add back destroy other browser sessions endpoint (jetstream migration)

tests/Feature/BrowserSessionsTest.php

@@ -1,25 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Feature;
-
-use App\Models\User;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Tests\TestCase;
-
-class BrowserSessionsTest extends TestCase
-{
-    use RefreshDatabase;
-
-    public function test_other_browser_sessions_can_be_logged_out(): void
-    {
-        $this->actingAs($user = User::factory()->create());
-
-        $response = $this->delete('/user/other-browser-sessions', [
-            'password' => 'password',
-        ]);
-
-        $response->assertSessionHasNoErrors();
-    }
-}

tests/Unit/Endpoint/Web/OtherBrowserSessionsEndpointTest.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Endpoint\Web;
+
+use App\Http\Controllers\Web\OtherBrowserSessionsController;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use PHPUnit\Framework\Attributes\CoversClass;
+
+#[CoversClass(OtherBrowserSessionsController::class)]
+class OtherBrowserSessionsEndpointTest extends EndpointTestAbstract
+{
+    public function test_destroy_logs_out_other_browser_sessions_with_the_correct_password(): void
+    {
+        // Arrange
+        $user = User::factory()->create();
+        $originalPasswordHash = $user->password;
+        $this->actingAs($user);
+
+        // Act
+        $response = $this->delete('/user/other-browser-sessions', [
+            'password' => 'password',
+        ]);
+
+        // Assert
+        $response->assertRedirect();
+        $response->assertSessionHasNoErrors();
+        // logoutOtherDevices re-hashes the password (same plaintext, new hash) to invalidate other sessions.
+        $this->assertNotSame($originalPasswordHash, $user->fresh()->password);
+        $this->assertTrue(Hash::check('password', $user->fresh()->password));
+    }
+
+    public function test_destroy_fails_with_an_incorrect_password(): void
+    {
+        // Arrange
+        $user = User::factory()->create();
+        $originalPasswordHash = $user->password;
+        $this->actingAs($user);
+
+        // Act
+        $response = $this->delete('/user/other-browser-sessions', [
+            'password' => 'wrong-password',
+        ]);
+
+        // Assert
+        $response->assertSessionHasErrors('password');
+        // No side effects when the password is incorrect: the password must not be re-hashed.
+        $this->assertSame($originalPasswordHash, $user->fresh()->password);
+    }
+
+    public function test_destroy_requires_authentication(): void
+    {
+        // Act
+        $response = $this->delete('/user/other-browser-sessions', [
+            'password' => 'password',
+        ]);
+
+        // Assert
+        $response->assertRedirect(route('login'));
+    }
+
+    public function test_destroy_deletes_the_other_database_session_records_of_the_current_user(): void
+    {
+        // Arrange
+        config(['session.driver' => 'database']);
+        $user = User::factory()->create();
+        $otherUser = User::factory()->create();
+        $this->actingAs($user);
+
+        DB::table('sessions')->insert([
+            [
+                'id' => 'other-session-of-current-user',
+                'user_id' => $user->getKey(),
+                'ip_address' => '192.0.2.10',
+                'user_agent' => '',
+                'payload' => '',
+                'last_activity' => now()->subMinutes(5)->timestamp,
+            ],
+            [
+                'id' => 'session-of-another-user',
+                'user_id' => $otherUser->getKey(),
+                'ip_address' => '192.0.2.30',
+                'user_agent' => '',
+                'payload' => '',
+                'last_activity' => now()->timestamp,
+            ],
+        ]);
+
+        // Act
+        $response = $this->delete('/user/other-browser-sessions', [
+            'password' => 'password',
+        ]);
+
+        // Assert
+        $response->assertSessionHasNoErrors();
+        // The current user's other sessions are removed, while another user's session is untouched.
+        $this->assertDatabaseMissing('sessions', ['id' => 'other-session-of-current-user']);
+        $this->assertDatabaseHas('sessions', ['id' => 'session-of-another-user']);
+    }
+}