Verde-Web/tests/Feature/Api/V1/Auth/LogoutRefreshMeTest.php

<?php

namespace Tests\Feature\Api\V1\Auth;

use App\Models\User;
use Database\Seeders\RoleSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

class LogoutRefreshMeTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();
        $this->seed(RoleSeeder::class);
    }

    public function test_me_returns_authed_user(): void
    {
        $user = User::factory()->create(['status' => User::STATUS_ACTIVE]);
        Sanctum::actingAs($user);

        $response = $this->getJson('/api/v1/auth/me');

        $response->assertOk()
            ->assertJsonPath('data.user.email', $user->email);
    }

    public function test_me_rejects_unauthed(): void
    {
        $this->getJson('/api/v1/auth/me')->assertStatus(401);
    }

    public function test_logout_revokes_token(): void
    {
        $user = User::factory()->create(['status' => User::STATUS_ACTIVE]);
        $token = $user->createToken('phpunit');
        $tokenId = $token->accessToken->id;

        $response = $this->withHeader('Authorization', 'Bearer '.$token->plainTextToken)
            ->postJson('/api/v1/auth/logout');

        $response->assertOk();
        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $tokenId]);
    }

    public function test_refresh_issues_new_token_and_revokes_old(): void
    {
        $user = User::factory()->create(['status' => User::STATUS_ACTIVE]);
        $token = $user->createToken('phpunit');
        $oldId = $token->accessToken->id;

        $response = $this->withHeader('Authorization', 'Bearer '.$token->plainTextToken)
            ->postJson('/api/v1/auth/refresh');

        $response->assertOk()
            ->assertJsonStructure(['data' => ['token']]);

        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $oldId]);
    }
}