add tests for controllers and ActionCable channels; improve main backend docs

main-server/spec/controllers/application_controller_spec.rb

@@ -0,0 +1,58 @@
+require "rails_helper"
+
+RSpec.describe ApplicationController, type: :controller do
+  controller do
+    def index
+      render json: { user_id: current_user.id }
+    end
+  end
+
+  let(:user) { User.create!(nickname: "alice", password: "password123") }
+  let(:token) { JwtService.encode(user_id: user.id) }
+
+  describe "#authenticate_request!" do
+    context "with valid Bearer token in Authorization header" do
+      it "sets current_user and succeeds" do
+        request.headers["Authorization"] = "Bearer #{token}"
+        get :index
+        expect(response).to have_http_status(:ok)
+        expect(JSON.parse(response.body)).to eq({ "user_id" => user.id })
+      end
+    end
+
+    context "with valid token in params" do
+      it "sets current_user and succeeds" do
+        get :index, params: { token: token }
+        expect(response).to have_http_status(:ok)
+        expect(JSON.parse(response.body)).to eq({ "user_id" => user.id })
+      end
+    end
+
+    context "without token" do
+      it "returns 401 unauthorized" do
+        get :index
+        expect(response).to have_http_status(:unauthorized)
+        expect(JSON.parse(response.body)).to eq({ "error" => "Unauthorized" })
+      end
+    end
+
+    context "with invalid token" do
+      it "returns 401 unauthorized" do
+        request.headers["Authorization"] = "Bearer invalid_token"
+        get :index
+        expect(response).to have_http_status(:unauthorized)
+        expect(JSON.parse(response.body)).to eq({ "error" => "Unauthorized" })
+      end
+    end
+
+    context "with token for nonexistent user" do
+      it "returns 401 unauthorized" do
+        orphan_token = JwtService.encode(user_id: 999_999)
+        request.headers["Authorization"] = "Bearer #{orphan_token}"
+        get :index
+        expect(response).to have_http_status(:unauthorized)
+        expect(JSON.parse(response.body)).to eq({ "error" => "Unauthorized" })
+      end
+    end
+  end
+end