feat: update password

2026-05-26 13:48:22 +02:00
parent 835dfcc677
commit b3968a8181
6 changed files with 138 additions and 1 deletions
@@ -0,0 +1,63 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+
+uses(RefreshDatabase::class);
+
+it('updates the authenticated user password and keeps the current api token', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('OldPassword123!'),
+    ]);
+    $currentToken = $user->createToken('current-device');
+    $otherToken = $user->createToken('other-device');
+
+    $this
+        ->withHeader('Authorization', 'Bearer '.$currentToken->plainTextToken)
+        ->patchJson('/api/auth/me/password', [
+            'currentPassword' => 'OldPassword123!',
+            'password' => 'NewPassword123!',
+            'passwordConfirmation' => 'NewPassword123!',
+        ])
+        ->assertOk()
+        ->assertJsonPath('message', __('api.auth.password_updated'));
+
+    expect(Hash::check('NewPassword123!', $user->fresh()->password))->toBeTrue();
+
+    $this->assertDatabaseHas('personal_access_tokens', [
+        'id' => $currentToken->accessToken->getKey(),
+    ]);
+    $this->assertDatabaseMissing('personal_access_tokens', [
+        'id' => $otherToken->accessToken->getKey(),
+    ]);
+});
+
+it('rejects an invalid current password', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('OldPassword123!'),
+    ]);
+    $currentToken = $user->createToken('current-device');
+
+    $this
+        ->withHeader('Authorization', 'Bearer '.$currentToken->plainTextToken)
+        ->patchJson('/api/auth/me/password', [
+            'currentPassword' => 'wrong-password',
+            'password' => 'NewPassword123!',
+            'passwordConfirmation' => 'NewPassword123!',
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors(['current_password']);
+
+    expect(Hash::check('OldPassword123!', $user->fresh()->password))->toBeTrue();
+});
+
+it('requires authentication to update the password', function () {
+    $this
+        ->patchJson('/api/auth/me/password', [
+            'currentPassword' => 'OldPassword123!',
+            'password' => 'NewPassword123!',
+            'passwordConfirmation' => 'NewPassword123!',
+        ])
+        ->assertUnauthorized();
+});