feat: mobile regist and login

tests/Feature/EmailVerificationTest.php

@@ -36,7 +36,8 @@ it('sends a verification email when a user registers', function () {
         ->assertJsonPath('user.weightGoal', WeightGoal::MAINTAIN_WEIGHT->value)
         ->assertJsonPath('user.pacePreference', PacePreference::NORMAL->value)
         ->assertJsonPath('user.sex', UserSex::WOMAN->value)
-        ->assertJsonPath('user.dateOfBirth', '2003-04-24');
+        ->assertJsonPath('user.dateOfBirth', '2003-04-24')
+        ->assertCookieMissing('token');
 
     $user = User::where('email', 'leon@example.com')->firstOrFail();
 
@@ -75,6 +76,37 @@ it('returns a temporary error when the verification email cannot be sent during
     ]);
 });
 
+it('registers mobile users with a bearer token', function () {
+    Notification::fake();
+
+    $this->postJson('/api/auth/mobile/register', [
+        'name' => 'MobileLeon',
+        'email' => 'mobile.leon@example.com',
+        'password' => 'Motsdfdepasse123*',
+        'deviceName' => 'Bowli Android',
+        'locale' => 'fr-FR',
+        'physicalActivityLevel' => PhysicalActivityLevel::LIGHTLY_ACTIVE->value,
+        'weightGoal' => WeightGoal::MAINTAIN_WEIGHT->value,
+        'pacePreference' => PacePreference::NORMAL->value,
+        'sex' => UserSex::MAN->value,
+        'dateOfBirth' => '2003-04-24',
+    ])
+        ->assertCreated()
+        ->assertJsonPath('user.email', 'mobile.leon@example.com')
+        ->assertJsonPath('user.emailVerified', false)
+        ->assertJsonStructure(['token'])
+        ->assertCookieMissing('token');
+
+    $user = User::where('email', 'mobile.leon@example.com')->firstOrFail();
+
+    $this->assertDatabaseHas('personal_access_tokens', [
+        'name' => 'Bowli Android',
+        'tokenable_id' => $user->getKey(),
+    ]);
+
+    Notification::assertSentTo($user, VerifyEmail::class);
+});
+
 it('uses the custom account verification mailable', function () {
     $user = User::factory()->unverified()->create([
         'locale' => 'fr',
@@ -169,7 +201,7 @@ it('blocks login for unverified users', function () {
     ]);
 });
 
-it('allows login for verified users', function () {
+it('allows session login for verified users without issuing a token cookie', function () {
     $user = User::factory()->create([
         'locale' => 'en',
         'password' => 'password',
@@ -184,11 +216,54 @@ it('allows login for verified users', function () {
         ->assertJsonPath('user.email', $user->email)
         ->assertJsonPath('user.locale', 'fr')
         ->assertJsonPath('user.emailVerified', true)
-        ->assertCookie('token');
+        ->assertCookieMissing('token');
 
     expect($user->fresh()->locale)->toBe('fr');
 });
 
+it('allows mobile login for verified users with a bearer token', function () {
+    $user = User::factory()->create([
+        'locale' => 'en',
+        'password' => 'password',
+    ]);
+
+    $this->postJson('/api/auth/mobile/login', [
+        'deviceName' => 'Bowli iOS',
+        'email' => $user->email,
+        'locale' => 'fr-FR',
+        'password' => 'password',
+    ])
+        ->assertOk()
+        ->assertJsonPath('user.email', $user->email)
+        ->assertJsonPath('user.locale', 'fr')
+        ->assertJsonPath('user.emailVerified', true)
+        ->assertJsonStructure(['token'])
+        ->assertCookieMissing('token');
+
+    expect($user->fresh()->locale)->toBe('fr');
+
+    $this->assertDatabaseHas('personal_access_tokens', [
+        'name' => 'Bowli iOS',
+        'tokenable_id' => $user->getKey(),
+    ]);
+});
+
+it('logs out mobile users by deleting the current bearer token', function () {
+    $user = User::factory()->create();
+    $token = $user->createToken('Bowli iOS')->plainTextToken;
+
+    $this
+        ->withToken($token)
+        ->postJson('/api/auth/logout')
+        ->assertOk()
+        ->assertJsonPath('message', __('api.auth.logout'));
+
+    $this->assertDatabaseMissing('personal_access_tokens', [
+        'name' => 'Bowli iOS',
+        'tokenable_id' => $user->getKey(),
+    ]);
+});
+
 it('resends a verification email for an unverified user without authentication', function () {
     Notification::fake();