first commit from hostslim

tests/Feature/Auth/AuthenticationTest.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AuthenticationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_login_screen_can_be_rendered(): void
+    {
+        $response = $this->get('/login');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_users_can_authenticate_using_the_login_screen(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->post('/login', [
+            'email' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+    }
+
+    public function test_users_can_not_authenticate_with_invalid_password(): void
+    {
+        $user = User::factory()->create();
+
+        $this->post('/login', [
+            'email' => $user->email,
+            'password' => 'wrong-password',
+        ]);
+
+        $this->assertGuest();
+    }
+
+    public function test_users_can_logout(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->post('/logout');
+
+        $this->assertGuest();
+        $response->assertRedirect('/');
+    }
+}

tests/Feature/Auth/EmailVerificationTest.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Auth\Events\Verified;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\URL;
+use Tests\TestCase;
+
+class EmailVerificationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_email_verification_screen_can_be_rendered(): void
+    {
+        $user = User::factory()->unverified()->create();
+
+        $response = $this->actingAs($user)->get('/verify-email');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_email_can_be_verified(): void
+    {
+        $user = User::factory()->unverified()->create();
+
+        Event::fake();
+
+        $verificationUrl = URL::temporarySignedRoute(
+            'verification.verify',
+            now()->addMinutes(60),
+            ['id' => $user->id, 'hash' => sha1($user->email)]
+        );
+
+        $response = $this->actingAs($user)->get($verificationUrl);
+
+        Event::assertDispatched(Verified::class);
+        $this->assertTrue($user->fresh()->hasVerifiedEmail());
+        $response->assertRedirect(route('dashboard', absolute: false).'?verified=1');
+    }
+
+    public function test_email_is_not_verified_with_invalid_hash(): void
+    {
+        $user = User::factory()->unverified()->create();
+
+        $verificationUrl = URL::temporarySignedRoute(
+            'verification.verify',
+            now()->addMinutes(60),
+            ['id' => $user->id, 'hash' => sha1('wrong-email')]
+        );
+
+        $this->actingAs($user)->get($verificationUrl);
+
+        $this->assertFalse($user->fresh()->hasVerifiedEmail());
+    }
+}

tests/Feature/Auth/PasswordConfirmationTest.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class PasswordConfirmationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_confirm_password_screen_can_be_rendered(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->get('/confirm-password');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_password_can_be_confirmed(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->post('/confirm-password', [
+            'password' => 'password',
+        ]);
+
+        $response->assertRedirect();
+        $response->assertSessionHasNoErrors();
+    }
+
+    public function test_password_is_not_confirmed_with_invalid_password(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->post('/confirm-password', [
+            'password' => 'wrong-password',
+        ]);
+
+        $response->assertSessionHasErrors();
+    }
+}

tests/Feature/Auth/PasswordResetTest.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Auth\Notifications\ResetPassword;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Notification;
+use Tests\TestCase;
+
+class PasswordResetTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_reset_password_link_screen_can_be_rendered(): void
+    {
+        $response = $this->get('/forgot-password');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_reset_password_link_can_be_requested(): void
+    {
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $this->post('/forgot-password', ['email' => $user->email]);
+
+        Notification::assertSentTo($user, ResetPassword::class);
+    }
+
+    public function test_reset_password_screen_can_be_rendered(): void
+    {
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $this->post('/forgot-password', ['email' => $user->email]);
+
+        Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
+            $response = $this->get('/reset-password/'.$notification->token);
+
+            $response->assertStatus(200);
+
+            return true;
+        });
+    }
+
+    public function test_password_can_be_reset_with_valid_token(): void
+    {
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $this->post('/forgot-password', ['email' => $user->email]);
+
+        Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
+            $response = $this->post('/reset-password', [
+                'token' => $notification->token,
+                'email' => $user->email,
+                'password' => 'password',
+                'password_confirmation' => 'password',
+            ]);
+
+            $response
+                ->assertSessionHasNoErrors()
+                ->assertRedirect(route('login'));
+
+            return true;
+        });
+    }
+}

