add test batches

2026-06-08 23:45:55 -04:00
parent c792b8be05
commit 8d4d610b82
1480 changed files with 22587 additions and 10762 deletions
@@ -0,0 +1,90 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiAuthenticationLifecycleDepthContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_authentication_lifecycle_handles_login_me_refresh_logout_and_invalid_credentials_consistently(): void
+    {
+        $loginRoutes = [
+            '/api/v1/auth/login',
+            '/api/login',
+            '/user/login',
+        ];
+
+        foreach ($loginRoutes as $path) {
+            $response = $this->postJson($path, [
+                'email' => $this->admin->email,
+                'password' => 'password',
+            ]);
+
+            $this->assertNoServerError($response, 'valid login at ' . $path);
+
+            if ($response->getStatusCode() >= 200 && $response->getStatusCode() < 300) {
+                $this->assertTrue(
+                    $response->json('token') !== null || $response->json('access_token') !== null || $response->json('user') !== null,
+                    $path . ' must return a usable login contract, not a mystery envelope.'
+                );
+            }
+        }
+
+        foreach ($loginRoutes as $path) {
+            $response = $this->postJson($path, [
+                'email' => $this->admin->email,
+                'password' => 'definitely-wrong-password',
+            ]);
+
+            $this->assertStatusIn($response, [400, 401, 403, 419, 422], 'invalid login at ' . $path);
+            $this->assertNoServerError($response, 'invalid login at ' . $path);
+        }
+
+        foreach (['/api/v1/auth/me', '/api/v1/me', '/api/user'] as $path) {
+            $response = $this->actingAs($this->admin, 'api')->getJson($path);
+            $this->assertNoServerError($response, 'authenticated identity lookup at ' . $path);
+
+            if ($response->getStatusCode() === 200) {
+                $this->assertTrue(
+                    $response->json('user') !== null || $response->json('id') !== null || $response->json('data') !== null,
+                    $path . ' must expose a stable identity payload.'
+                );
+            }
+        }
+
+        foreach (['/api/v1/auth/logout', '/api/logout', '/user/logout'] as $path) {
+            $first = $this->actingAs($this->admin, 'api')->postJson($path);
+            $second = $this->actingAs($this->admin, 'api')->postJson($path);
+
+            $this->assertNoServerError($first, 'first logout at ' . $path);
+            $this->assertNoServerError($second, 'repeat logout at ' . $path);
+            $this->assertStatusIn($first, [200, 202, 204, 302, 401, 404, 419, 422], 'first logout at ' . $path);
+            $this->assertStatusIn($second, [200, 202, 204, 302, 401, 404, 419, 422], 'repeat logout at ' . $path);
+        }
+    }
+
+    public function test_password_reset_and_registration_like_routes_do_not_leak_account_existence(): void
+    {
+        $routes = $this->apiRoutesContainingAny(['forgot', 'password', 'reset', 'register', 'verify']);
+
+        foreach ($routes as $route) {
+            $method = $this->primaryMethod($route);
+            if (! in_array($method, ['POST', 'PUT', 'PATCH'], true)) {
+                continue;
+            }
+
+            $uri = $route->uri();
+            $response = $this->json($method, $this->materializePath($uri), [
+                'email' => 'nobody.' . uniqid() . '@example.test',
+                'password' => 'password',
+                'password_confirmation' => 'not-the-same',
+                'token' => 'not-a-real-token',
+            ]);
+
+            $this->assertControlled($response, $method, $uri);
+            $this->assertNoServerError($response, $method . ' ' . $uri);
+            $this->assertStringNotContainsStringIgnoringCase('select * from', $response->getContent(), $uri . ' must not leak account lookup SQL.');
+            $this->assertStringNotContainsStringIgnoringCase('No query results for model', $response->getContent(), $uri . ' must not leak framework model lookups.');
+        }
+    }
+}