feat(auth): add user profile, phone login, and account deletion

backend/internal/e2e/sqlite_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
+	"errors"
 	"image"
 	"image/color"
 	"image/png"
@@ -80,13 +81,118 @@ func openStack(t *testing.T, path, blobRoot string) (*stack, func()) {
 	return &stack{db: database, photos: photosSvc, albums: albumsSvc, auth: authSvc, hub: hub, tm: tm, repos: repos, storage: blob}, func() { database.Close() }
 }
 
+func TestUsersSchemaSupportsPhone(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "galo.db")
+	st, closeDB := openStack(t, path, t.TempDir())
+	defer closeDB()
+
+	var emailNotNull int
+	if err := st.db.QueryRowContext(ctx,
+		`SELECT "notnull" FROM pragma_table_info('users') WHERE name='email'`).Scan(&emailNotNull); err != nil {
+		t.Fatalf("email column: %v", err)
+	}
+	if emailNotNull != 0 {
+		t.Fatalf("users.email is still NOT NULL")
+	}
+
+	var phoneCols int
+	if err := st.db.QueryRowContext(ctx,
+		`SELECT count(*) FROM pragma_table_info('users') WHERE name='phone'`).Scan(&phoneCols); err != nil {
+		t.Fatalf("phone column: %v", err)
+	}
+	if phoneCols != 1 {
+		t.Fatalf("users.phone column missing")
+	}
+
+	insert := func(id, email, phone string) error {
+		var e any
+		if email != "" {
+			e = email
+		}
+		var p any
+		if phone != "" {
+			p = phone
+		}
+		_, err := st.db.ExecContext(ctx,
+			`INSERT INTO users (id, email, phone, password_hash, name) VALUES ($1, $2, $3, 'x', 'U')`,
+			id, e, p)
+		return err
+	}
+
+	// A phone-only account is allowed (email NULL).
+	if err := insert("u-phone-only", "", "+15550000001"); err != nil {
+		t.Fatalf("insert phone-only user: %v", err)
+	}
+	// A second email-less account is allowed: NULL emails do not collide.
+	if err := insert("u-phone-only-2", "", "+15550000002"); err != nil {
+		t.Fatalf("insert second phone-only user: %v", err)
+	}
+	// Phone must be unique.
+	if err := insert("u-dup-phone", "dup@test.local", "+15550000001"); err == nil {
+		t.Fatalf("duplicate phone accepted")
+	}
+	// A phone-only insert without a phone must be rejected by application
+	// logic; the schema itself still permits it, which is by design.
+	if err := insert("u-email-1", "same@test.local", ""); err != nil {
+		t.Fatalf("insert email user: %v", err)
+	}
+	if err := insert("u-email-dup", "same@test.local", ""); err == nil {
+		t.Fatalf("duplicate email accepted")
+	}
+}
+
+func TestDeleteAccountRemovesSharedAlbum(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "galo.db")
+	st, closeDB := openStack(t, path, t.TempDir())
+	defer closeDB()
+
+	owner, _, err := st.auth.Register(ctx, "ownerdel@test.local", "", "password123", "Owner")
+	if err != nil {
+		t.Fatalf("register owner: %v", err)
+	}
+	member, _, err := st.auth.Register(ctx, "memberdel@test.local", "", "password123", "Member")
+	if err != nil {
+		t.Fatalf("register member: %v", err)
+	}
+	album, err := st.albums.Create(ctx, owner.ID, albums.CreateInput{Title: "Shared"})
+	if err != nil {
+		t.Fatalf("create album: %v", err)
+	}
+	if _, err := st.db.ExecContext(ctx,
+		`INSERT INTO album_members (album_id, user_id, role) VALUES ($1, $2, 'member')`, album.ID, member.ID); err != nil {
+		t.Fatalf("add member: %v", err)
+	}
+	if list, err := st.repos.Albums.ListForUser(ctx, member.ID); err != nil || len(list) != 1 {
+		t.Fatalf("member albums before delete = %d err=%v", len(list), err)
+	}
+
+	if err := st.auth.DeleteAccount(ctx, owner.ID, "password123"); err != nil {
+		t.Fatalf("delete account: %v", err)
+	}
+
+	if list, err := st.repos.Albums.ListForUser(ctx, member.ID); err != nil || len(list) != 0 {
+		t.Fatalf("member albums after owner delete = %d err=%v, want 0", len(list), err)
+	}
+	if _, err := st.repos.Albums.GetByID(ctx, album.ID); !errors.Is(err, albums.ErrNotFound) {
+		t.Fatalf("album survived owner deletion: %v", err)
+	}
+	if role, _ := st.repos.Members.Role(ctx, album.ID, member.ID); role != "" {
+		t.Fatalf("membership survived: %q", role)
+	}
+	if _, err := st.repos.Auth.GetUserByID(ctx, member.ID); err != nil {
+		t.Fatalf("member account removed by cascade: %v", err)
+	}
+}
+
 func TestUploadSetsDefaultCover(t *testing.T) {
 	ctx := context.Background()
 	path := filepath.Join(t.TempDir(), "galo.db")
 	st, closeDB := openStack(t, path, t.TempDir())
 	defer closeDB()
 
-	user, _, err := st.auth.Register(ctx, "cover@test.local", "password123", "C")
+	user, _, err := st.auth.Register(ctx, "cover@test.local", "", "password123", "C")
 	if err != nil {
 		t.Fatalf("register: %v", err)
 	}
@@ -130,7 +236,7 @@ func TestCoverClearedWhenCoverPhotoLeaves(t *testing.T) {
 	st, closeDB := openStack(t, path, t.TempDir())
 	defer closeDB()
 
-	user, _, err := st.auth.Register(ctx, "clear@test.local", "password123", "C")
+	user, _, err := st.auth.Register(ctx, "clear@test.local", "", "password123", "C")
 	if err != nil {
 		t.Fatalf("register: %v", err)
 	}
@@ -190,7 +296,7 @@ func TestWorkerPublishesPhotoUpdated(t *testing.T) {
 	defer cancel()
 	go worker.Run(wctx)
 
-	user, _, err := st.auth.Register(ctx, "evt@test.local", "password123", "E")
+	user, _, err := st.auth.Register(ctx, "evt@test.local", "", "password123", "E")
 	if err != nil {
 		t.Fatalf("register: %v", err)
 	}
@@ -228,7 +334,7 @@ func TestSQLiteEndToEndWithRestart(t *testing.T) {
 	wctx, cancel := context.WithCancel(ctx)
 	go worker.Run(wctx)
 
-	user, _, err := st.auth.Register(ctx, "e2e@test.local", "password123", "E2E")
+	user, _, err := st.auth.Register(ctx, "e2e@test.local", "", "password123", "E2E")
 	if err != nil {
 		t.Fatalf("register: %v", err)
 	}