test password login

backend/tests/Feature/Auth/LoginEndpointTest.php

@@ -0,0 +1,163 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\Clock;
+use App\Auth\SessionRepository;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\User;
+use App\User\UserRepository;
+use DateTimeImmutable;
+use DateTimeZone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Symfony\Component\HttpFoundation\Cookie;
+use Tests\Fakes\FakeClock;
+use Tests\TestCase;
+
+class LoginEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private DateTimeImmutable $currentTime;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->currentTime = new DateTimeImmutable(
+            '2026-07-31T12:00:00',
+            new DateTimeZone('UTC'),
+        );
+        $this->app->instance(
+            Clock::class,
+            new FakeClock($this->currentTime),
+        );
+        config()->set('session.lifetime', 120);
+        config()->set('session.path', '/');
+        config()->set('session.secure', true);
+        config()->set('session.same_site', 'lax');
+    }
+
+    public function test_login_validates_its_request(): void
+    {
+        $this->postJson('/api/login')
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['email', 'password']);
+
+        $this->postJson('/api/login', [
+            'email' => 'invalid-email',
+            'password' => 'password',
+        ])->assertUnprocessable()
+            ->assertJsonValidationErrors(['email']);
+    }
+
+    public function test_login_rejects_invalid_credentials_generically(): void
+    {
+        $this->createUser();
+
+        $this->postJson('/api/login', [
+            'email' => 'user@example.com',
+            'password' => 'wrong-password',
+        ])->assertUnauthorized()
+            ->assertExactJson(['error' => 'invalid_credentials'])
+            ->assertCookieMissing(AuthMiddleware::COOKIE_NAME);
+
+        $this->postJson('/api/login', [
+            'email' => 'unknown@example.com',
+            'password' => 'correct-password',
+        ])->assertUnauthorized()
+            ->assertExactJson(['error' => 'invalid_credentials'])
+            ->assertCookieMissing(AuthMiddleware::COOKIE_NAME);
+
+        $this->assertDatabaseCount('sessions', 0);
+    }
+
+    public function test_login_creates_a_session_and_returns_the_user(): void
+    {
+        $user = $this->createUser();
+
+        $response = $this->postJson('/api/login', [
+            'email' => ' user@EXAMPLE.COM ',
+            'password' => 'correct-password',
+        ]);
+
+        $response->assertOk()->assertExactJson([
+            'user' => [
+                'id' => $user->getId(),
+                'email' => 'user@example.com',
+            ],
+        ]);
+
+        $cookie = $this->findAuthCookie(
+            $response->headers->getCookies(),
+        );
+        $token = $cookie->getValue();
+
+        $this->assertMatchesRegularExpression(
+            '/^[a-f0-9]{64}$/',
+            $token,
+        );
+        $this->assertTrue($cookie->isHttpOnly());
+        $this->assertTrue($cookie->isSecure());
+        $this->assertSame('/', $cookie->getPath());
+        $this->assertSame('lax', $cookie->getSameSite());
+        $this->assertSame(
+            $this->currentTime->modify('+120 minutes')->getTimestamp(),
+            $cookie->getExpiresTime(),
+        );
+
+        $session = app(SessionRepository::class)->findByToken($token);
+
+        $this->assertNotNull($session);
+        $this->assertSame($user->getId(), $session->getUser()->getId());
+        $this->assertEquals(
+            $this->currentTime,
+            $session->getCreatedAt(),
+        );
+        $this->assertEquals(
+            $this->currentTime->modify('+120 minutes'),
+            $session->getExpiresAt(),
+        );
+    }
+
+    public function test_login_throttles_repeated_attempts(): void
+    {
+        $this->createUser();
+
+        for ($attempt = 1; $attempt <= 5; $attempt++) {
+            $this->postJson('/api/login', [
+                'email' => 'user@example.com',
+                'password' => 'wrong-password',
+            ])->assertUnauthorized();
+        }
+
+        $this->postJson('/api/login', [
+            'email' => 'user@example.com',
+            'password' => 'wrong-password',
+        ])->assertStatus(429);
+    }
+
+    private function createUser(): User
+    {
+        return app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            password: 'correct-password',
+        ));
+    }
+
+    /**
+     * @param  array<int, Cookie>  $cookies
+     */
+    private function findAuthCookie(array $cookies): Cookie
+    {
+        foreach ($cookies as $cookie) {
+            if ($cookie->getName() === AuthMiddleware::COOKIE_NAME) {
+                return $cookie;
+            }
+        }
+
+        $this->fail('The authentication cookie was not set.');
+    }
+}