chore: init project

tests/InboxIntel.IntegrationTests/AuthEndpointsTests.cs

@@ -0,0 +1,53 @@
+using System.Net;
+using FluentAssertions;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Hosting;
+using Xunit;
+
+namespace InboxIntel.IntegrationTests;
+
+/// <summary>
+/// Test host that disables startup auto-migration so the factory boots without
+/// a live PostgreSQL instance. The auth tests below never touch the database
+/// (the challenge happens in middleware before any controller runs).
+/// </summary>
+public class TestAppFactory : WebApplicationFactory<Program>
+{
+    protected override IHost CreateHost(IHostBuilder builder)
+    {
+        builder.ConfigureHostConfiguration(cfg => cfg.AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["Database:AutoMigrate"] = "false"
+        }));
+        return base.CreateHost(builder);
+    }
+}
+
+/// <summary>
+/// Smoke tests proving the host boots and authorization is enforced. A fuller
+/// suite would swap PostgreSQL for a Testcontainers instance and the Gmail
+/// client for a fake, then exercise sync -> analytics end to end.
+/// </summary>
+public class AuthEndpointsTests : IClassFixture<TestAppFactory>
+{
+    private readonly TestAppFactory _factory;
+    public AuthEndpointsTests(TestAppFactory factory) => _factory = factory;
+
+    [Fact]
+    public async Task Protected_endpoint_challenges_when_anonymous()
+    {
+        var client = _factory.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
+        var resp = await client.GetAsync("/api/v1/analytics/dashboard");
+        // Unauthenticated -> redirect to Google challenge (302) or 401.
+        resp.StatusCode.Should().BeOneOf(HttpStatusCode.Found, HttpStatusCode.Unauthorized);
+    }
+
+    [Fact]
+    public async Task Login_endpoint_is_anonymous()
+    {
+        var client = _factory.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
+        var resp = await client.GetAsync("/api/v1/auth/login");
+        resp.StatusCode.Should().Be(HttpStatusCode.Redirect); // 302 to Google
+    }
+}