feat(auth): add user profile, phone login, and account deletion

backend/internal/e2e/auth_flow_test.go

@@ -0,0 +1,132 @@
+package e2e
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"galo/internal/app"
+	"galo/internal/config"
+	"galo/internal/models"
+)
+
+// TestAuthProfileFlowOverHTTP drives the whole account lifecycle through the
+// real HTTP router: register phone-only, log in, add an email, change the
+// password (revoking sessions), and delete the account.
+func TestAuthProfileFlowOverHTTP(t *testing.T) {
+	st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
+	defer closeDB()
+
+	gin.SetMode(gin.TestMode)
+	srv := app.New(&config.Config{}, st.repos, st.db.PingContext, st.tm, st.storage, st.hub)
+	router := srv.Router()
+
+	do := func(method, path, token string, body any) *httptest.ResponseRecorder {
+		var buf bytes.Buffer
+		if body != nil {
+			_ = json.NewEncoder(&buf).Encode(body)
+		}
+		req := httptest.NewRequest(method, path, &buf)
+		req.Header.Set("Content-Type", "application/json")
+		if token != "" {
+			req.Header.Set("Authorization", "Bearer "+token)
+		}
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		return rec
+	}
+
+	type tokens struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+	}
+	type authBody struct {
+		User   models.SelfUser `json:"user"`
+		Tokens tokens          `json:"tokens"`
+	}
+
+	phone := "+15550007000"
+	// Register with a phone only — no email.
+	rec := do(http.MethodPost, "/api/auth/register", "", map[string]string{
+		"phone": phone, "password": "password123", "name": "Phone Only",
+	})
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("register status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	var registered authBody
+	if err := json.Unmarshal(rec.Body.Bytes(), &registered); err != nil {
+		t.Fatalf("decode register: %v", err)
+	}
+	if registered.User.Phone != phone || registered.User.Email != "" {
+		t.Fatalf("registered user = %+v", registered.User)
+	}
+
+	// Log in by phone.
+	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
+		"identifier": phone, "password": "password123",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("login status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	var logged authBody
+	_ = json.Unmarshal(rec.Body.Bytes(), &logged)
+	access := logged.Tokens.AccessToken
+
+	// Add the missing email identifier.
+	rec = do(http.MethodPost, "/api/auth/me/identifiers", access, map[string]string{
+		"email": "phoneonly@test.local",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("add identifier status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	var added struct {
+		User models.SelfUser `json:"user"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &added)
+	if added.User.Email != "phoneonly@test.local" {
+		t.Fatalf("email not added: %+v", added.User)
+	}
+
+	// Change the password, which revokes every refresh token.
+	rec = do(http.MethodPost, "/api/auth/me/password", access, map[string]string{
+		"current_password": "password123", "new_password": "newpassword",
+	})
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("change password status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	rec = do(http.MethodPost, "/api/auth/refresh", "", map[string]string{
+		"refresh_token": logged.Tokens.RefreshToken,
+	})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("refresh after password change status = %d, want 401", rec.Code)
+	}
+
+	// The new password works; login by the added email.
+	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
+		"identifier": "phoneonly@test.local", "password": "newpassword",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("login with new password status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	var relogged authBody
+	_ = json.Unmarshal(rec.Body.Bytes(), &relogged)
+
+	// Delete the account: it disappears immediately.
+	rec = do(http.MethodDelete, "/api/auth/me", relogged.Tokens.AccessToken, map[string]string{
+		"password": "newpassword",
+	})
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("delete status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
+		"identifier": phone, "password": "newpassword",
+	})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("login after delete status = %d, want 401", rec.Code)
+	}
+}