Merge branch 'feature/me-endpoint'

backend/.env.example

@@ -3,6 +3,7 @@ APP_ENV=local
 APP_KEY=
 APP_DEBUG=true
 APP_URL=https://localhost:8000
+FRONTEND_URL=https://localhost:5173
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en

backend/app/Http/Controllers/AuthController.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\User\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class AuthController extends Controller
+{
+    public function me(Request $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = $request->attributes->get('user');
+
+        return new JsonResponse([
+            'user' => [
+                'id' => $user->getId(),
+                'email' => $user->getEmail()->value(),
+            ],
+        ]);
+    }
+}

backend/bootstrap/app.php

@@ -9,6 +9,7 @@ use Illuminate\Http\Request;
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
         web: __DIR__.'/../routes/web.php',
+        api: __DIR__.'/../routes/api.php',
         commands: __DIR__.'/../routes/console.php',
         health: '/up',
     )

backend/config/cors.php

@@ -0,0 +1,22 @@
+<?php
+
+$frontendUrl = (string) env(
+    'FRONTEND_URL',
+    'https://localhost:5173',
+);
+$allowedOrigins = array_values(array_unique([
+    $frontendUrl,
+    str_replace('localhost', '127.0.0.1', $frontendUrl),
+    str_replace('127.0.0.1', 'localhost', $frontendUrl),
+]));
+
+return [
+    'paths' => ['api/*'],
+    'allowed_methods' => ['*'],
+    'allowed_origins' => $allowedOrigins,
+    'allowed_origins_patterns' => [],
+    'allowed_headers' => ['*'],
+    'exposed_headers' => [],
+    'max_age' => 0,
+    'supports_credentials' => true,
+];

backend/phpunit.xml

@@ -26,6 +26,7 @@
         <env name="DB_CONNECTION" value="sqlite"/>
         <env name="DB_DATABASE" value=":memory:"/>
         <env name="DB_URL" value=""/>
+        <env name="FRONTEND_URL" value="https://localhost:5173"/>
         <env name="MAIL_MAILER" value="array"/>
         <env name="QUEUE_CONNECTION" value="sync"/>
         <env name="SESSION_DRIVER" value="array"/>

backend/routes/api.php

@@ -0,0 +1,9 @@
+<?php
+
+use App\Http\Controllers\AuthController;
+use App\Http\Middleware\AuthMiddleware;
+use Illuminate\Support\Facades\Route;
+
+Route::middleware(AuthMiddleware::class)->group(function (): void {
+    Route::get('/me', [AuthController::class, 'me']);
+});

backend/tests/Feature/Auth/MeEndpointTest.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\CreateSessionDto;
+use App\Auth\SessionRepository;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use DateTimeImmutable;
+use DateTimeZone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class MeEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_me_returns_the_authenticated_user(): void
+    {
+        $now = new DateTimeImmutable(
+            '2026-07-31T12:00:00',
+            new DateTimeZone('UTC'),
+        );
+        $user = app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+        ));
+        app(SessionRepository::class)->create(new CreateSessionDto(
+            token: 'valid-token',
+            user: $user,
+            createdAt: $now,
+            expiresAt: $now->modify('+7 days'),
+        ));
+
+        $response = $this->withCredentials()
+            ->withUnencryptedCookie(
+                AuthMiddleware::COOKIE_NAME,
+                'valid-token',
+            )->getJson('/api/me');
+
+        $response->assertOk()->assertExactJson([
+            'user' => [
+                'id' => $user->getId(),
+                'email' => 'user@example.com',
+            ],
+        ]);
+    }
+
+    public function test_me_rejects_a_request_without_a_cookie(): void
+    {
+        $response = $this->getJson('/api/me');
+
+        $response
+            ->assertStatus(401)
+            ->assertExactJson(['error' => 'unauthenticated']);
+    }
+
+    public function test_me_allows_credentialed_frontend_requests(): void
+    {
+        $response = $this->withHeaders([
+            'Origin' => 'https://localhost:5173',
+            'Access-Control-Request-Method' => 'GET',
+        ])->options('/api/me');
+
+        $response
+            ->assertNoContent()
+            ->assertHeader(
+                'Access-Control-Allow-Origin',
+                'https://localhost:5173',
+            )
+            ->assertHeader('Access-Control-Allow-Credentials', 'true');
+    }
+}

