From de62bd9f44afa16d917ac3e0d1651d1edf484298 Mon Sep 17 00:00:00 2001
From: DualFroz <me@dualfroz.com>
Date: Fri, 28 Aug 2026 09:42:54 +0200
Subject: [PATCH] test: add auth and permissions tests

---
 tests/AuthTest.php        | 83 +++++++++++++++++++++++++++++++++++++++
 tests/PermissionsTest.php | 83 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 166 insertions(+)
 create mode 100644 tests/AuthTest.php
 create mode 100644 tests/PermissionsTest.php

diff --git a/tests/AuthTest.php b/tests/AuthTest.php
new file mode 100644
index 0000000..dd57f8c
--- /dev/null
+++ b/tests/AuthTest.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace Bazaar\Tests;
+
+use Bazaar\Core\Session;
+use Bazaar\Repositories\UserRepository;
+use Bazaar\Services\Auth;
+
+final class AuthTest extends DatabaseTestCase
+{
+    private UserRepository $users;
+    private Auth $auth;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->users = new UserRepository($this->db);
+        $this->auth = new Auth(new Session(), $this->users);
+    }
+
+    public function testRegisterStoresAHashNotThePlaintext(): void
+    {
+        $userId = $this->auth->register('buyer@bazaar.test', 'sup3rsecret', 'Buyer');
+
+        $user = $this->users->findById($userId);
+        $this->assertNotSame('sup3rsecret', $user['passwordHash']);
+        $this->assertTrue(password_verify('sup3rsecret', $user['passwordHash']));
+    }
+
+    public function testEmailIsNormalizedAndUniquenessDetected(): void
+    {
+        $this->auth->register('Mixed@Bazaar.test', 'sup3rsecret', 'Buyer');
+
+        $this->assertTrue($this->users->emailExists('mixed@bazaar.test'));
+        $this->assertNotNull($this->users->findByEmail('MIXED@BAZAAR.TEST'));
+    }
+
+    public function testAttemptSucceedsWithCorrectPassword(): void
+    {
+        $this->auth->register('ok@bazaar.test', 'correcthorse', 'Ok');
+
+        $this->assertNotNull($this->auth->attempt('ok@bazaar.test', 'correcthorse'));
+    }
+
+    public function testAttemptFailsWithWrongPassword(): void
+    {
+        $this->auth->register('nope@bazaar.test', 'correcthorse', 'Nope');
+
+        $this->assertNull($this->auth->attempt('nope@bazaar.test', 'wrongpassword'));
+        $this->assertNull($this->auth->attempt('ghost@bazaar.test', 'correcthorse'));
+    }
+
+    public function testLoginEstablishesSessionAndIdentity(): void
+    {
+        $userId = $this->auth->register('session@bazaar.test', 'correcthorse', 'Session');
+        $this->assertFalse($this->auth->check());
+
+        $this->auth->login($this->users->findById($userId));
+
+        $this->assertTrue($this->auth->check());
+        $this->assertSame($userId, $this->auth->id());
+        $this->assertSame('session@bazaar.test', $this->auth->user()['email']);
+    }
+
+    public function testLogoutClearsIdentity(): void
+    {
+        $userId = $this->auth->register('bye@bazaar.test', 'correcthorse', 'Bye');
+        $this->auth->login($this->users->findById($userId));
+
+        $this->auth->logout();
+
+        $this->assertFalse($this->auth->check());
+        $this->assertNull($this->auth->id());
+    }
+
+    public function testAdminFlagIsReflected(): void
+    {
+        $adminId = $this->users->create('boss@bazaar.test', password_hash('correcthorse', PASSWORD_DEFAULT), 'Boss', true);
+        $this->auth->login($this->users->findById($adminId));
+
+        $this->assertTrue($this->auth->isAdmin());
+    }
+}
diff --git a/tests/PermissionsTest.php b/tests/PermissionsTest.php
new file mode 100644
index 0000000..48dd1c1
--- /dev/null
+++ b/tests/PermissionsTest.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace Bazaar\Tests;
+
+use Bazaar\Core\Session;
+use Bazaar\Repositories\UserRepository;
+use Bazaar\Services\Auth;
+use Bazaar\Support\Permissions;
+use Bazaar\Support\Role;
+
+final class PermissionsTest extends DatabaseTestCase
+{
+    private UserRepository $users;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->users = new UserRepository($this->db);
+    }
+
+    private function authFor(int $userId): Auth
+    {
+        $_SESSION = [];
+        $auth = new Auth(new Session(), $this->users);
+        $auth->login($this->users->findById($userId));
+        return $auth;
+    }
+
+    public function testManagerIsStaffButNotAdmin(): void
+    {
+        $id = $this->users->create('m@bazaar.test', 'hash', 'Manager', false, Role::manager);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->isStaff());
+        $this->assertFalse($auth->isAdmin());
+        $this->assertSame(Role::manager, $auth->role());
+    }
+
+    public function testManagerCanRunCatalogButNotCouponsOrUsers(): void
+    {
+        $id = $this->users->create('m@bazaar.test', 'hash', 'Manager', false, Role::manager);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->can(Permissions::catalogManage));
+        $this->assertTrue($auth->can(Permissions::ordersManage));
+        $this->assertTrue($auth->can(Permissions::reviewsModerate));
+        $this->assertFalse($auth->can(Permissions::couponsManage));
+        $this->assertFalse($auth->can(Permissions::usersManage));
+    }
+
+    public function testAdminCanDoEverything(): void
+    {
+        $id = $this->users->create('admin@bazaar.test', 'hash', 'Admin', true);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->isAdmin());
+        $this->assertTrue($auth->isStaff());
+        $this->assertTrue($auth->can(Permissions::couponsManage));
+        $this->assertTrue($auth->can(Permissions::usersManage));
+    }
+
+    public function testCustomerHasNoStaffAccess(): void
+    {
+        $id = $this->users->create('c@bazaar.test', 'hash', 'Customer');
+        $auth = $this->authFor($id);
+
+        $this->assertFalse($auth->isStaff());
+        $this->assertFalse($auth->can(Permissions::catalogManage));
+    }
+
+    public function testSetRolePromotesAndDemotes(): void
+    {
+        $id = $this->users->create('u@bazaar.test', 'hash', 'User');
+
+        $this->users->setRole($id, Role::admin);
+        $this->assertTrue($this->authFor($id)->isAdmin());
+
+        $this->users->setRole($id, Role::manager);
+        $promoted = $this->authFor($id);
+        $this->assertFalse($promoted->isAdmin());
+        $this->assertTrue($promoted->isStaff());
+    }
+}