tests/Feature/Auth/PasswordUpdateTest.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class PasswordUpdateTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_password_can_be_updated(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->from('/profile')
+            ->put('/password', [
+                'current_password' => 'password',
+                'password' => 'new-password',
+                'password_confirmation' => 'new-password',
+            ]);
+
+        $response
+            ->assertSessionHasNoErrors()
+            ->assertRedirect('/profile');
+
+        $this->assertTrue(Hash::check('new-password', $user->refresh()->password));
+    }
+
+    public function test_correct_password_must_be_provided_to_update_password(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->from('/profile')
+            ->put('/password', [
+                'current_password' => 'wrong-password',
+                'password' => 'new-password',
+                'password_confirmation' => 'new-password',
+            ]);
+
+        $response
+            ->assertSessionHasErrorsIn('updatePassword', 'current_password')
+            ->assertRedirect('/profile');
+    }
+}

tests/Feature/Auth/RegistrationTest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class RegistrationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_registration_screen_can_be_rendered(): void
+    {
+        $response = $this->get('/register');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_new_users_can_register(): void
+    {
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+    }
+}

tests/Feature/CollectControllerTest.php

@@ -0,0 +1,182 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Jobs\ProcessTrackingPayload;
+use App\Models\Website;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Tests\TestCase;
+
+class CollectControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Website $website;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->website = Website::factory()->create(['domain' => 'example.com']);
+    }
+
+    private function validPayload(array $overrides = []): array
+    {
+        return array_merge([
+            'tid' => $this->website->tracking_id,
+            'vid' => 'visitor-abc-123',
+            'sid' => 'session-abc-123',
+            'type' => 'pageview',
+            'url' => 'https://example.com/hello',
+            'path' => '/hello',
+            'title' => 'Hello Page',
+        ], $overrides);
+    }
+
+    // -- Store endpoint --
+
+    public function test_valid_pageview_payload_dispatches_job(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload());
+
+        $response->assertOk()->assertJson(['ok' => true]);
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_valid_event_payload_dispatches_job(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'type' => 'event',
+            'event_name' => 'signup',
+            'event_category' => 'conversion',
+        ]));
+
+        $response->assertOk()->assertJson(['ok' => true]);
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_missing_required_fields_returns_validation_error(): void
+    {
+        $response = $this->postJson('/api/collect', []);
+
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['tid', 'vid', 'sid', 'type']);
+    }
+
+    public function test_invalid_type_returns_validation_error(): void
+    {
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'type' => 'invalid_type',
+        ]));
+
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['type']);
+    }
+
+    public function test_domain_mismatch_returns_error(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'url' => 'https://evil-site.com/phishing',
+        ]));
+
+        $response->assertStatus(400);
+        $response->assertJson(['ok' => false, 'reason' => 'domain_mismatch']);
+        Bus::assertNotDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_subdomain_is_allowed(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'url' => 'https://www.example.com/page',
+        ]));
+
+        $response->assertOk()->assertJson(['ok' => true]);
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_unknown_tracking_id_still_succeeds(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'tid' => 'TA-NONEXISTENT',
+            'url' => null,
+        ]));
+
+        $response->assertOk()->assertJson(['ok' => true]);
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_bot_requests_are_rejected(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload(), [
+            'User-Agent' => 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
+        ]);
+
+        $response->assertOk()->assertJson(['ok' => false, 'reason' => 'bot']);
+        Bus::assertNotDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_payload_with_utm_parameters(): void
+    {
+        Bus::fake();
+
+        $response = $this->postJson('/api/collect', $this->validPayload([
+            'utm_source' => 'google',
+            'utm_medium' => 'cpc',
+            'utm_campaign' => 'spring_sale',
+            'utm_term' => 'shoes',
+            'utm_content' => 'ad_v1',
+        ]));
+
+        $response->assertOk()->assertJson(['ok' => true]);
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    // -- Pixel endpoint --
+
+    public function test_pixel_returns_gif(): void
+    {
+        Bus::fake();
+
+        $response = $this->get('/api/pixel?tid='.$this->website->tracking_id);
+
+        $response->assertOk();
+        $response->assertHeader('Content-Type', 'image/gif');
+        Bus::assertDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_pixel_without_tid_returns_gif_without_dispatching(): void
+    {
+        Bus::fake();
+
+        $response = $this->get('/api/pixel');
+
+        $response->assertOk();
+        $response->assertHeader('Content-Type', 'image/gif');
+        Bus::assertNotDispatched(ProcessTrackingPayload::class);
+    }
+
+    public function test_pixel_rejects_bots(): void
+    {
+        Bus::fake();
+
+        $response = $this->get('/api/pixel?tid='.$this->website->tracking_id, [
+            'User-Agent' => 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
+        ]);
+
+        $response->assertOk();
+        $response->assertHeader('Content-Type', 'image/gif');
+        Bus::assertNotDispatched(ProcessTrackingPayload::class);
+    }
+}