frontend/website/cypress.config.ts

@@ -5,7 +5,7 @@ const frontendPort = process.env.VITE_PORT ?? '5173'
 export default defineConfig({
   allowCypressEnv: false,
   e2e: {
-    baseUrl: `http://127.0.0.1:${frontendPort}`,
+    baseUrl: `https://localhost:${frontendPort}`,
     supportFile: false,
   },
   video: false,

frontend/website/cypress/e2e/session-auth.cy.ts

@@ -0,0 +1,56 @@
+const authenticatedUser = {
+  id: 7,
+  email: 'user@example.com',
+}
+
+describe('session authentication', () => {
+  it('restores an authenticated session on a protected route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+    cy.get('h1').should('have.text', 'Your next step starts here.')
+  })
+
+  it('redirects an unauthenticated protected route to login', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 401,
+      body: { error: 'unauthenticated' },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+    cy.location('search').should('include', 'redirect=/dashboard')
+  })
+
+  it('redirects a restored session away from a guest-only route', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: authenticatedUser },
+    }).as('me')
+
+    cy.visit('/login')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/dashboard')
+  })
+
+  it('rejects a malformed authenticated-user response', () => {
+    cy.intercept('GET', '**/api/me', {
+      statusCode: 200,
+      body: { user: { id: 7 } },
+    }).as('me')
+
+    cy.visit('/dashboard')
+    cy.wait('@me')
+
+    cy.location('pathname').should('equal', '/login')
+  })
+})

frontend/website/env.d.ts

@@ -1 +1,9 @@
 /// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_API_URL: string
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv
+}

frontend/website/package-lock.json

@@ -10,7 +10,8 @@
       "dependencies": {
         "pinia": "^4.0.2",
         "vue": "^3.5.40",
-        "vue-router": "^5.2.0"
+        "vue-router": "^5.2.0",
+        "zod": "^4.4.3"
       },
       "devDependencies": {
         "@tsconfig/node24": "^24.0.4",
@@ -7620,6 +7621,15 @@
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }

frontend/website/package.json

@@ -18,7 +18,8 @@
   "dependencies": {
     "pinia": "^4.0.2",
     "vue": "^3.5.40",
-    "vue-router": "^5.2.0"
+    "vue-router": "^5.2.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tsconfig/node24": "^24.0.4",

frontend/website/src/router/index.ts

@@ -37,21 +37,31 @@ const router = createRouter({
   ],
 })
 
-router.beforeEach((to) => {
+router.beforeEach(async (to) => {
   const authStore = useAuthStore()
 
   if (to.meta.requiresAuth && !authStore.isAuthenticated) {
-    return {
+    const restoredSession = await authStore.fetchMe()
-      name: 'login',
+    if (!restoredSession) {
-      query: {
+      return {
-        redirect: to.fullPath,
+        name: 'login',
-      },
+        query: {
+          redirect: to.fullPath,
+        },
+      }
     }
   }
 
-  if (to.meta.guestOnly && authStore.isAuthenticated) {
+  if (to.meta.guestOnly) {
-    return {
+    let restoredSession = authStore.isAuthenticated
-      name: 'dashboard',
+    if (!restoredSession) {
+      restoredSession = await authStore.fetchMe()
+    }
+
+    if (restoredSession) {
+      return {
+        name: 'dashboard',
+      }
     }
   }
 })

frontend/website/src/stores/auth.ts

@@ -1,10 +1,67 @@
-import { ref } from 'vue'
+import { computed, ref } from 'vue'
 import { defineStore } from 'pinia'
+import { z } from 'zod'
+
+import { API_BASE } from '@/utils/apiBase'
+
+export const authUserSchema = z.object({
+  id: z.number().int().positive(),
+  email: z.string().email(),
+})
+
+const meResponseSchema = z.object({
+  user: authUserSchema,
+})
+
+export type AuthUser = z.infer<typeof authUserSchema>
 
 export const useAuthStore = defineStore('auth', () => {
-  const isAuthenticated = ref(false)
+  const user = ref<AuthUser | null>(null)
+  const loading = ref(false)
+  const error = ref<string | null>(null)
+  const isAuthenticated = computed(() => user.value !== null)
+
+  async function fetchMe(): Promise<boolean> {
+    loading.value = true
+    error.value = null
+
+    try {
+      const response = await fetch(`${API_BASE}/api/me`, {
+        method: 'GET',
+        credentials: 'include',
+        headers: {
+          Accept: 'application/json',
+        },
+      })
+
+      if (response.status === 200) {
+        const responseBody: unknown = await response.json()
+        user.value = meResponseSchema.parse(responseBody).user
+
+        return true
+      }
+
+      user.value = null
+      if (response.status !== 401) {
+        error.value = 'Unable to restore session'
+      }
+
+      return false
+    } catch {
+      user.value = null
+      error.value = 'Unable to restore session'
+
+      return false
+    } finally {
+      loading.value = false
+    }
+  }
 
