handlers: image/reindex/auth via use cases; auth::authenticate replaces ensure_active; check-handler-services guard

crates/application/tests/auth/authenticate_test.rs

@@ -0,0 +1,109 @@
+use std::sync::Arc;
+
+use domain::{
+    errors::DomainError,
+    ports::UserRepository,
+    testing::InMemoryStore,
+    value_objects::{Email, UserId},
+};
+
+use application::auth::{
+    authenticate,
+    deps::{AuthenticateDeps, RegisterDeps},
+    register,
+};
+
+use crate::support::{TestContextBuilder, register_command};
+
+#[tokio::test]
+async fn a_live_users_token_authenticates() {
+    let store = InMemoryStore::new();
+    let b = TestContextBuilder::new().with_users(Arc::clone(&store) as _);
+    let reg = RegisterDeps {
+        user: b.user_repo.clone(),
+        password_hasher: b.password_hasher.clone(),
+        config: b.config.clone(),
+    };
+    register::execute(&reg, register_command("alice@example.com", "alice"))
+        .await
+        .unwrap();
+    let id = store
+        .find_by_email(&Email::new("alice@example.com".into()).unwrap())
+        .await
+        .unwrap()
+        .unwrap()
+        .id()
+        .clone();
+    let deps = AuthenticateDeps {
+        auth: b.auth_service.clone(),
+        user: b.user_repo.clone(),
+    };
+
+    let authenticated = authenticate::execute(&deps, &id.value().to_string())
+        .await
+        .unwrap();
+
+    assert_eq!(authenticated, id);
+}
+
+#[tokio::test]
+async fn a_deleted_users_token_is_rejected() {
+    let store = InMemoryStore::new();
+    let b = TestContextBuilder::new().with_users(Arc::clone(&store) as _);
+    let reg = RegisterDeps {
+        user: b.user_repo.clone(),
+        password_hasher: b.password_hasher.clone(),
+        config: b.config.clone(),
+    };
+    register::execute(&reg, register_command("alice@example.com", "alice"))
+        .await
+        .unwrap();
+    let id = store
+        .find_by_email(&Email::new("alice@example.com".into()).unwrap())
+        .await
+        .unwrap()
+        .unwrap()
+        .id()
+        .clone();
+    store.mark_deleted(&id, &[]).await.unwrap();
+    let deps = AuthenticateDeps {
+        auth: b.auth_service.clone(),
+        user: b.user_repo.clone(),
+    };
+
+    let err = authenticate::execute(&deps, &id.value().to_string())
+        .await
+        .unwrap_err();
+
+    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+}
+
+#[tokio::test]
+async fn an_unknown_users_token_is_rejected() {
+    let b = TestContextBuilder::new();
+    let deps = AuthenticateDeps {
+        auth: b.auth_service.clone(),
+        user: b.user_repo.clone(),
+    };
+
+    let err = authenticate::execute(&deps, &UserId::generate().value().to_string())
+        .await
+        .unwrap_err();
+
+    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+}
+
+#[tokio::test]
+async fn an_invalid_token_is_rejected() {
+    let b = TestContextBuilder::new();
+    let deps = AuthenticateDeps {
+        auth: b.auth_service.clone(),
+        user: b.user_repo.clone(),
+    };
+
+    let err = authenticate::execute(&deps, "not-a-token")
+        .await
+        .unwrap_err();
+
+    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+}