test email signup flow

backend/tests/Feature/Auth/ConfirmEmailEndpointTest.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\PasswordHasher;
+use App\Auth\SessionRepository;
+use App\Email\EmailConfirmationToken\EmailConfirmationTokenRepository;
+use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationToken;
+use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationTokenRequest;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ConfirmEmailEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_confirmation_sets_password_and_starts_session(): void
+    {
+        $userRepository = app(UserRepository::class);
+        $user = $userRepository->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: null,
+        ));
+        $token = app(CreateEmailConfirmationToken::class)->execute(
+            new CreateEmailConfirmationTokenRequest(
+                user: $user,
+                minuteOffset: 10,
+            ),
+        );
+
+        $response = $this->postJson('/api/confirm-email', [
+            'token' => $token->getToken(),
+            'password' => 'password123',
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonPath('user.email', 'user@example.com');
+        $confirmedUser = $userRepository->find($user->getId());
+        $this->assertNotNull($confirmedUser);
+        $passwordHash = $confirmedUser->getPasswordHash();
+        $this->assertNotNull($passwordHash);
+        $this->assertTrue(
+            app(PasswordHasher::class)->verify('password123', $passwordHash),
+        );
+        $this->assertNull(
+            app(EmailConfirmationTokenRepository::class)
+                ->findByToken($token->getToken()),
+        );
+        $cookie = $response->getCookie(AuthMiddleware::COOKIE_NAME, false);
+        $this->assertNotNull($cookie);
+        $this->assertNotNull(
+            app(SessionRepository::class)->findByToken($cookie->getValue()),
+        );
+    }
+
+    public function test_confirmation_rejects_an_unknown_token(): void
+    {
+        $response = $this->postJson('/api/confirm-email', [
+            'token' => 'unknown-token',
+            'password' => 'password123',
+        ]);
+
+        $response->assertConflict();
+        $response->assertJson(['error' => 'token not found']);
+    }
+}