Add /api/auth/{register,login,logout,me} with first-user-is-admin rule

2026-06-11 18:34:07 +00:00
parent 8a7d01ac9e
commit 2a208e81b2
3 changed files with 116 additions and 0 deletions
@@ -0,0 +1,50 @@
+using System.Net;
+using System.Net.Http.Json;
+using FluentAssertions;
+using Xunit;
+
+namespace backend.tests;
+
+public class AuthTests(ApiFactory factory) : IClassFixture<ApiFactory>
+{
+    private readonly ApiFactory _factory = factory;
+
+    [Fact]
+    public async Task Register_then_login_then_me_returns_user()
+    {
+        var client = _factory.CreateClient();
+
+        var reg = await client.PostAsJsonAsync("/api/auth/register",
+            new { email = "first@example.com", password = "Passw0rd!" });
+        reg.StatusCode.Should().Be(HttpStatusCode.OK);
+
+        var login = await client.PostAsJsonAsync("/api/auth/login",
+            new { email = "first@example.com", password = "Passw0rd!" });
+        login.StatusCode.Should().Be(HttpStatusCode.OK);
+
+        var me = await client.GetAsync("/api/auth/me");
+        me.StatusCode.Should().Be(HttpStatusCode.OK);
+        (await me.Content.ReadAsStringAsync()).Should().Contain("first@example.com");
+    }
+
+    [Fact]
+    public async Task Me_without_login_returns_401()
+    {
+        var client = _factory.CreateClient();
+        var res = await client.GetAsync("/api/auth/me");
+        res.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact]
+    public async Task First_user_is_admin()
+    {
+        var client = _factory.CreateClient();
+        await client.PostAsJsonAsync("/api/auth/register",
+            new { email = "first@example.com", password = "Passw0rd!" });
+        await client.PostAsJsonAsync("/api/auth/login",
+            new { email = "first@example.com", password = "Passw0rd!" });
+
+        var me = await client.GetAsync("/api/auth/me");
+        (await me.Content.ReadAsStringAsync()).Should().Contain("\"isAdmin\":true");
+    }
+}