tests/Feature/ExampleTest.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Tests\Feature;
+
+// use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ExampleTest extends TestCase
+{
+    /**
+     * A basic test example.
+     */
+    public function test_the_application_returns_a_successful_response(): void
+    {
+        $response = $this->get('/');
+
+        $response->assertStatus(200);
+    }
+}

tests/Feature/ProfileTest.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ProfileTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_profile_page_is_displayed(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->get('/profile');
+
+        $response->assertOk();
+    }
+
+    public function test_profile_information_can_be_updated(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->patch('/profile', [
+                'name' => 'Test User',
+                'email' => 'test@example.com',
+            ]);
+
+        $response
+            ->assertSessionHasNoErrors()
+            ->assertRedirect('/profile');
+
+        $user->refresh();
+
+        $this->assertSame('Test User', $user->name);
+        $this->assertSame('test@example.com', $user->email);
+        $this->assertNull($user->email_verified_at);
+    }
+
+    public function test_email_verification_status_is_unchanged_when_the_email_address_is_unchanged(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->patch('/profile', [
+                'name' => 'Test User',
+                'email' => $user->email,
+            ]);
+
+        $response
+            ->assertSessionHasNoErrors()
+            ->assertRedirect('/profile');
+
+        $this->assertNotNull($user->refresh()->email_verified_at);
+    }
+
+    public function test_user_can_delete_their_account(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->delete('/profile', [
+                'password' => 'password',
+            ]);
+
+        $response
+            ->assertSessionHasNoErrors()
+            ->assertRedirect('/');
+
+        $this->assertGuest();
+        $this->assertNull($user->fresh());
+    }
+
+    public function test_correct_password_must_be_provided_to_delete_account(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->from('/profile')
+            ->delete('/profile', [
+                'password' => 'wrong-password',
+            ]);
+
+        $response
+            ->assertSessionHasErrorsIn('userDeletion', 'password')
+            ->assertRedirect('/profile');
+
+        $this->assertNotNull($user->fresh());
+    }
+}

