diff --git a/backend/tests/Feature/Auth/EloquentSessionRepositoryTest.php b/backend/tests/Feature/Auth/EloquentSessionRepositoryTest.php
new file mode 100644
index 0000000..c9f76e2
--- /dev/null
+++ b/backend/tests/Feature/Auth/EloquentSessionRepositoryTest.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\CreateSessionDto;
+use App\Auth\SessionRepository;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use DateTimeImmutable;
+use DateTimeZone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class EloquentSessionRepositoryTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_creates_and_finds_a_session(): void
+    {
+        $user = app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+        ));
+        $createdAt = $this->utc('2026-07-31T12:00:00');
+        $expiresAt = $this->utc('2026-08-07T12:00:00');
+        $repository = app(SessionRepository::class);
+
+        $session = $repository->create(new CreateSessionDto(
+            token: 'session-token',
+            user: $user,
+            createdAt: $createdAt,
+            expiresAt: $expiresAt,
+        ));
+
+        $this->assertSame('session-token', $session->getToken());
+        $this->assertSame($user, $session->getUser());
+        $this->assertDatabaseHas('auth_sessions', [
+            'token' => 'session-token',
+            'user_id' => $user->getId(),
+        ]);
+
+        $foundSession = $repository->findByToken('session-token');
+
+        $this->assertNotNull($foundSession);
+        $this->assertSame(
+            $user->getId(),
+            $foundSession->getUser()->getId(),
+        );
+        $this->assertEquals($createdAt, $foundSession->getCreatedAt());
+        $this->assertEquals($expiresAt, $foundSession->getExpiresAt());
+    }
+
+    public function test_it_returns_null_for_an_unknown_token(): void
+    {
+        $repository = app(SessionRepository::class);
+
+        $this->assertNull($repository->findByToken('unknown-token'));
+    }
+
+    public function test_it_deletes_a_session_by_token(): void
+    {
+        $user = app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+        ));
+        $repository = app(SessionRepository::class);
+        $repository->create(new CreateSessionDto(
+            token: 'session-token',
+            user: $user,
+            createdAt: $this->utc('2026-07-31T12:00:00'),
+            expiresAt: $this->utc('2026-08-07T12:00:00'),
+        ));
+
+        $repository->deleteByToken('session-token');
+
+        $this->assertNull($repository->findByToken('session-token'));
+        $this->assertDatabaseMissing('auth_sessions', [
+            'token' => 'session-token',
+        ]);
+    }
+
+    private function utc(string $time): DateTimeImmutable
+    {
+        return new DateTimeImmutable($time, new DateTimeZone('UTC'));
+    }
+}
diff --git a/backend/tests/Unit/Auth/SessionTest.php b/backend/tests/Unit/Auth/SessionTest.php
new file mode 100644
index 0000000..7804333
--- /dev/null
+++ b/backend/tests/Unit/Auth/SessionTest.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace Tests\Unit\Auth;
+
+use App\Auth\Session;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\User;
+use DateTimeImmutable;
+use DateTimeZone;
+use PHPUnit\Framework\TestCase;
+
+class SessionTest extends TestCase
+{
+    public function test_it_exposes_its_values(): void
+    {
+        $user = new User(
+            id: 7,
+            email: new EmailAddress('user@example.com'),
+        );
+        $createdAt = $this->utc('2026-07-31T12:00:00');
+        $expiresAt = $this->utc('2026-08-07T12:00:00');
+        $session = new Session(
+            token: 'session-token',
+            user: $user,
+            createdAt: $createdAt,
+            expiresAt: $expiresAt,
+        );
+
+        $this->assertSame('session-token', $session->getToken());
+        $this->assertSame($user, $session->getUser());
+        $this->assertSame($createdAt, $session->getCreatedAt());
+        $this->assertSame($expiresAt, $session->getExpiresAt());
+    }
+
+    public function test_it_expires_at_the_expiry_time(): void
+    {
+        $expiresAt = $this->utc('2026-08-07T12:00:00');
+        $session = new Session(
+            token: 'session-token',
+            user: new User(
+                id: 7,
+                email: new EmailAddress('user@example.com'),
+            ),
+            createdAt: $this->utc('2026-07-31T12:00:00'),
+            expiresAt: $expiresAt,
+        );
+
+        $this->assertFalse(
+            $session->isExpired($expiresAt->modify('-1 second')),
+        );
+        $this->assertTrue($session->isExpired($expiresAt));
+        $this->assertTrue(
+            $session->isExpired($expiresAt->modify('+1 second')),
+        );
+    }
+
+    private function utc(string $time): DateTimeImmutable
+    {
+        return new DateTimeImmutable($time, new DateTimeZone('UTC'));
+    }
+}