   return {
+    user,
+    loading,
+    error,
     isAuthenticated,
+    fetchMe,
   }
 })

frontend/website/src/utils/apiBase.ts

@@ -0,0 +1,17 @@
+function resolveApiBase(): string {
+  const configuredApiUrl = import.meta.env.VITE_API_URL
+  if (configuredApiUrl === '') {
+    throw new Error('VITE_API_URL must be configured')
+  }
+
+  if (!import.meta.env.DEV) {
+    return configuredApiUrl
+  }
+
+  const apiUrl = new URL(configuredApiUrl)
+  apiUrl.hostname = window.location.hostname
+
+  return apiUrl.origin
+}
+
+export const API_BASE = resolveApiBase()

frontend/website/vite.config.ts

@@ -1,12 +1,30 @@
+import { existsSync, readFileSync } from 'node:fs'
 import { fileURLToPath, URL } from 'node:url'
 
 import { defineConfig } from 'vite'
+import type { ServerOptions } from 'vite'
 import vue from '@vitejs/plugin-vue'
 import vueJsx from '@vitejs/plugin-vue-jsx'
 import vueDevTools from 'vite-plugin-vue-devtools'
 
+const certificateKeyPath = fileURLToPath(
+  new URL('../../.cert/localhost-key.pem', import.meta.url),
+)
+const certificatePath = fileURLToPath(
+  new URL('../../.cert/localhost.pem', import.meta.url),
+)
+const serverOptions: ServerOptions = {}
+
+if (existsSync(certificateKeyPath) && existsSync(certificatePath)) {
+  serverOptions.https = {
+    key: readFileSync(certificateKeyPath),
+    cert: readFileSync(certificatePath),
+  }
+}
+
 // https://vite.dev/config/
 export default defineConfig({
+  server: serverOptions,
   plugins: [
     vue(),
     vueJsx(),

nix/shell-hook.sh

@@ -38,6 +38,7 @@ export PGUSER="postgres"
 export PGDATABASE="postgres"
 
 DEV_APP_URL="https://localhost:$CADDY_PORT"
+DEV_FRONTEND_URL="https://localhost:$VITE_PORT"
 DEV_DB_CONNECTION="pgsql"
 DEV_DB_HOST="$PGHOST"
 DEV_DB_PORT="5432"
@@ -99,6 +100,7 @@ set_env_value() {
 }
 
 set_env_value APP_URL "$DEV_APP_URL"
+set_env_value FRONTEND_URL "$DEV_FRONTEND_URL"
 set_env_value DB_CONNECTION "$DEV_DB_CONNECTION"
 set_env_value DB_HOST "$DEV_DB_HOST"
 set_env_value DB_PORT "$DEV_DB_PORT"
@@ -109,6 +111,13 @@ set_env_value MAIL_MAILER "$DEV_MAIL_MAILER"
 set_env_value MAIL_HOST "$DEV_MAIL_HOST"
 set_env_value MAIL_PORT "$DEV_MAIL_PORT"
 
+FRONTEND_ENV_FILE="$REPO_ROOT/frontend/website/.env.local"
+FRONTEND_API_URL="VITE_API_URL=$DEV_APP_URL"
+if [ ! -f "$FRONTEND_ENV_FILE" ] \
+  || [ "$(cat "$FRONTEND_ENV_FILE")" != "$FRONTEND_API_URL" ]; then
+  printf '%s\n' "$FRONTEND_API_URL" > "$FRONTEND_ENV_FILE"
+fi
+
 if [ ! -d "$REPO_ROOT/backend/vendor" ]; then
   echo "[composer] installing backend dependencies"
   (cd "$REPO_ROOT/backend" && composer install)

process-compose.yaml

@@ -63,6 +63,7 @@ processes:
         host: 127.0.0.1
         port: ${VITE_PORT:-5173}
         path: /
+        scheme: https
       initial_delay_seconds: 1
       period_seconds: 2