tests/Feature/WebsiteControllerTest.php

@@ -0,0 +1,204 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Models\Website;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class WebsiteControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private User $user;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->user = User::factory()->create();
+    }
+
+    // -- Index --
+
+    public function test_guests_cannot_access_website_list(): void
+    {
+        $this->get(route('websites.index'))->assertRedirect(route('login'));
+    }
+
+    public function test_authenticated_user_can_see_their_websites(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+        Website::factory()->create(); // another user's website
+
+        $response = $this->actingAs($this->user)->get(route('websites.index'));
+
+        $response->assertOk();
+        $response->assertSeeText($website->name);
+    }
+
+    // -- Create / Store --
+
+    public function test_user_can_view_create_form(): void
+    {
+        $this->actingAs($this->user)
+            ->get(route('websites.create'))
+            ->assertOk();
+    }
+
+    public function test_user_can_create_website(): void
+    {
+        $response = $this->actingAs($this->user)->post(route('websites.store'), [
+            'name' => 'My Site',
+            'domain' => 'mysite.com',
+        ]);
+
+        $response->assertRedirect(route('websites.index'));
+        $this->assertDatabaseHas('websites', [
+            'user_id' => $this->user->id,
+            'name' => 'My Site',
+            'domain' => 'mysite.com',
+        ]);
+    }
+
+    public function test_create_website_generates_tracking_id(): void
+    {
+        $this->actingAs($this->user)->post(route('websites.store'), [
+            'name' => 'My Site',
+            'domain' => 'mysite.com',
+        ]);
+
+        $website = Website::where('domain', 'mysite.com')->first();
+        $this->assertNotNull($website->tracking_id);
+        $this->assertStringStartsWith('TA-', $website->tracking_id);
+    }
+
+    public function test_create_website_validates_domain_format(): void
+    {
+        $response = $this->actingAs($this->user)->post(route('websites.store'), [
+            'name' => 'My Site',
+            'domain' => 'not a domain!!',
+        ]);
+
+        $response->assertSessionHasErrors('domain');
+    }
+
+    public function test_create_website_requires_name(): void
+    {
+        $response = $this->actingAs($this->user)->post(route('websites.store'), [
+            'name' => '',
+            'domain' => 'mysite.com',
+        ]);
+
+        $response->assertSessionHasErrors('name');
+    }
+
+    // -- Edit / Update --
+
+    public function test_owner_can_edit_website(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+
+        $this->actingAs($this->user)
+            ->get(route('websites.edit', $website))
+            ->assertOk();
+    }
+
+    public function test_non_owner_cannot_edit_website(): void
+    {
+        $otherUser = User::factory()->create();
+        $website = Website::factory()->for($otherUser)->create();
+
+        $this->actingAs($this->user)
+            ->get(route('websites.edit', $website))
+            ->assertForbidden();
+    }
+
+    public function test_owner_can_update_website(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+
+        $response = $this->actingAs($this->user)->put(route('websites.update', $website), [
+            'name' => 'Updated Name',
+            'domain' => 'updated.com',
+        ]);
+
+        $response->assertRedirect(route('dashboard.show', $website));
+        $this->assertDatabaseHas('websites', [
+            'id' => $website->id,
+            'name' => 'Updated Name',
+            'domain' => 'updated.com',
+        ]);
+    }
+
+    public function test_non_owner_cannot_update_website(): void
+    {
+        $otherUser = User::factory()->create();
+        $website = Website::factory()->for($otherUser)->create();
+
+        $this->actingAs($this->user)
+            ->put(route('websites.update', $website), [
+                'name' => 'Hacked',
+                'domain' => 'hacked.com',
+            ])
+            ->assertForbidden();
+    }
+
+    // -- Delete --
+
+    public function test_owner_can_delete_website(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+
+        $response = $this->actingAs($this->user)
+            ->delete(route('websites.destroy', $website));
+
+        $response->assertRedirect(route('websites.index'));
+        $this->assertDatabaseMissing('websites', ['id' => $website->id]);
+    }
+
+    public function test_non_owner_cannot_delete_website(): void
+    {
+        $otherUser = User::factory()->create();
+        $website = Website::factory()->for($otherUser)->create();
+
+        $this->actingAs($this->user)
+            ->delete(route('websites.destroy', $website))
+            ->assertForbidden();
+
+        $this->assertDatabaseHas('websites', ['id' => $website->id]);
+    }
+
+    // -- Show redirects to dashboard --
+
+    public function test_show_redirects_to_dashboard(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+
+        $this->actingAs($this->user)
+            ->get(route('websites.show', $website))
+            ->assertRedirect(route('dashboard.show', $website));
+    }
+
+    // -- Snippet --
+
+    public function test_owner_can_view_snippet(): void
+    {
+        $website = Website::factory()->for($this->user)->create();
+
+        $this->actingAs($this->user)
+            ->get(route('websites.snippet', $website))
+            ->assertOk()
+            ->assertSeeText($website->tracking_id);
+    }
+
+    public function test_non_owner_cannot_view_snippet(): void
+    {
+        $otherUser = User::factory()->create();
+        $website = Website::factory()->for($otherUser)->create();
+
+        $this->actingAs($this->user)
+            ->get(route('websites.snippet', $website))
+            ->assertForbidden();
+    }
+}