trypost/tests/Feature/Settings/AuthenticationTest.php

<?php

declare(strict_types=1);

use App\Models\User;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;

test('authentication page is displayed', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->get(route('app.authentication.edit'))
        ->assertOk()
        ->assertInertia(fn ($page) => $page
            ->component('settings/profile/Authentication')
            ->has('sessions')
            ->where('hasPassword', true)
            ->has('connectedAccounts')
        );
});

test('password can be updated', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->put(route('app.authentication.update-password'), [
            'current_password' => 'password',
            'password' => 'new-password',
            'password_confirmation' => 'new-password',
        ])
        ->assertSessionHasNoErrors()
        ->assertRedirect(route('app.authentication.edit'));

    expect(Hash::check('new-password', $user->refresh()->password))->toBeTrue();
});

test('correct password must be provided to update password', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->put(route('app.authentication.update-password'), [
            'current_password' => 'wrong-password',
            'password' => 'new-password',
            'password_confirmation' => 'new-password',
        ])
        ->assertSessionHasErrors('current_password')
        ->assertRedirect(route('app.authentication.edit'));
});

test('password update requires authentication', function () {
    $this->put(route('app.authentication.update-password'), [])
        ->assertRedirect(route('login'));
});

test('password must be confirmed', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->put(route('app.authentication.update-password'), [
            'current_password' => 'password',
            'password' => 'new-password',
            'password_confirmation' => 'wrong-confirmation',
        ])
        ->assertSessionHasErrors('password');
});

test('user without a password can set one without current_password', function () {
    $user = User::factory()->create(['password' => null, 'google_id' => 'google-123']);

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->put(route('app.authentication.update-password'), [
            'password' => 'new-password',
            'password_confirmation' => 'new-password',
        ])
        ->assertSessionHasNoErrors();

    expect(Hash::check('new-password', $user->refresh()->password))->toBeTrue();
});

test('disconnect provider removes the link', function () {
    $user = User::factory()->create(['google_id' => 'google-123', 'password' => bcrypt('password')]);

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->delete(route('app.authentication.disconnect-provider', 'google'))
        ->assertRedirect(route('app.authentication.edit'));

    expect($user->refresh()->google_id)->toBeNull();
});

test('disconnect provider blocked when it is the only sign-in method', function () {
    $user = User::factory()->create(['google_id' => 'google-123', 'password' => null]);

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->delete(route('app.authentication.disconnect-provider', 'google'))
        ->assertSessionHas('flash.error');

    expect($user->refresh()->google_id)->toBe('google-123');
});

test('disconnect provider rejects unknown provider', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->delete(route('app.authentication.disconnect-provider', 'twitter'))
        ->assertNotFound();
});

test('destroy other sessions removes other rows for the user', function () {
    if (config('session.driver') !== 'database') {
        $this->markTestSkipped('Session driver is not database.');
    }

    $user = User::factory()->create();
    $sessionsTable = config('session.table', 'sessions');

    DB::table($sessionsTable)->insert([
        [
            'id' => 'other-session-id',
            'user_id' => $user->id,
            'ip_address' => '1.2.3.4',
            'user_agent' => 'OtherDevice',
            'payload' => '',
            'last_activity' => time(),
        ],
    ]);

    $this->actingAs($user)
        ->from(route('app.authentication.edit'))
        ->delete(route('app.authentication.destroy-other-sessions'), [
            'password' => 'password',
        ])
        ->assertRedirect(route('app.authentication.edit'));

    expect(DB::table($sessionsTable)->where('id', 'other-session-id')->exists())->toBeFalse();
});