]);
        self::assertSame(400, $response->getStatusCode());
        self::assertStringContainsString('expired', $this->decode($response)['error']['message']);
    }

    public function test_resend_is_throttled_immediately_after_registration(): void
    {
        $auth = $this->authHeader('ada@example.com');

        $response = $this->request('POST', '/api/email/verification', null, $auth);

        self::assertSame(429, $response->getStatusCode());
        self::assertArrayHasKey('retry_after', $this->decode($response)['error']['details']);
    }

    public function test_resend_works_once_the_interval_has_passed(): void
    {
        $auth = $this->authHeader('ada@example.com');
        $this->cooldownElapsed('ada@example.com');

        $response = $this->request('POST', '/api/email/verification', null, $auth);

        self::assertSame(202, $response->getStatusCode());
        self::assertCount(2, $this->sentEmails());
        self::assertSame('ada@example.com', $this->lastEmail()['to']);
    }

    public function test_resend_conflicts_when_already_verified(): void
    {
        $auth = $this->authHeader('ada@example.com');
        $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
        $this->cooldownElapsed('ada@example.com');

        $response = $this->request('POST', '/api/email/verification', null, $auth);
        self::assertSame(409, $response->getStatusCode());
    }

    public function test_magic_link_login_emails_a_link_that_signs_the_user_in(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
        $this->cooldownElapsed('ada@example.com');

        $requested = $this->request('POST', '/api/auth/magic-link', ['email' => 'ADA@example.com']);
        self::assertSame(202, $requested->getStatusCode());

        $login = $this->lastEmail();
        self::assertSame('ada@example.com', $login['to']);
        self::assertSame('Your login link', $login['subject']);

        $session = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail($login)]);
        self::assertSame(200, $session->getStatusCode());
        $body = $this->decode($session);
        self::assertSame('ada@example.com', $body['user']['email']);
        self::assertTrue($body['user']['email_verified']);
        self::assertNotEmpty($body['token']);
    }

    public function test_magic_link_login_verifies_an_unverified_account(): void
    {
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
        $this->cooldownElapsed('ada@example.com');

        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
        $body = $this->decode(
            $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
        );

        self::assertTrue($body['user']['email_verified']);
    }

    public function test_magic_link_login_is_silent_for_an_unknown_address(): void
    {
        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'nobody@example.com']);

        self::assertSame(202, $response->getStatusCode());
        self::assertSame([], $this->sentEmails());
    }

    public function test_magic_link_login_does_not_resend_within_the_interval(): void
    {
        // Registration already sent a verification email moments ago.
        $this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);

        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);

        self::assertSame(202, $response->getStatusCode());
        self::assertCount(1, $this->sentEmails()); // still just the registration email
    }

    public function test_magic_link_login_validates_the_address(): void
    {
        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'not-an-email']);
        self::assertSame(422, $response->getStatusCode());
    }

    public function test_email_change_is_deferred_until_the_new_address_is_confirmed(): void
    {
        $auth = $this->authHeader('old@example.com');
        $this->cooldownElapsed('old@example.com');

        $change = $this->request('POST', '/api/email/change', [
            'email' => 'New@example.com',
            'password' => 'password123',
        ], $auth);

        self::assertSame(202, $change->getStatusCode());
        self::assertSame('new@example.com', $this->decode($change)['pending_email']);
        self::assertSame('new@example.com', $this->lastEmail()['to']);

        // Not applied yet.
        $me = $this->decode($this->request('GET', '/api/me', null, $auth));
        self::assertSame('old@example.com', $me['user']['email']);
        self::assertSame('new@example.com', $me['user']['pending_email']);

        // Open the link from the new inbox.
        $verified = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
        self::assertSame(200, $verified->getStatusCode());
        $body = $this->decode($verified);
        self::assertSame('new@example.com', $body['user']['email']);
        self::assertTrue($body['user']['email_verified']);
        self::assertNull($body['user']['pending_email']);
    }

    public function test_email_change_requires_the_current_password(): void
    {
        $auth = $this->authHeader('old@example.com');
        $this->cooldownElapsed('old@example.com');

        $response = $this->request('POST', '/api/email/change', [
            'email' => 'new@example.com',
            'password' => 'wrong-password',
        ], $auth);

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('password', $this->decode($response)['error']['details']);
    }

    public function test_email_change_rejects_an_address_already_in_use(): void
    {
        $this->authHeader('taken@example.com');
        $auth = $this->authHeader('mine@example.com');
        $this->cooldownElapsed('mine@example.com');

        $response = $this->request('POST', '/api/email/change', [
            'email' => 'taken@example.com',
            'password' => 'password123',
        ], $auth);

        self::assertSame(409, $response->getStatusCode());
    }

    public function test_email_change_rejects_the_current_address(): void
    {
        $auth = $this->authHeader('same@example.com');
        $this->cooldownElapsed('same@example.com');

        $response = $this->request('POST', '/api/email/change', [
            'email' => 'same@example.com',
            'password' => 'password123',
        ], $auth);

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
    }

    /** Push the user's last-sent timestamp far enough back to clear the throttle. */
    private function cooldownElapsed(string $email): void
    {
        $this->db()
            ->prepare('UPDATE users SET verification_email_sent_at = :ts WHERE email = :email')
            ->execute(['ts' => gmdate('Y-m-d\TH:i:s\Z', time() - 120), 'email' => $email]);
    }
}