add tests for controllers and ActionCable channels; improve main backend docs

main-server/spec/controllers/api/sessions_controller_spec.rb

@@ -0,0 +1,154 @@
+require "rails_helper"
+
+RSpec.describe Api::SessionsController, type: :controller do
+  let!(:user) { User.create!(nickname: "AdmiralNelson", password: "securepassword") }
+  let(:token) { JwtService.encode(user_id: user.id) }
+
+  describe "POST #create" do
+    context "with valid credentials" do
+      it "returns 200 OK with user info and JWT token" do
+        post :create, params: { nickname: "AdmiralNelson", password: "securepassword" }
+
+        expect(response).to have_http_status(:ok)
+        json = JSON.parse(response.body)
+        expect(json["token"]).to be_present
+        expect(json["user"]).to include(
+          "id" => user.id,
+          "nickname" => "AdmiralNelson",
+          "avatar_url" => nil
+        )
+
+        decoded = JwtService.decode(json["token"])
+        expect(decoded[:user_id]).to eq(user.id)
+      end
+    end
+
+    context "with invalid credentials" do
+      it "returns 401 when password does not match" do
+        post :create, params: { nickname: "AdmiralNelson", password: "wrongpassword" }
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Invalid nickname or password")
+        expect(json["token"]).to be_nil
+      end
+
+      it "returns 401 when user does not exist" do
+        post :create, params: { nickname: "GhostCaptain", password: "securepassword" }
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Invalid nickname or password")
+      end
+
+      it "returns 401 when nickname is omitted" do
+        post :create, params: { password: "securepassword" }
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Invalid nickname or password")
+      end
+
+      it "returns 401 when password is omitted" do
+        post :create, params: { nickname: "AdmiralNelson" }
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Invalid nickname or password")
+      end
+
+      it "returns 401 when credentials are blank" do
+        post :create, params: { nickname: "", password: "" }
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Invalid nickname or password")
+      end
+    end
+  end
+
+  describe "DELETE #destroy" do
+    context "when authenticated" do
+      it "returns 200 with success message" do
+        request.headers["Authorization"] = "Bearer #{token}"
+        delete :destroy
+
+        expect(response).to have_http_status(:ok)
+        json = JSON.parse(response.body)
+        expect(json["message"]).to eq("Signed out successfully")
+      end
+    end
+
+    context "when unauthenticated" do
+      it "returns 401 unauthorized" do
+        delete :destroy
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Unauthorized")
+      end
+    end
+  end
+
+  describe "GET #me" do
+    context "when authenticated with Authorization header" do
+      it "returns 200 with user data" do
+        request.headers["Authorization"] = "Bearer #{token}"
+        get :me
+
+        expect(response).to have_http_status(:ok)
+        json = JSON.parse(response.body)
+        expect(json["user"]).to include(
+          "id" => user.id,
+          "nickname" => "AdmiralNelson",
+          "avatar_url" => nil
+        )
+      end
+
+      it "includes avatar_url when user has an attached avatar" do
+        user.avatar.attach(
+          io: StringIO.new("\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15c4"),
+          filename: "avatar.png",
+          content_type: "image/png"
+        )
+
+        request.headers["Authorization"] = "Bearer #{token}"
+        get :me
+
+        expect(response).to have_http_status(:ok)
+        json = JSON.parse(response.body)
+        expect(json["user"]["avatar_url"]).to be_present
+      end
+    end
+
+    context "when authenticated with token in query params" do
+      it "returns 200 with user data" do
+        get :me, params: { token: token }
+
+        expect(response).to have_http_status(:ok)
+        json = JSON.parse(response.body)
+        expect(json["user"]["id"]).to eq(user.id)
+      end
+    end
+
+    context "when unauthenticated" do
+      it "returns 401 unauthorized" do
+        get :me
+
+        expect(response).to have_http_status(:unauthorized)
+        json = JSON.parse(response.body)
+        expect(json["error"]).to eq("Unauthorized")
+      end
+    end
+
+    context "when token is expired" do
+      it "returns 401 unauthorized" do
+        expired_token = JwtService.encode(user_id: user.id, exp: 1.hour.ago.to_i)
+        request.headers["Authorization"] = "Bearer #{expired_token}"
+        get :me
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+  end
+end