munch-ease-frontend/tests/auth.api.test.ts

import { describe, it, expect } from 'vitest'
import { server, http, HttpResponse } from './test-setup'
import { logout, loginWithPassword, createAccount, handleGoogleLogin } from '@/api/auth'
import { api } from '@/api/client'

describe('auth api (jwt + households)', () => {
  it('loginWithPassword posts email/password and returns user from token response', async () => {
    server.use(
      http.post('*/api/v1/auth/login', async ({ request }) => {
        const body = await request.json()
        expect(body).toEqual({ email: 'test@example.com', password: 'secret' })
        return HttpResponse.json({ accessToken: 'abc123', tokenType: 'bearer', user: { id: 123, email: 'test@example.com', displayName: 'Test User' } })
      })
    )
    const user = await loginWithPassword('test@example.com', 'secret')
    expect(user.id).toBe(123)
    expect(user.displayName).toBe('Test User')

    // Subsequent API call should include Authorization header
    server.use(
      http.get('*/api/v1/users/me/households', ({ request }) => {
        const auth = request.headers.get('authorization')
        expect(auth?.toLowerCase()).toBe('bearer abc123')
        return HttpResponse.json([])
      })
    )
    const res = await api.GET('/api/v1/users/me/households', { params: {} })
    expect(res.response.ok).toBe(true)
  })

  it('createAccount posts to /auth/register and sets token', async () => {
    server.use(
      http.post('*/api/v1/auth/register', async ({ request }) => {
        const body = await request.json()
        expect(body).toEqual({ email: 'new@example.com', password: 'pw', displayName: 'New User' })
        return HttpResponse.json({ accessToken: 'xyz789', tokenType: 'bearer', user: { id: 55, email: 'new@example.com', displayName: 'New User' } })
      })
    )
    const user = await createAccount('new@example.com', 'New User', 'pw')
    expect(user.id).toBe(55)

    server.use(
      http.get('*/api/v1/users/me/households', ({ request }) => {
        const auth = request.headers.get('authorization')
        expect(auth?.toLowerCase()).toBe('bearer xyz789')
        return HttpResponse.json([])
      })
    )
    const res = await api.GET('/api/v1/users/me/households', { params: {} })
    expect(res.response.ok).toBe(true)
  })

  it('handleGoogleLogin exists (not implemented yet)', async () => {
    await expect(handleGoogleLogin('token-123')).rejects.toBeInstanceOf(Error)
  })

  it('logout clears auth token', async () => {
    // Simulate logged-in state then logout and verify header is not sent
    server.use(
      http.post('*/api/v1/auth/login', () => HttpResponse.json({ accessToken: 'tok', tokenType: 'bearer', user: { id: 1, email: 'a@b', displayName: 'A' } }))
    )
    await loginWithPassword('a@b', 'pw')
    await logout()
    server.use(
      http.get('*/api/v1/users/me/households', ({ request }) => {
        const auth = request.headers.get('authorization')
        expect(auth).toBeFalsy()
        return HttpResponse.json([])
      })
    )
    const res = await api.GET('/api/v1/users/me/households', { params: {} })
    expect(res.response.ok).toBe(true)
  })
})