From 24f437cac608a8b7ea3b1a9b6ebe6db17eb34553 Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Fri, 31 Jul 2026 10:53:54 +0300
Subject: [PATCH] test session restoration

---
 .../website/cypress/e2e/session-auth.cy.ts    | 56 +++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 frontend/website/cypress/e2e/session-auth.cy.ts

diff --git a/frontend/website/cypress/e2e/session-auth.cy.ts b/frontend/website/cypress/e2e/session-auth.cy.ts
new file mode 100644
index 0000000..d7fb723
--- /dev/null
+++ b/frontend/website/cypress/e2e/session-auth.cy.ts
@@ -0,0 +1,56 @@
+const authenticatedUser = {
+  id: 7,
+  email: 'user@example.com',
+}
+
+describe('session authentication', () => {
+  it('restores an authenticated session on a protected route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+    cy.get('h1').should('have.text', 'Your next step starts here.')
+  })
+
+  it('redirects an unauthenticated protected route to login', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 401,
+      body: { error: 'unauthenticated' },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+    cy.location('search').should('include', 'redirect=/dashboard')
+  })
+
+  it('redirects a restored session away from a guest-only route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/login')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+  })
+
+  it('rejects a malformed authenticated-user response', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: { id: 7 } },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+  })
+})