feat: reset password

tests/Feature/PasswordResetTest.php

@@ -1,19 +1,23 @@
 <?php
 
+use App\Mail\ResetPasswordMail;
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Facades\URL;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function (): void {
-    config()->set('services.mobile.password_reset_url', 'bowly://reset-password');
+    config()->set('app.url', 'https://api.bowli.test');
+    URL::forceRootUrl('https://api.bowli.test');
+    URL::forceScheme('https');
 });
 
-it('sends a password reset email with a mobile app url', function () {
+it('sends a password reset email with a clickable api web url', function () {
     Notification::fake();
 
     $user = User::factory()->create([
@@ -32,14 +36,22 @@ it('sends a password reset email with a mobile app url', function () {
         ResetPassword::class,
         function (ResetPassword $notification) use ($user): bool {
             $mail = $notification->toMail($user);
-            $url = $mail->actionUrl;
 
-            expect($url)->toStartWith('bowly://reset-password?');
+            expect($mail)->toBeInstanceOf(ResetPasswordMail::class);
+
+            $url = $mail->resetUrl;
+
+            expect($url)->toStartWith('https://api.bowli.test/password/reset/');
 
             parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
 
             expect($query['email'])->toBe($user->email)
-                ->and($query['token'])->not->toBeEmpty();
+                ->and((string) parse_url($url, PHP_URL_PATH))->toStartWith('/password/reset/');
+
+            $mail
+                ->assertSeeInHtml('Réinitialise ton mot de passe')
+                ->assertSeeInHtml('Choisir un nouveau mot de passe')
+                ->assertSeeInHtml($user->name);
 
             return true;
         }
@@ -85,6 +97,50 @@ it('resets the password and invalidates existing api tokens', function () {
     ]);
 });
 
+it('shows the api password reset form from the email link', function () {
+    $user = User::factory()->create([
+        'email' => 'leon@example.com',
+    ]);
+    $token = Password::broker()->createToken($user);
+
+    $this
+        ->get(route('password.reset', [
+            'email' => $user->email,
+            'token' => $token,
+        ], absolute: false))
+        ->assertOk()
+        ->assertViewIs('auth.reset-password')
+        ->assertSee('Nouveau mot de passe')
+        ->assertSee($user->email);
+});
+
+it('resets the password from the api web form', function () {
+    $user = User::factory()->create([
+        'email' => 'leon@example.com',
+        'password' => 'old-password',
+    ]);
+    $token = Password::broker()->createToken($user);
+
+    $user->createToken('api');
+
+    $this
+        ->post('/password/reset', [
+            'email' => 'LEON@example.com',
+            'password' => 'new-password',
+            'password_confirmation' => 'new-password',
+            'token' => $token,
+        ])
+        ->assertOk()
+        ->assertViewIs('auth.reset-password')
+        ->assertSee('Mot de passe modifié');
+
+    expect(Hash::check('new-password', $user->fresh()->password))->toBeTrue();
+
+    $this->assertDatabaseMissing('personal_access_tokens', [
+        'tokenable_id' => $user->getKey(),
+    ]);
+});
+
 it('rejects an invalid password reset token', function () {
     $user = User::factory()->create([
         'email' => 'leon@example.com',