auth tests

backend/tests/Feature/Auth/AuthControllerTest.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AuthControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_me_returns_authenticated_user_with_setup_status(): void
+    {
+        $user = $this->operationalUser();
+        $this->actingAs($user, 'sanctum');
+
+        $response = $this->getJson('/api/user');
+
+        $response->assertOk()
+            ->assertJsonPath('id', $user->id)
+            ->assertJsonPath('email', $user->email)
+            ->assertJsonPath('setup_status', 'complete');
+
+        // Gli attributi sensibili non devono mai essere serializzati.
+        $this->assertArrayNotHasKey('password', $response->json());
+        $this->assertArrayNotHasKey('two_factor_secret', $response->json());
+        $this->assertArrayNotHasKey('two_factor_recovery_codes', $response->json());
+    }
+
+    public function test_me_is_reachable_during_setup(): void
+    {
+        // La rotta /user è nel tier "transitional": deve restare accessibile anche
+        // a setup incompleto, così il frontend può leggere setup_status.
+        $user = $this->setupIncompleteUser();
+        $this->actingAs($user, 'sanctum');
+
+        $this->getJson('/api/user')
+            ->assertOk()
+            ->assertJsonPath('setup_status', 'password_required');
+    }
+
+    public function test_me_requires_authentication(): void
+    {
+        $this->getJson('/api/user')->assertUnauthorized();
+    }
+
+    public function test_logout_succeeds_and_forgets_cookies(): void
+    {
+        $user = $this->operationalUser();
+        $this->actingAs($user, 'sanctum');
+
+        $response = $this->postJson('/api/logout');
+
+        $response->assertOk()
+            ->assertJsonPath('message', config('messages.auth.logout_success'))
+            ->assertCookieExpired('XSRF-TOKEN');
+    }
+
+    public function test_destroy_account_soft_deletes_the_user(): void
+    {
+        $user = $this->operationalUser();
+        $this->actingAs($user, 'sanctum');
+
+        $this->deleteJson('/api/account')
+            ->assertOk()
+            ->assertJsonPath('message', config('messages.account.deleted'));
+
+        $this->assertSoftDeleted('users', ['id' => $user->id]);
+    }
+
+    public function test_destroy_account_is_forbidden_for_the_system_user(): void
+    {
+        $user = $this->systemUser();
+        $this->actingAs($user, 'sanctum');
+
+        $this->deleteJson('/api/account')->assertForbidden();
+
+        $this->assertDatabaseHas('users', ['id' => $user->id, 'deleted_at' => null]);
+    }
+
+    public function test_session_endpoints_require_authentication(): void
+    {
+        $this->postJson('/api/logout')->assertUnauthorized();
+        $this->deleteJson('/api/account')->assertUnauthorized();
+    }
+}