auth tests

backend/tests/Feature/PurgeUserActionTest.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\PurgeUserAction;
+use App\Exceptions\CannotDeleteSystemUserException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class PurgeUserActionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function purge(): PurgeUserAction
+    {
+        return app(PurgeUserAction::class);
+    }
+
+    public function test_it_anonymizes_personal_data_in_place(): void
+    {
+        $this->systemUser();
+        $user = $this->operationalUser(['name' => 'Mario Rossi']);
+
+        $this->purge()->execute($user);
+
+        $user->refresh();
+        $this->assertSame('Deleted user', $user->name);
+        $this->assertSame("deleted-{$user->id}@anonymized.invalid", $user->email);
+        $this->assertNotNull($user->anonymized_at);
+        $this->assertNull($user->email_verified_at);
+        $this->assertNull($user->two_factor_setup_completed_at);
+        $this->assertFalse($user->must_change_password);
+    }
+
+    public function test_it_is_idempotent_on_already_anonymized_users(): void
+    {
+        $this->systemUser();
+        $user = $this->operationalUser(['name' => 'Keep Me', 'anonymized_at' => now()]);
+
+        $this->purge()->execute($user);
+
+        $user->refresh();
+        // Già anonimizzato → uscita anticipata: nessuna riscrittura del nome.
+        $this->assertSame('Keep Me', $user->name);
+    }
+
+    public function test_it_refuses_to_anonymize_the_system_user(): void
+    {
+        $system = $this->systemUser();
+
+        $this->expectException(CannotDeleteSystemUserException::class);
+
+        $this->purge()->execute($system);
+    }
+}