unsupervised-scheduler/tests/Unit/Auth/LoginPageTest.php

<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Tests\Unit\Auth;

use Brain\Monkey\Functions;
use Unsupervised\Schedular\Auth\LoginPage;
use Unsupervised\Schedular\Tests\Unit\TestCase;

class LoginPageTest extends TestCase
{
    private LoginPage $page;

    protected function setUp(): void
    {
        parent::setUp();
        $this->page = new LoginPage();
    }

    protected function tearDown(): void
    {
        unset($_POST['us_login'], $_POST['log'], $_POST['pwd']);
        parent::tearDown();
    }

    public function testLoggedInVisitorIsLinkedToTheCurrentPageByDefault(): void
    {
        Functions\when('is_user_logged_in')->justReturn(true);
        Functions\when('get_permalink')->alias(
            static fn(int $id = 0): string|false => 0 === $id ? 'https://example.com/login/' : false
        );

        $html = $this->page->render([]);

        self::assertStringContainsString('href="https://example.com/login/"', $html);
        self::assertStringContainsString('View available lessons', $html);
    }

    public function testLoggedInVisitorIsLinkedToTheChosenBookingPage(): void
    {
        Functions\when('is_user_logged_in')->justReturn(true);
        Functions\when('get_permalink')->alias(
            static fn(int $id = 0): string|false => 9 === $id ? 'https://example.com/book/' : 'https://example.com/login/'
        );

        $html = $this->page->render(['bookingPageId' => 9]);

        self::assertStringContainsString('href="https://example.com/book/"', $html);
    }

    public function testShortcodeStyleAttributeSelectsTheBookingPageToo(): void
    {
        Functions\when('is_user_logged_in')->justReturn(true);
        Functions\when('get_permalink')->alias(
            static fn(int $id = 0): string|false => 9 === $id ? 'https://example.com/book/' : 'https://example.com/login/'
        );

        $html = $this->page->render(['booking_page_id' => '9']);

        self::assertStringContainsString('href="https://example.com/book/"', $html);
    }

    public function testLoggedOutVisitorSeesTheLoginForm(): void
    {
        Functions\when('is_user_logged_in')->justReturn(false);
        Functions\when('get_permalink')->justReturn('https://example.com/login/');
        Functions\when('sanitize_url')->returnArg();
        Functions\when('wp_nonce_field')->justReturn('');

        $html = $this->page->render([]);

        self::assertStringContainsString('us-login-form', $html);
        self::assertStringContainsString('name="us_login"', $html);
    }

    public function testBookingUrlIsNullWithoutAChosenPage(): void
    {
        self::assertNull($this->page->bookingUrl(0));
    }

    public function testBookingUrlIsNullWhenTheChosenPageIsGone(): void
    {
        Functions\when('get_permalink')->justReturn(false);

        self::assertNull($this->page->bookingUrl(9));
    }

    public function testBookingUrlIsThePagePermalink(): void
    {
        Functions\when('get_permalink')->justReturn('https://example.com/book/');

        self::assertSame('https://example.com/book/', $this->page->bookingUrl(9));
    }

    /**
     * wp_signon()'s second argument decides whether the auth cookie carries the
     * Secure flag, and *only* its default (the empty string) makes it work that
     * out from is_ssl(). Passing an explicit false — which reads like "no
     * preference" and is not — issues the plain, non-Secure cookie on an HTTPS
     * site, leaving every student's session to leak over the first http://
     * request to the domain. So the call must pass the credentials and nothing
     * else, which is what this asserts: a second argument of any kind fails it.
     */
    public function testSignOnDoesNotOverrideWordPressSecureCookieDetection(): void
    {
        $_POST['us_login'] = '1';
        $_POST['log']      = '[email protected]';
        $_POST['pwd']      = 'hunter2';

        Functions\when('is_user_logged_in')->justReturn(false);
        Functions\when('get_permalink')->justReturn('https://example.com/login/');
        Functions\when('sanitize_url')->returnArg();
        Functions\when('sanitize_user')->returnArg();
        Functions\when('wp_unslash')->returnArg();
        Functions\when('wp_nonce_field')->justReturn('');
        Functions\when('check_admin_referer')->justReturn(true);
        // The failure branch, so the render returns instead of redirecting and
        // exiting the test process.
        Functions\when('is_wp_error')->justReturn(true);

        Functions\expect('wp_signon')->once()->with(\Mockery::type('array'))->andReturn(null);

        $html = $this->page->render([]);

        self::assertStringContainsString('Invalid username or password.', $html);
    }
}