53 lines
1.6 KiB
PHP
53 lines
1.6 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Hash;
|
|
|
|
// Post to Fortify with a matching CSRF token in session + body (the browser sends
|
|
// a real token; CSRF itself is not what these tests exercise).
|
|
function loginPost(array $data)
|
|
{
|
|
return test()
|
|
->withSession(['_token' => 'test-token'])
|
|
->post('/login', array_merge(['_token' => 'test-token'], $data));
|
|
}
|
|
|
|
it('renders the login page', function () {
|
|
$this->get('/login')
|
|
->assertOk()
|
|
->assertSee('CluPilot')
|
|
->assertSee('name="email"', false);
|
|
});
|
|
|
|
it('logs in with valid credentials and redirects to the dashboard', function () {
|
|
$user = User::factory()->create(['password' => Hash::make('secret-password')]);
|
|
|
|
loginPost(['email' => $user->email, 'password' => 'secret-password'])
|
|
->assertRedirect('/dashboard');
|
|
|
|
$this->assertAuthenticatedAs($user);
|
|
});
|
|
|
|
it('rejects invalid credentials', function () {
|
|
$user = User::factory()->create(['password' => Hash::make('secret-password')]);
|
|
|
|
loginPost(['email' => $user->email, 'password' => 'wrong-password'])
|
|
->assertSessionHasErrors('email');
|
|
|
|
$this->assertGuest();
|
|
});
|
|
|
|
it('throttles repeated failed attempts', function () {
|
|
$user = User::factory()->create(['password' => Hash::make('secret-password')]);
|
|
|
|
// Exceed the 5/min login limiter.
|
|
foreach (range(1, 6) as $ignored) {
|
|
loginPost(['email' => $user->email, 'password' => 'wrong-password']);
|
|
}
|
|
|
|
// Once throttled, even correct credentials are refused.
|
|
loginPost(['email' => $user->email, 'password' => 'secret-password']);
|
|
|
|
$this->assertGuest();
|
|
});
|