project-manager/tests/AuthTest.php

<?php

declare(strict_types=1);

namespace Tests;

use PDO;
use PHPUnit\Framework\TestCase;
use Psr\Http\Message\ResponseInterface;
use Slim\App;
use Slim\Psr7\Factory\ServerRequestFactory;

final class AuthTest extends TestCase
{
    private App $app;
    private string $databasePath;

    protected function setUp(): void
    {
        $this->databasePath = sys_get_temp_dir() . '/todo-test-' . uniqid() . '.sqlite';
        putenv('DATABASE_PATH=' . $this->databasePath);
        $_ENV['DATABASE_PATH'] = $this->databasePath;

        $pdo = new PDO('sqlite:' . $this->databasePath);
        foreach (glob(dirname(__DIR__) . '/migrations/*.sql') ?: [] as $migration) {
            $pdo->exec((string) file_get_contents($migration));
        }

        $this->app = require dirname(__DIR__) . '/src/bootstrap.php';
    }

    protected function tearDown(): void
    {
        @unlink($this->databasePath);
        putenv('DATABASE_PATH');
        unset($_ENV['DATABASE_PATH']);
    }

    public function test_registration_returns_a_user_and_token(): void
    {
        $response = $this->request('POST', '/api/auth/register', [
            'email' => 'Ada@example.com',
            'password' => 'correct horse battery',
        ]);

        self::assertSame(201, $response->getStatusCode());

        $body = $this->decode($response);
        self::assertSame('ada@example.com', $body['user']['email']);
        self::assertFalse($body['user']['email_verified']);
        self::assertNull($body['user']['email_verified_at']);
        self::assertArrayNotHasKey('password_hash', $body['user']);
        self::assertNotEmpty($body['token']);
    }

    public function test_registration_rejects_a_duplicate_email(): void
    {
        $payload = ['email' => 'dupe@example.com', 'password' => 'password123'];

        $this->request('POST', '/api/auth/register', $payload);
        $response = $this->request('POST', '/api/auth/register', $payload);

        self::assertSame(409, $response->getStatusCode());
    }

    public function test_registration_validates_input(): void
    {
        $response = $this->request('POST', '/api/auth/register', [
            'email' => 'not-an-email',
            'password' => 'short',
        ]);

        self::assertSame(422, $response->getStatusCode());

        $body = $this->decode($response);
        self::assertArrayHasKey('email', $body['error']['details']);
        self::assertArrayHasKey('password', $body['error']['details']);
    }

    public function test_login_succeeds_with_correct_password(): void
    {
        $this->request('POST', '/api/auth/register', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        $response = $this->request('POST', '/api/auth/login', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        self::assertSame(200, $response->getStatusCode());
        self::assertNotEmpty($this->decode($response)['token']);
    }

    public function test_login_fails_with_wrong_password(): void
    {
        $this->request('POST', '/api/auth/register', [
            'email' => 'grace@example.com',
            'password' => 'password123',
        ]);

        $response = $this->request('POST', '/api/auth/login', [
            'email' => 'grace@example.com',
            'password' => 'wrong-password',
        ]);

        self::assertSame(401, $response->getStatusCode());
    }

    public function test_me_requires_a_valid_token(): void
    {
        $unauthorised = $this->request('GET', '/api/me');
        self::assertSame(401, $unauthorised->getStatusCode());

        $token = $this->decode($this->request('POST', '/api/auth/register', [
            'email' => 'linus@example.com',
            'password' => 'password123',
        ]))['token'];

        $response = $this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $token]);

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
    }

    /**
     * @param array<string, mixed>|null $body
     * @param array<string, string> $headers
     */
    private function request(string $method, string $path, ?array $body = null, array $headers = []): ResponseInterface
    {
        $request = (new ServerRequestFactory())->createServerRequest($method, $path);

        foreach ($headers as $name => $value) {
            $request = $request->withHeader($name, $value);
        }

        if ($body !== null) {
            $request = $request->withParsedBody($body)->withHeader('Content-Type', 'application/json');
        }

        return $this->app->handle($request);
    }

    /**
     * @return array<string, mixed>
     */
    private function decode(ResponseInterface $response): array
    {
        return (array) json_decode((string) $response->getBody(), true, 512, JSON_THROW_ON_ERROR);
    }
}