Add stage 1: authentication REST API

Slim 4 + SQLite todo-list API providing email/password registration, login, and an authenticated GET /me endpoint. Stateless HS256 JWTs, bcrypt password hashing, uniform JSON error envelope, and a SQL migration runner. Includes PHPUnit feature tests and stage-1 docs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-03 17:35:10 +01:00
commit 7faef6fbff
23 changed files with 4054 additions and 0 deletions
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests;
+
+use PDO;
+use PHPUnit\Framework\TestCase;
+use Psr\Http\Message\ResponseInterface;
+use Slim\App;
+use Slim\Psr7\Factory\ServerRequestFactory;
+
+final class AuthTest extends TestCase
+{
+    private App $app;
+    private string $databasePath;
+
+    protected function setUp(): void
+    {
+        $this->databasePath = sys_get_temp_dir() . '/todo-test-' . uniqid() . '.sqlite';
+        putenv('DATABASE_PATH=' . $this->databasePath);
+        $_ENV['DATABASE_PATH'] = $this->databasePath;
+
+        $pdo = new PDO('sqlite:' . $this->databasePath);
+        foreach (glob(dirname(__DIR__) . '/migrations/*.sql') ?: [] as $migration) {
+            $pdo->exec((string) file_get_contents($migration));
+        }
+
+        $this->app = require dirname(__DIR__) . '/src/bootstrap.php';
+    }
+
+    protected function tearDown(): void
+    {
+        @unlink($this->databasePath);
+        putenv('DATABASE_PATH');
+        unset($_ENV['DATABASE_PATH']);
+    }
+
+    public function test_registration_returns_a_user_and_token(): void
+    {
+        $response = $this->request('POST', '/api/auth/register', [
+            'email' => 'Ada@example.com',
+            'password' => 'correct horse battery',
+        ]);
+
+        self::assertSame(201, $response->getStatusCode());
+
+        $body = $this->decode($response);
+        self::assertSame('ada@example.com', $body['user']['email']);
+        self::assertArrayNotHasKey('password_hash', $body['user']);
+        self::assertNotEmpty($body['token']);
+    }
+
+    public function test_registration_rejects_a_duplicate_email(): void
+    {
+        $payload = ['email' => 'dupe@example.com', 'password' => 'password123'];
+
+        $this->request('POST', '/api/auth/register', $payload);
+        $response = $this->request('POST', '/api/auth/register', $payload);
+
+        self::assertSame(409, $response->getStatusCode());
+    }
+
+    public function test_registration_validates_input(): void
+    {
+        $response = $this->request('POST', '/api/auth/register', [
+            'email' => 'not-an-email',
+            'password' => 'short',
+        ]);
+
+        self::assertSame(422, $response->getStatusCode());
+
+        $body = $this->decode($response);
+        self::assertArrayHasKey('email', $body['error']['details']);
+        self::assertArrayHasKey('password', $body['error']['details']);
+    }
+
+    public function test_login_succeeds_with_correct_password(): void
+    {
+        $this->request('POST', '/api/auth/register', [
+            'email' => 'grace@example.com',
+            'password' => 'password123',
+        ]);
+
+        $response = $this->request('POST', '/api/auth/login', [
+            'email' => 'grace@example.com',
+            'password' => 'password123',
+        ]);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertNotEmpty($this->decode($response)['token']);
+    }
+
+    public function test_login_fails_with_wrong_password(): void
+    {
+        $this->request('POST', '/api/auth/register', [
+            'email' => 'grace@example.com',
+            'password' => 'password123',
+        ]);
+
+        $response = $this->request('POST', '/api/auth/login', [
+            'email' => 'grace@example.com',
+            'password' => 'wrong-password',
+        ]);
+
+        self::assertSame(401, $response->getStatusCode());
+    }
+
+    public function test_me_requires_a_valid_token(): void
+    {
+        $unauthorised = $this->request('GET', '/api/me');
+        self::assertSame(401, $unauthorised->getStatusCode());
+
+        $token = $this->decode($this->request('POST', '/api/auth/register', [
+            'email' => 'linus@example.com',
+            'password' => 'password123',
+        ]))['token'];
+
+        $response = $this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $token]);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
+    }
+
+    /**
+     * @param array<string, mixed>|null $body
+     * @param array<string, string> $headers
+     */
+    private function request(string $method, string $path, ?array $body = null, array $headers = []): ResponseInterface
+    {
+        $request = (new ServerRequestFactory())->createServerRequest($method, $path);
+
+        foreach ($headers as $name => $value) {
+            $request = $request->withHeader($name, $value);
+        }
+
+        if ($body !== null) {
+            $request = $request->withParsedBody($body)->withHeader('Content-Type', 'application/json');
+        }
+
+        return $this->app->handle($request);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function decode(ResponseInterface $response): array
+    {
+        return (array) json_decode((string) $response->getBody(), true, 512, JSON_THROW_ON_ERROR);
+    }
+}