whisper-money/tests/Feature/OpenBanking/AuthorizationControllerTest.php

<?php

use App\Contracts\BankingProviderInterface;
use App\Enums\BankingConnectionStatus;
use App\Jobs\SyncBankingConnectionJob;
use App\Models\Account;
use App\Models\BankingConnection;
use App\Models\User;
use Illuminate\Support\Facades\Queue;

beforeEach(function () {
    config([
        'services.enablebanking.app_id' => 'test-app-id',
        'services.enablebanking.private_key_path' => '/tmp/fake-key.pem',
        'services.enablebanking.redirect_url' => 'https://example.com/callback',
    ]);
});

test('users can start bank authorization', function () {
    $user = User::factory()->onboarded()->create();
    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/authorize',
            'authorization_id' => 'auth-123',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->postJson('/open-banking/authorize', [
        'aspsp_name' => 'Test Bank',
        'country' => 'ES',
    ]);

    $response->assertOk();
    $response->assertJsonStructure(['redirect_url', 'connection_id']);

    $this->assertDatabaseHas('banking_connections', [
        'user_id' => $user->id,
        'provider' => 'enablebanking',
        'aspsp_name' => 'Test Bank',
        'aspsp_country' => 'ES',
        'status' => BankingConnectionStatus::Pending->value,
    ]);
});

test('free tier users cannot start bank authorization when subscriptions are enabled', function () {
    config(['subscriptions.enabled' => true]);

    $user = User::factory()->onboarded()->create();
    $response = $this->actingAs($user)->postJson('/open-banking/authorize', [
        'aspsp_name' => 'Test Bank',
        'country' => 'ES',
    ]);

    $response->assertStatus(402);
    $response->assertJson(['redirect' => route('subscribe')]);

    $this->assertDatabaseMissing('banking_connections', [
        'user_id' => $user->id,
    ]);
});

test('users can start bank authorization during onboarding when subscriptions are enabled', function () {
    config(['subscriptions.enabled' => true]);

    $user = User::factory()->notOnboarded()->create();
    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/authorize',
            'authorization_id' => 'auth-onboarding-123',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->postJson('/open-banking/authorize', [
        'aspsp_name' => 'Test Bank',
        'country' => 'ES',
    ]);

    $response->assertOk();
    $response->assertJsonStructure(['redirect_url', 'connection_id']);

    $this->assertDatabaseHas('banking_connections', [
        'user_id' => $user->id,
        'provider' => 'enablebanking',
        'aspsp_name' => 'Test Bank',
        'aspsp_country' => 'ES',
        'status' => BankingConnectionStatus::Pending->value,
    ]);
});

test('subscribed users can start bank authorization when subscriptions are enabled', function () {
    config(['subscriptions.enabled' => true]);

    $user = User::factory()->onboarded()->create();
    $user->subscriptions()->create([
        'type' => 'default',
        'stripe_id' => 'sub_test_auth',
        'stripe_status' => 'active',
        'stripe_price' => 'price_test123',
    ]);
    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/authorize',
            'authorization_id' => 'auth-456',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->postJson('/open-banking/authorize', [
        'aspsp_name' => 'Test Bank',
        'country' => 'ES',
    ]);

    $response->assertOk();
    $response->assertJsonStructure(['redirect_url', 'connection_id']);
});

test('authorization requires aspsp_name and country', function () {
    $user = User::factory()->onboarded()->create();
    $response = $this->actingAs($user)->postJson('/open-banking/authorize', []);

    $response->assertUnprocessable();
    $response->assertJsonValidationErrors(['aspsp_name', 'country']);
});

test('callback with error redirects with error message and deletes pending connection', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
    ]);

    $response = $this->actingAs($user)
        ->get('/open-banking/callback?error=access_denied&error_description=User+denied+access');

    $response->assertRedirect(route('settings.connections.index'));
    $response->assertSessionHas('error', 'User denied access');

    $connection->refresh();
    expect($connection->trashed())->toBeTrue();
});

test('callback with error during onboarding redirects to the accounts step', function () {
    $user = User::factory()->notOnboarded()->create();
    Account::factory()->create(['user_id' => $user->id]);
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
    ]);

    $response = $this->actingAs($user)
        ->get('/open-banking/callback?error=access_denied&error_description=User+denied+access');

    $response->assertRedirect(route('onboarding', ['step' => 'create-account']));
    $response->assertSessionHas('error', 'User denied access');

    $connection->refresh();
    expect($connection->trashed())->toBeTrue();
});

test('callback without code redirects with error', function () {
    $user = User::factory()->onboarded()->create();
    $response = $this->actingAs($user)->get('/open-banking/callback');

    $response->assertRedirect(route('settings.connections.index'));
    $response->assertSessionHas('error');
});

test('callback with valid code stores pending accounts and redirects to mapping', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'Test Bank',
        'aspsp_country' => 'ES',
    ]);

