test auth contracts

backend/tests/Unit/Auth/Middleware/AuthMiddlewareTest.php

@@ -154,6 +154,7 @@ class AuthMiddlewareTest extends TestCase
         return new User(
             id: 7,
             email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed-password',
         );
     }
 }

backend/tests/Unit/Auth/SessionTest.php

@@ -16,6 +16,7 @@ class SessionTest extends TestCase
         $user = new User(
             id: 7,
             email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed-password',
         );
         $createdAt = $this->utc('2026-07-31T12:00:00');
         $expiresAt = $this->utc('2026-08-07T12:00:00');
@@ -40,6 +41,7 @@ class SessionTest extends TestCase
             user: new User(
                 id: 7,
                 email: new EmailAddress('user@example.com'),
+                passwordHash: 'hashed-password',
             ),
             createdAt: $this->utc('2026-07-31T12:00:00'),
             expiresAt: $expiresAt,

backend/tests/Unit/Auth/UseCases/AuthenticateUserTest.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace Tests\Unit\Auth\UseCases;
+
+use App\Auth\UseCases\AuthenticateUser\AuthenticateUser;
+use App\Auth\UseCases\AuthenticateUser\AuthenticateUserRequest;
+use App\Exceptions\BadRequestException;
+use App\Exceptions\UnauthorizedException;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\User;
+use PHPUnit\Framework\TestCase;
+use Tests\Fakes\FakePasswordHasher;
+use Tests\Fakes\FakeUserRepository;
+
+class AuthenticateUserTest extends TestCase
+{
+    private FakeUserRepository $userRepository;
+
+    private FakePasswordHasher $passwordHasher;
+
+    private AuthenticateUser $useCase;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new FakeUserRepository;
+        $this->passwordHasher = new FakePasswordHasher;
+        $this->useCase = new AuthenticateUser(
+            $this->userRepository,
+            $this->passwordHasher,
+        );
+    }
+
+    public function test_null_email_throws_bad_request(): void
+    {
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('email is required');
+
+        $this->useCase->execute(new AuthenticateUserRequest(
+            email: null,
+            password: 'correct-password',
+        ));
+    }
+
+    public function test_null_password_throws_bad_request(): void
+    {
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('password is required');
+
+        $this->useCase->execute(new AuthenticateUserRequest(
+            email: 'user@example.com',
+            password: null,
+        ));
+    }
+
+    public function test_unknown_email_throws_unauthorized(): void
+    {
+        $this->expectException(UnauthorizedException::class);
+        $this->expectExceptionMessage('invalid credentials');
+
+        $this->useCase->execute(new AuthenticateUserRequest(
+            email: 'unknown@example.com',
+            password: 'correct-password',
+        ));
+    }
+
+    public function test_wrong_password_throws_unauthorized(): void
+    {
+        $this->createUser('correct-password');
+        $this->expectException(UnauthorizedException::class);
+        $this->expectExceptionMessage('invalid credentials');
+
+        $this->useCase->execute(new AuthenticateUserRequest(
+            email: 'user@example.com',
+            password: 'wrong-password',
+        ));
+    }
+
+    public function test_valid_credentials_return_user(): void
+    {
+        $user = $this->createUser('correct-password');
+
+        $authenticatedUser = $this->useCase->execute(
+            new AuthenticateUserRequest(
+                email: 'user@example.com',
+                password: 'correct-password',
+            ),
+        );
+
+        $this->assertSame($user->getId(), $authenticatedUser->getId());
+        $this->assertSame(
+            $user->getEmail()->value(),
+            $authenticatedUser->getEmail()->value(),
+        );
+    }
+
+    private function createUser(string $password): User
+    {
+        return $this->userRepository->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: $this->passwordHasher->hash($password),
+        ));
+    }
+}

backend/tests/Unit/Auth/UseCases/CreateSessionTest.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Tests\Unit\Auth\UseCases;
+
+use App\Auth\UseCases\CreateSession\CreateSession;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\User;
+use DateTimeImmutable;
+use DateTimeZone;
+use PHPUnit\Framework\TestCase;
+use Tests\Fakes\FakeClock;
+use Tests\Fakes\FakeSessionRepository;
+use Tests\Fakes\FakeTokenGenerator;
+
+class CreateSessionTest extends TestCase
+{
+    private DateTimeImmutable $now;
+
+    private FakeSessionRepository $sessionRepository;
+
+    private CreateSession $useCase;
+
+    protected function setUp(): void
+    {
+        $this->now = new DateTimeImmutable(
+            '2026-07-31T12:00:00',
+            new DateTimeZone('UTC'),
+        );
+        $this->sessionRepository = new FakeSessionRepository;
+        $this->useCase = new CreateSession(
+            $this->sessionRepository,
+            new FakeTokenGenerator(['session-token']),
+            new FakeClock($this->now),
+        );
+    }
+
+    public function test_creates_a_seven_day_session_with_generated_token(): void
+    {
+        $user = $this->user();
+
+        $session = $this->useCase->execute($user);
+
+        $this->assertSame('session-token', $session->getToken());
+        $this->assertSame($user, $session->getUser());
+        $this->assertSame($this->now, $session->getCreatedAt());
+        $this->assertEquals(
+            $this->now->modify('+7 days'),
+            $session->getExpiresAt(),
+        );
+    }
+
+    public function test_created_session_is_findable_by_token(): void
+    {
+        $this->useCase->execute($this->user());
+
+        $session = $this->sessionRepository->findByToken('session-token');
+
+        $this->assertNotNull($session);
+        $this->assertSame(7, $session->getUser()->getId());
+    }
+
+    private function user(): User
+    {
+        return new User(
+            id: 7,
+            email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed:correct-password',
+        );
+    }
+}