87 lines
2.7 KiB
PHP
87 lines
2.7 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Auth;
|
|
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
class AuthControllerTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_me_returns_authenticated_user_with_setup_status(): void
|
|
{
|
|
$user = $this->operationalUser();
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$response = $this->getJson('/api/user');
|
|
|
|
$response->assertOk()
|
|
->assertJsonPath('id', $user->id)
|
|
->assertJsonPath('email', $user->email)
|
|
->assertJsonPath('setup_status', 'complete');
|
|
|
|
// Gli attributi sensibili non devono mai essere serializzati.
|
|
$this->assertArrayNotHasKey('password', $response->json());
|
|
$this->assertArrayNotHasKey('two_factor_secret', $response->json());
|
|
$this->assertArrayNotHasKey('two_factor_recovery_codes', $response->json());
|
|
}
|
|
|
|
public function test_me_is_reachable_during_setup(): void
|
|
{
|
|
// La rotta /user è nel tier "transitional": deve restare accessibile anche
|
|
// a setup incompleto, così il frontend può leggere setup_status.
|
|
$user = $this->setupIncompleteUser();
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$this->getJson('/api/user')
|
|
->assertOk()
|
|
->assertJsonPath('setup_status', 'password_required');
|
|
}
|
|
|
|
public function test_me_requires_authentication(): void
|
|
{
|
|
$this->getJson('/api/user')->assertUnauthorized();
|
|
}
|
|
|
|
public function test_logout_succeeds_and_forgets_cookies(): void
|
|
{
|
|
$user = $this->operationalUser();
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$response = $this->postJson('/api/logout');
|
|
|
|
$response->assertOk()
|
|
->assertJsonPath('message', config('messages.auth.logout_success'))
|
|
->assertCookieExpired('XSRF-TOKEN');
|
|
}
|
|
|
|
public function test_destroy_account_soft_deletes_the_user(): void
|
|
{
|
|
$user = $this->operationalUser();
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$this->deleteJson('/api/account')
|
|
->assertOk()
|
|
->assertJsonPath('message', config('messages.account.deleted'));
|
|
|
|
$this->assertSoftDeleted('users', ['id' => $user->id]);
|
|
}
|
|
|
|
public function test_destroy_account_is_forbidden_for_the_system_user(): void
|
|
{
|
|
$user = $this->systemUser();
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$this->deleteJson('/api/account')->assertForbidden();
|
|
|
|
$this->assertDatabaseHas('users', ['id' => $user->id, 'deleted_at' => null]);
|
|
}
|
|
|
|
public function test_session_endpoints_require_authentication(): void
|
|
{
|
|
$this->postJson('/api/logout')->assertUnauthorized();
|
|
$this->deleteJson('/api/account')->assertUnauthorized();
|
|
}
|
|
}
|