    $accounts = [
        [
            'uid' => 'ext-account-1',
            'currency' => 'EUR',
            'name' => 'My Checking Account',
            'account_id' => ['iban' => 'ES1234567890123456789012'],
        ],
    ];

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->with('test-code')
        ->once()
        ->andReturn([
            'session_id' => 'session-123',
            'accounts' => $accounts,
            'aspsp' => ['name' => 'Test Bank', 'country' => 'ES'],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    $response->assertRedirect(route('open-banking.map-accounts', $connection));

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::AwaitingMapping);
    expect($connection->session_id)->toBe('session-123');
    expect($connection->pending_accounts_data)->toEqual($accounts);

    $this->assertDatabaseMissing('accounts', [
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
    ]);

    Queue::assertNothingPushed();
});

// Reauthorize tests

test('reauthorize returns 403 when user does not own the connection', function () {
    $owner = User::factory()->onboarded()->create();
    $other = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->error()->create([
        'user_id' => $owner->id,
    ]);

    $response = $this->actingAs($other)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertForbidden();
});

test('reauthorize returns 422 for non-EnableBanking connections', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->indexaCapital()->error()->create([
        'user_id' => $user->id,
    ]);

    $response = $this->actingAs($user)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertUnprocessable();
    $response->assertJson(['error' => 'Only EnableBanking connections can be re-authorized.']);
});

test('reauthorize returns 422 for active connections', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->create([
        'user_id' => $user->id,
        'status' => BankingConnectionStatus::Active,
    ]);

    $response = $this->actingAs($user)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertUnprocessable();
    $response->assertJson(['error' => 'Only connections with an error or expired status can be re-authorized.']);
});

test('reauthorize starts new authorization and sets connection to pending for error connections', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->error()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
        'error_message' => 'Authentication failed. Your credentials may have expired or been revoked.',
    ]);

    $originalAuthorizationId = $connection->authorization_id;

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->with('CaixaBank', 'ES', config('services.enablebanking.redirect_url'))
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/reauthorize',
            'authorization_id' => 'new-auth-id-456',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertOk();
    $response->assertJsonStructure(['redirect_url', 'connection_id']);
    $response->assertJson([
        'redirect_url' => 'https://bank.example.com/reauthorize',
        'connection_id' => $connection->id,
    ]);

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::Pending);
    expect($connection->authorization_id)->toBe('new-auth-id-456');
    expect($connection->authorization_id)->not->toBe($originalAuthorizationId);
    expect($connection->error_message)->toBeNull();
});

test('reauthorize starts new authorization for expired connections', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->expired()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'Santander',
        'aspsp_country' => 'ES',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/reauthorize',
            'authorization_id' => 'new-auth-id-789',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertOk();

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::Pending);
    expect($connection->authorization_id)->toBe('new-auth-id-789');
});

test('reconnect link redirects expired connections to bank authorization', function () {
    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->expired()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'Santander',
        'aspsp_country' => 'ES',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('startAuthorization')
        ->with('Santander', 'ES', config('services.enablebanking.redirect_url'))
        ->once()
        ->andReturn([
            'url' => 'https://bank.example.com/reauthorize',
            'authorization_id' => 'new-auth-id-987',
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->get(route('open-banking.reconnect', $connection));

    $response->assertRedirect('https://bank.example.com/reauthorize');

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::Pending);
    expect($connection->authorization_id)->toBe('new-auth-id-987');
});

test('free tier users cannot reauthorize after onboarding when subscriptions are enabled', function () {
    config(['subscriptions.enabled' => true]);

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->error()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
        'error_message' => 'Authentication failed. Your credentials may have expired or been revoked.',
    ]);

    $response = $this->actingAs($user)->postJson("/open-banking/connections/{$connection->id}/reauthorize");

    $response->assertStatus(402);
    $response->assertJson(['redirect' => route('subscribe')]);
});

// Reconnect callback tests

test('callback with existing accounts updates session without creating new accounts', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
        'last_synced_at' => now()->subWeek(),
    ]);

    Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'existing-ext-account-1',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->with('test-code')
        ->once()
        ->andReturn([
            'session_id' => 'new-session-456',
            'accounts' => [
                [
                    'uid' => 'existing-ext-account-1',
                    'currency' => 'EUR',
                    'name' => 'CaixaBank Account',
                    'account_id' => ['iban' => 'ES1234567890123456789012'],
                ],
            ],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    $response->assertRedirect(route('settings.connections.index'));
    $response->assertSessionHas('success', 'Bank account reconnected successfully.');

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::Active);
    expect($connection->session_id)->toBe('new-session-456');
    expect($connection->error_message)->toBeNull();

    // No duplicate accounts should have been created
    $this->assertDatabaseCount('accounts', 1);

    Queue::assertPushed(SyncBankingConnectionJob::class);
});

test('callback with existing accounts skips mapping on reconnect', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
    ]);

    Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'existing-ext-account-1',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->once()
        ->andReturn([
            'session_id' => 'new-session-789',
            'accounts' => [],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $response = $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    // Must redirect to connections page, NOT to the account-mapping route
    $response->assertRedirect(route('settings.connections.index'));

    $connection->refresh();
    expect($connection->status)->toBe(BankingConnectionStatus::Active);

    Queue::assertPushed(SyncBankingConnectionJob::class);
});

// refreshAccountIds tests

test('reconnect callback updates external_account_id when enable banking issues new account uids', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
    ]);

    $account = Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'old-uid-1',
        'iban' => 'ES1234567890123456789012',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->with('test-code')
        ->once()
        ->andReturn([
            'session_id' => 'new-session-abc',
            'accounts' => [
                [
                    'uid' => 'new-uid-1',
                    'currency' => 'EUR',
                    'name' => 'CaixaBank Account',
                    'account_id' => ['iban' => 'ES1234567890123456789012'],
                ],
            ],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    $account->refresh();
    expect($account->external_account_id)->toBe('new-uid-1');
    expect($account->iban)->toBe('ES1234567890123456789012');
});

test('reconnect callback matches accounts by iban before falling back to position', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
    ]);

    // Two accounts; create them in reverse IBAN order to confirm positional matching
    // would produce wrong results, while IBAN matching produces correct results.
    $accountA = Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'old-uid-a',
        'iban' => 'ES0000000000000000000001',
        'created_at' => now()->subMinutes(2),
    ]);

    $accountB = Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'old-uid-b',
        'iban' => 'ES0000000000000000000002',
        'created_at' => now()->subMinutes(1),
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->once()
        ->andReturn([
            'session_id' => 'new-session-abc',
            // Enable Banking returns accounts in a different order this time
            'accounts' => [
                [
                    'uid' => 'new-uid-b',
                    'currency' => 'EUR',
                    'name' => 'Account B',
                    'account_id' => ['iban' => 'ES0000000000000000000002'],
                ],
                [
                    'uid' => 'new-uid-a',
                    'currency' => 'EUR',
                    'name' => 'Account A',
                    'account_id' => ['iban' => 'ES0000000000000000000001'],
                ],
            ],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    expect($accountA->refresh()->external_account_id)->toBe('new-uid-a');
    expect($accountB->refresh()->external_account_id)->toBe('new-uid-b');
});

test('reconnect callback uses positional fallback for accounts without stored iban', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'CaixaBank',
        'aspsp_country' => 'ES',
    ]);

    $accountA = Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'old-uid-a',
        'iban' => null, // legacy account without IBAN stored
        'created_at' => now()->subMinutes(2),
    ]);

    $accountB = Account::factory()->create([
        'user_id' => $user->id,
        'banking_connection_id' => $connection->id,
        'external_account_id' => 'old-uid-b',
        'iban' => null,
        'created_at' => now()->subMinutes(1),
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->once()
        ->andReturn([
            'session_id' => 'new-session-abc',
            'accounts' => [
                [
                    'uid' => 'new-uid-a',
                    'currency' => 'EUR',
                    'name' => 'Account A',
                    'account_id' => ['iban' => 'ES0000000000000000000001'],
                ],
                [
                    'uid' => 'new-uid-b',
                    'currency' => 'EUR',
                    'name' => 'Account B',
                    'account_id' => ['iban' => 'ES0000000000000000000002'],
                ],
            ],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    // Positional match: index 0 → accountA (oldest), index 1 → accountB
    expect($accountA->refresh()->external_account_id)->toBe('new-uid-a');
    expect($accountA->refresh()->iban)->toBe('ES0000000000000000000001'); // IBAN populated from new session
    expect($accountB->refresh()->external_account_id)->toBe('new-uid-b');
    expect($accountB->refresh()->iban)->toBe('ES0000000000000000000002');
});

test('callback stores iban in pending accounts data', function () {
    Queue::fake();

    $user = User::factory()->onboarded()->create();
    $connection = BankingConnection::factory()->pending()->create([
        'user_id' => $user->id,
        'aspsp_name' => 'Test Bank',
        'aspsp_country' => 'ES',
    ]);

    $mockProvider = Mockery::mock(BankingProviderInterface::class);
    $mockProvider->shouldReceive('createSession')
        ->with('test-code')
        ->once()
        ->andReturn([
            'session_id' => 'session-new',
            'accounts' => [
                [
                    'uid' => 'ext-account-1',
                    'currency' => 'EUR',
                    'name' => 'My Account',
                    'account_id' => ['iban' => 'ES9999999999999999999999'],
                ],
            ],
            'access' => ['valid_until' => now()->addDays(90)->toIso8601String()],
        ]);

    $this->app->instance(BankingProviderInterface::class, $mockProvider);

    $this->actingAs($user)->get('/open-banking/callback?code=test-code');

    $connection->refresh();
    expect($connection->pending_accounts_data)->toHaveCount(1);
    expect($connection->pending_accounts_data[0]['account_id']['iban'])->toBe('ES9999999999999999999999');
});