first work

tests/Feature/LoginTest.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace Rodev\DelegateAuth\Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Rodev\DelegateAuth\Tests\Fixtures\User;
+use Rodev\DelegateAuth\Tests\TestCase;
+
+class LoginTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_valid_token_authenticates_user_and_redirects(): void
+    {
+        $user  = User::create(['email' => 'user@example.com']);
+        $token = $this->makeToken(['email' => 'user@example.com']);
+
+        $this->get(route('delegate-auth.login', ['token' => $token]))
+             ->assertRedirect('/dashboard');
+
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_missing_token_fails_validation(): void
+    {
+        $this->get(route('delegate-auth.login'))
+             ->assertSessionHasErrors('token');
+    }
+
+    public function test_malformed_token_returns_401(): void
+    {
+        $this->get(route('delegate-auth.login', ['token' => 'notavalidtoken']))
+             ->assertStatus(401);
+    }
+
+    public function test_token_encrypted_with_wrong_key_returns_401(): void
+    {
+        $wrongKey  = substr(hash('sha256', 'wrong-key', binary: true), 0, 32);
+        $iv        = random_bytes(16);
+        $encrypted = openssl_encrypt(json_encode(['email' => 'user@example.com']), 'AES-256-CBC', $wrongKey, 0, $iv);
+        $token     = base64_encode($iv).'.'.$encrypted;
+
+        User::create(['email' => 'user@example.com']);
+
+        $this->get(route('delegate-auth.login', ['token' => $token]))
+             ->assertStatus(401);
+    }
+
+    public function test_token_for_unknown_user_returns_401(): void
+    {
+        $token = $this->makeToken(['email' => 'nobody@example.com']);
+
+        $this->get(route('delegate-auth.login', ['token' => $token]))
+             ->assertStatus(401);
+    }
+
+    public function test_token_missing_user_field_returns_401(): void
+    {
+        $token = $this->makeToken(['foo' => 'bar']);
+
+        $this->get(route('delegate-auth.login', ['token' => $token]))
+             ->assertStatus(401);
+    }
+}

tests/Feature/LogoutTest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Rodev\DelegateAuth\Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Rodev\DelegateAuth\Tests\Fixtures\User;
+use Rodev\DelegateAuth\Tests\TestCase;
+
+class LogoutTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_logout_disconnects_authenticated_user_and_redirects(): void
+    {
+        $user = User::create(['email' => 'user@example.com']);
+
+        $this->actingAs($user)
+             ->post(route('delegate-auth.logout'))
+             ->assertRedirect('/');
+
+        $this->assertGuest();
+    }
+
+    public function test_logout_as_guest_still_redirects(): void
+    {
+        $this->post(route('delegate-auth.logout'))
+             ->assertRedirect('/');
+    }
+}