Phase 7-8

backend/WordVersioning.Api.IntegrationTests/AuthTests.cs

@@ -0,0 +1,51 @@
+using System.Net;
+
+namespace WordVersioning.Api.IntegrationTests;
+
+/// <summary>FR-8 ฝั่ง backend + AC-3 — ทุก endpoint ต้อง [Authorize]: ไม่แนบ token → 401 ทั้งหมด</summary>
+[Collection(IntegrationTestCollection.Name)]
+public sealed class AuthTests(IntegrationTestFixture fixture)
+{
+    [Theory]
+    [InlineData("GET", "api/templates")]
+    [InlineData("POST", "api/templates")]
+    [InlineData("GET", "api/templates/{0}/documents")]
+    [InlineData("POST", "api/documents/generate")]
+    [InlineData("GET", "api/documents/{0}/versions")]
+    [InlineData("POST", "api/documents/{0}/versions")]
+    [InlineData("GET", "api/documents/{0}/versions/{1}/download")]
+    [InlineData("GET", "api/documents/{0}")]
+    public async Task WithoutToken_AllEndpoints_Return401(string method, string routeTemplate)
+    {
+        using var client = fixture.CreateAnonymousClient();
+        var route = routeTemplate
+            .Replace("{0}", Guid.NewGuid().ToString())
+            .Replace("{1}", Guid.NewGuid().ToString());
+
+        using var request = new HttpRequestMessage(new HttpMethod(method), route);
+        using var response = await client.SendAsync(request);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task WithGarbageToken_Returns401()
+    {
+        using var client = fixture.CreateAnonymousClient();
+        client.DefaultRequestHeaders.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "not-a-real-jwt");
+
+        using var response = await client.GetAsync("api/templates");
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task WithValidToken_Returns200()
+    {
+        using var client = fixture.CreateClient();
+        using var response = await client.GetAsync("api/templates");
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+    }
+}