batchCooking/apps/api/test/auth.test.ts

import { ErrorCode } from "@batch-cooking/shared";
import { expect } from "chai";
import request from "supertest";
import { createApp } from "../src/app.js";
import { prisma } from "../src/db/prisma.js";
import { resetDatabase } from "../test-support/reset-db.js";

/** Valid signup payload reused across tests. */
const validSignup = {
  firstName: "Nicolas",
  lastName: "Lefevre",
  email: "nicolas@example.com",
  password: "correct-horse-battery-staple",
};

describe("Auth", () => {
  const app = createApp();

  beforeEach(async () => {
    await resetDatabase();
  });

  after(async () => {
    await prisma.$disconnect();
  });

  describe("POST /auth/signup", () => {
    it("creates a profile and its house, and sets a session cookie", async () => {
      const res = await request(app).post("/auth/signup").send(validSignup);

      expect(res.status).to.equal(201);
      expect(res.body).to.include({
        firstName: "Nicolas",
        lastName: "Lefevre",
        email: "nicolas@example.com",
      });
      expect(res.body).to.not.have.property("passwordHash");
      expect(res.body.houseId).to.be.a("number");
      expect(res.headers["set-cookie"]?.[0]).to.include("session=");
    });

    it("rejects a duplicate email with 409 EMAIL_ALREADY_IN_USE", async () => {
      await request(app).post("/auth/signup").send(validSignup);
      const res = await request(app).post("/auth/signup").send(validSignup);

      expect(res.status).to.equal(409);
      expect(res.body.code).to.equal(ErrorCode.EMAIL_ALREADY_IN_USE);
    });

    it("rejects an invalid payload with 400 VALIDATION_ERROR", async () => {
      const res = await request(app)
        .post("/auth/signup")
        .send({ firstName: "X", lastName: "Y", email: "not-an-email", password: "short" });

      expect(res.status).to.equal(400);
      expect(res.body.code).to.equal(ErrorCode.VALIDATION_ERROR);
      expect(res.body.details).to.have.keys(["email", "password"]);
    });
  });

  describe("POST /auth/login", () => {
    beforeEach(async () => {
      await request(app).post("/auth/signup").send(validSignup);
    });

    it("logs in with correct credentials", async () => {
      const res = await request(app)
        .post("/auth/login")
        .send({ email: validSignup.email, password: validSignup.password });

      expect(res.status).to.equal(200);
      expect(res.body.email).to.equal(validSignup.email);
    });

    it("rejects a wrong password with 401 INVALID_CREDENTIALS", async () => {
      const res = await request(app)
        .post("/auth/login")
        .send({ email: validSignup.email, password: "wrong-password" });

      expect(res.status).to.equal(401);
      expect(res.body.code).to.equal(ErrorCode.INVALID_CREDENTIALS);
    });

    it("rejects an unknown email with 401 INVALID_CREDENTIALS", async () => {
      const res = await request(app)
        .post("/auth/login")
        .send({ email: "nobody@example.com", password: validSignup.password });

      expect(res.status).to.equal(401);
      expect(res.body.code).to.equal(ErrorCode.INVALID_CREDENTIALS);
    });
  });

  describe("GET /auth/me", () => {
    it("rejects requests without a session cookie with 401 NOT_AUTHENTICATED", async () => {
      const res = await request(app).get("/auth/me");

      expect(res.status).to.equal(401);
      expect(res.body.code).to.equal(ErrorCode.NOT_AUTHENTICATED);
    });

    it("returns the current profile when authenticated", async () => {
      const agent = request.agent(app);
      await agent.post("/auth/signup").send(validSignup);

      const res = await agent.get("/auth/me");

      expect(res.status).to.equal(200);
      expect(res.body.email).to.equal(validSignup.email);
    });
  });
});