test logout flow

backend/tests/Feature/Auth/LogoutEndpointTest.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\CreateSessionDto;
+use App\Auth\SessionRepository;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use DateTimeImmutable;
+use DateTimeZone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class LogoutEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_logout_deletes_session_and_clears_cookie(): void
+    {
+        $now = new DateTimeImmutable(
+            '2026-07-31T12:00:00',
+            new DateTimeZone('UTC'),
+        );
+        $user = app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed-password',
+        ));
+        app(SessionRepository::class)->create(new CreateSessionDto(
+            token: 'session-token',
+            user: $user,
+            createdAt: $now,
+            expiresAt: $now->modify('+7 days'),
+        ));
+
+        $response = $this->withCredentials()
+            ->withUnencryptedCookie(
+                AuthMiddleware::COOKIE_NAME,
+                'session-token',
+            )->postJson('/api/logout');
+
+        $response->assertNoContent();
+        $response->assertCookieExpired(AuthMiddleware::COOKIE_NAME);
+        $this->assertNull(
+            app(SessionRepository::class)->findByToken('session-token'),
+        );
+    }
+
+    public function test_logout_rejects_a_request_without_a_cookie(): void
+    {
+        $response = $this->postJson('/api/logout');
+
+        $response
+            ->assertStatus(401)
+            ->assertExactJson(['error' => 'unauthenticated']);
+    }
+}