From b705d49aa1b807a0eaaffd808de6e02723598740 Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Fri, 31 Jul 2026 10:48:37 +0300
Subject: [PATCH] test me endpoint

---
 backend/tests/Feature/Auth/MeEndpointTest.php | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 backend/tests/Feature/Auth/MeEndpointTest.php

diff --git a/backend/tests/Feature/Auth/MeEndpointTest.php b/backend/tests/Feature/Auth/MeEndpointTest.php
new file mode 100644
index 0000000..ec19fc3
--- /dev/null
+++ b/backend/tests/Feature/Auth/MeEndpointTest.php
@@ -0,0 +1,74 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Auth\CreateSessionDto;
+use App\Auth\SessionRepository;
+use App\Http\Middleware\AuthMiddleware;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use App\User\UserRepository;
+use DateTimeImmutable;
+use DateTimeZone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class MeEndpointTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_me_returns_the_authenticated_user(): void
+    {
+        $now = new DateTimeImmutable(
+            '2026-07-31T12:00:00',
+            new DateTimeZone('UTC'),
+        );
+        $user = app(UserRepository::class)->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+        ));
+        app(SessionRepository::class)->create(new CreateSessionDto(
+            token: 'valid-token',
+            user: $user,
+            createdAt: $now,
+            expiresAt: $now->modify('+7 days'),
+        ));
+
+        $response = $this->withCredentials()
+            ->withUnencryptedCookie(
+                AuthMiddleware::COOKIE_NAME,
+                'valid-token',
+            )->getJson('/api/me');
+
+        $response->assertOk()->assertExactJson([
+            'user' => [
+                'id' => $user->getId(),
+                'email' => 'user@example.com',
+            ],
+        ]);
+    }
+
+    public function test_me_rejects_a_request_without_a_cookie(): void
+    {
+        $response = $this->getJson('/api/me');
+
+        $response
+            ->assertStatus(401)
+            ->assertExactJson(['error' => 'unauthenticated']);
+    }
+
+    public function test_me_allows_credentialed_frontend_requests(): void
+    {
+        $response = $this->withHeaders([
+            'Origin' => 'https://localhost:5173',
+            'Access-Control-Request-Method' => 'GET',
+        ])->options('/api/me');
+
+        $response
+            ->assertNoContent()
+            ->assertHeader(
+                'Access-Control-Allow-Origin',
+                'https://localhost:5173',
+            )
+            ->assertHeader('Access-Control-Allow-Credentials', 'true');
+    }
+}