auth tests

backend/app/Http/Controllers/AuthController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Traits\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cookie;
+
+class AuthController extends Controller
+{
+    use ApiResponse;
+
+    /**
+     * Utente autenticato corrente (include l'accessor setup_status).
+     * Risposta al primo livello, come da convenzione Sanctum SPA.
+     */
+    public function me(Request $request): JsonResponse
+    {
+        return response()->json($request->user());
+    }
+
+    /**
+     * Logout: chiude la sessione stateful e ripulisce i cookie.
+     * Sovrascrive la rotta omonima di Fortify (registrata dopo → ha precedenza).
+     */
+    public function logout(Request $request): JsonResponse
+    {
+        $this->tearDownSession($request);
+
+        return $this->forgetAuthCookies($this->messageResponse('auth.logout_success'));
+    }
+
+    /**
+     * Cancellazione self-service dell'account: soft-delete + logout.
+     * L'anonimizzazione definitiva (GDPR) la fa l'Admin o la retention.
+     */
+    public function destroyAccount(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        abort_if($user->is_system, 403);
+
+        $user->delete();
+        $this->tearDownSession($request);
+
+        return $this->forgetAuthCookies($this->messageResponse('account.deleted'));
+    }
+
+    /**
+     * Invalida la sessione corrente e rigenera il token CSRF.
+     */
+    private function tearDownSession(Request $request): void
+    {
+        Auth::guard('web')->logout();
+
+        if ($request->hasSession()) {
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+        }
+    }
+
+    /**
+     * Marca per la cancellazione i cookie di sessione e XSRF lato client.
+     */
+    private function forgetAuthCookies(JsonResponse $response): JsonResponse
+    {
+        return $response
+            ->withCookie(Cookie::forget(config('session.cookie')))
+            ->withCookie(Cookie::forget('XSRF-TOKEN'));
+    }
+}