From f7a0a3740ee873440838954ea8791b2c8e95bf9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9C=A0=EC=B0=BD=EC=9A=B1?= Date: Sun, 12 Jul 2026 00:46:39 +0900 Subject: [PATCH] test(cloud): cover unknown-username 401 parity + logout session clear --- cloud/tests/AuthControllerTest.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/cloud/tests/AuthControllerTest.php b/cloud/tests/AuthControllerTest.php index 9bd6f24..53537e8 100644 --- a/cloud/tests/AuthControllerTest.php +++ b/cloud/tests/AuthControllerTest.php @@ -50,4 +50,21 @@ final class AuthControllerTest extends TestCase $this->assertSame(200, $res->status()); $this->assertSame(1, $sess->get('user_id')); } + public function testUnknownUsernameReturns401GenericBody(): void { + $c = new AuthController($this->users(), new InMemoryAuditRepository()); + $res = $c->login($this->req('nobody', 'whatever'), new ArraySessionStore(), now: 1000); + $this->assertSame(401, $res->status()); + // identical generic body to the wrong-password case (no user-enumeration leak) + $wrong = $c->login($this->req('alice', 'nope'), new ArraySessionStore(), now: 1000); + $this->assertSame($wrong->body(), $res->body()); + } + public function testLogoutClearsSession(): void { + $c = new AuthController($this->users(), new InMemoryAuditRepository()); + $sess = new ArraySessionStore(); + $c->login($this->req('alice', 'pw'), $sess, now: 1000); + $this->assertSame(1, $sess->get('user_id')); + $res = $c->logout($sess); + $this->assertSame(200, $res->status()); + $this->assertNull($sess->get('user_id')); // session identity cleared + } }