test email signup flow

backend/tests/Feature/Auth/ConfirmEmailEndpointTest.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\PasswordHasher;
+use App\Auth\SessionRepository;
+use App\Email\EmailConfirmationToken\EmailConfirmationTokenRepository;
+use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationToken;
+use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationTokenRequest;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ConfirmEmailEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_confirmation_sets_password_and_starts_session(): void
+    {
+        $userRepository = app(UserRepository::class);
+        $user = $userRepository->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: null,
+        ));
+        $token = app(CreateEmailConfirmationToken::class)->execute(
+            new CreateEmailConfirmationTokenRequest(
+                user: $user,
+                minuteOffset: 10,
+            ),
+        );
+
+        $response = $this->postJson('/api/confirm-email', [
+            'token' => $token->getToken(),
+            'password' => 'password123',
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonPath('user.email', 'user@example.com');
+        $confirmedUser = $userRepository->find($user->getId());
+        $this->assertNotNull($confirmedUser);
+        $passwordHash = $confirmedUser->getPasswordHash();
+        $this->assertNotNull($passwordHash);
+        $this->assertTrue(
+            app(PasswordHasher::class)->verify('password123', $passwordHash),
+        );
+        $this->assertNull(
+            app(EmailConfirmationTokenRepository::class)
+                ->findByToken($token->getToken()),
+        );
+        $cookie = $response->getCookie(AuthMiddleware::COOKIE_NAME, false);
+        $this->assertNotNull($cookie);
+        $this->assertNotNull(
+            app(SessionRepository::class)->findByToken($cookie->getValue()),
+        );
+    }
+
+    public function test_confirmation_rejects_an_unknown_token(): void
+    {
+        $response = $this->postJson('/api/confirm-email', [
+            'token' => 'unknown-token',
+            'password' => 'password123',
+        ]);
+
+        $response->assertConflict();
+        $response->assertJson(['error' => 'token not found']);
+    }
+}

backend/tests/Feature/Auth/SignupEndpointTest.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Email\EmailConfirmationToken\EmailConfirmationTokenRepository;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class SignupEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_signup_creates_a_pending_user_and_confirmation_token(): void
+    {
+        $response = $this->postJson('/api/signup', [
+            'email' => 'Founder@EXAMPLE.COM',
+        ]);
+
+        $response->assertCreated();
+        $user = app(UserRepository::class)->findByEmail(
+            new EmailAddress('Founder@example.com'),
+        );
+        $this->assertNotNull($user);
+        $this->assertNull($user->getPasswordHash());
+        $this->assertNotNull(
+            app(EmailConfirmationTokenRepository::class)
+                ->findByUser($user),
+        );
+    }
+
+    public function test_signup_rejects_an_existing_confirmed_account(): void
+    {
+        app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed-password',
+        ));
+
+        $response = $this->postJson('/api/signup', [
+            'email' => 'user@example.com',
+        ]);
+
+        $response->assertConflict();
+        $response->assertJson([
+            'error' => 'user@example.com already has an account',
+        ]);
+    }
+}

backend/tests/Feature/User/EloquentUserRepositoryTest.php

@@ -78,4 +78,23 @@ class EloquentUserRepositoryTest extends TestCase
             new EmailAddress('unknown@example.com'),
         ));
     }
+
+    public function test_it_persists_confirmation_of_a_pending_user(): void
+    {
+        $repository = app(UserRepository::class);
+        $user = $repository->create(new CreateUserDto(
+            email: new EmailAddress('pending@example.com'),
+            passwordHash: null,
+        ));
+
+        $this->assertNull($user->getPasswordHash());
+        $user->setPasswordHash('hashed-password');
+        $updatedUser = $repository->update($user);
+
+        $this->assertSame('hashed-password', $updatedUser->getPasswordHash());
+        $this->assertDatabaseHas('users', [
+            'id' => $user->getId(),
+            'passwordHash' => 'hashed-password',
+        ]);
+    }
 }