aneurinandClaude Sonnet 5
f9b65cc4a7
Backend - New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail() (the default fallback), and log-to-file transports, selected by MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token and sends the link (APP_URL/verify-email?token=...). - Migration 005: email_verifications table + users.verification_email_sent_at. - Registration now emails a verification link (best effort — a send failure doesn't fail registration). - POST /api/auth/verify-email consumes a token and returns a session, so opening the link verifies the address (or applies a pending email change) and logs the user in. Single-use; distinct 400s for invalid/used/expired. - POST /api/email/verification resends; POST /api/email/change requests a deferred change (current password required; link goes to the new address; users.email only updates when that link is opened). Both throttled to once per 60s, returning 429 + retry_after. - GET /api/me and every session payload now include pending_email. Shared SessionPayload builds the user/session JSON for all entry points. Frontend - /verify-email view: posts the token, adopts the returned session, redirects. - /profile view: shows address + status, a resend button with a live cooldown (driven by retry_after / 429), and a change-email form (new address + current password) that surfaces the pending change. - Header shows a "verify email" badge linking to the profile. Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle, and deferred change; AuthTest folded into ApiTestCase, which now routes mail to a per-test log. Suite: 32 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
98 lines
3.2 KiB
PHP
98 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests;
|
|
|
|
final class AuthTest extends ApiTestCase
|
|
{
|
|
public function test_registration_returns_a_user_and_token(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/register', [
|
|
'email' => 'Ada@example.com',
|
|
'password' => 'correct horse battery',
|
|
]);
|
|
|
|
self::assertSame(201, $response->getStatusCode());
|
|
|
|
$body = $this->decode($response);
|
|
self::assertSame('ada@example.com', $body['user']['email']);
|
|
self::assertFalse($body['user']['email_verified']);
|
|
self::assertNull($body['user']['email_verified_at']);
|
|
self::assertNull($body['user']['pending_email']);
|
|
self::assertArrayNotHasKey('password_hash', $body['user']);
|
|
self::assertNotEmpty($body['token']);
|
|
}
|
|
|
|
public function test_registration_rejects_a_duplicate_email(): void
|
|
{
|
|
$payload = ['email' => 'dupe@example.com', 'password' => 'password123'];
|
|
|
|
$this->request('POST', '/api/auth/register', $payload);
|
|
$response = $this->request('POST', '/api/auth/register', $payload);
|
|
|
|
self::assertSame(409, $response->getStatusCode());
|
|
}
|
|
|
|
public function test_registration_validates_input(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/register', [
|
|
'email' => 'not-an-email',
|
|
'password' => 'short',
|
|
]);
|
|
|
|
self::assertSame(422, $response->getStatusCode());
|
|
|
|
$body = $this->decode($response);
|
|
self::assertArrayHasKey('email', $body['error']['details']);
|
|
self::assertArrayHasKey('password', $body['error']['details']);
|
|
}
|
|
|
|
public function test_login_succeeds_with_correct_password(): void
|
|
{
|
|
$this->request('POST', '/api/auth/register', [
|
|
'email' => 'grace@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
|
|
$response = $this->request('POST', '/api/auth/login', [
|
|
'email' => 'grace@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
self::assertNotEmpty($this->decode($response)['token']);
|
|
}
|
|
|
|
public function test_login_fails_with_wrong_password(): void
|
|
{
|
|
$this->request('POST', '/api/auth/register', [
|
|
'email' => 'grace@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
|
|
$response = $this->request('POST', '/api/auth/login', [
|
|
'email' => 'grace@example.com',
|
|
'password' => 'wrong-password',
|
|
]);
|
|
|
|
self::assertSame(401, $response->getStatusCode());
|
|
}
|
|
|
|
public function test_me_requires_a_valid_token(): void
|
|
{
|
|
$unauthorised = $this->request('GET', '/api/me');
|
|
self::assertSame(401, $unauthorised->getStatusCode());
|
|
|
|
$token = $this->decode($this->request('POST', '/api/auth/register', [
|
|
'email' => 'linus@example.com',
|
|
'password' => 'password123',
|
|
]))['token'];
|
|
|
|
$response = $this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $token]);
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
|
|
}
|
|
}
|