test session restoration

frontend/website/cypress/e2e/session-auth.cy.ts

@@ -0,0 +1,56 @@
+const authenticatedUser = {
+  id: 7,
+  email: 'user@example.com',
+}
+
+describe('session authentication', () => {
+  it('restores an authenticated session on a protected route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+    cy.get('h1').should('have.text', 'Your next step starts here.')
+  })
+
+  it('redirects an unauthenticated protected route to login', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 401,
+      body: { error: 'unauthenticated' },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+    cy.location('search').should('include', 'redirect=/dashboard')
+  })
+
+  it('redirects a restored session away from a guest-only route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/login')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+  })
+
+  it('rejects a malformed authenticated-user response', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: { id: 7 } },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+  })
+})