Authentication Testing — Testing Auth Systems and Flows

describe('Authentication System', () => {
  let app;
  let testUser;

  beforeAll(async () => {
    app = await setupTestApp();
    testUser = await createTestUser({
      email: 'test@example.com',
      password: 'ValidPass1!'
    });
  });

  describe('Login endpoint', () => {
    it('should return tokens for valid credentials', async () => {
      const response = await request(app)
        .post('/auth/login')
        .send({ email: 'test@example.com', password: 'ValidPass1!' });

      expect(response.status).toBe(200);
      expect(response.body).toHaveProperty('accessToken');
      expect(response.body).toHaveProperty('refreshToken');
      expect(jwt.decode(response.body.accessToken)).toHaveProperty('sub', testUser.id);
    });

    it('should reject invalid password', async () => {
      const response = await request(app)
        .post('/auth/login')
        .send({ email: 'test@example.com', password: 'wrong' });

      expect(response.status).toBe(401);
    });

    it('should rate limit after 5 failed attempts', async () => {
      for (let i = 0; i < 5; i++) {
        await request(app).post('/auth/login')
          .send({ email: 'test@example.com', password: 'wrong' });
      }
      const response = await request(app).post('/auth/login')
        .send({ email: 'test@example.com', password: 'ValidPass1!' });
      expect(response.status).toBe(429);
    });
  });

  describe('Token refresh', () => {
    it('should reject reused refresh tokens (rotation)', async () => {
      const login = await request(app).post('/auth/login')
        .send({ email: 'test@example.com', password: 'ValidPass1!' });
      const refreshToken = login.body.refreshToken;

      // First use - should succeed
      await request(app).post('/auth/refresh').send({ refreshToken }).expect(200);

      // Second use - should fail (rotation)
      await request(app).post('/auth/refresh').send({ refreshToken }).expect(401);
    });
  });
});