# Auth-Gated App Testing Playbook (Solace-Companion)

Solace supports TWO auth methods:
1. Email/password (JWT) — token returned by /api/auth/signup and /api/auth/login, sent as `Authorization: Bearer <token>`. Frontend stores it in localStorage `solace_token`.
2. Emergent Google OAuth — session_token stored in DB (`user_sessions`) + httpOnly cookie.

## Testing email/password (simplest)
```
API=$(grep REACT_APP_BACKEND_URL /app/frontend/.env | cut -d= -f2)
TOKEN=$(curl -s -X POST "$API/api/auth/signup" -H "Content-Type: application/json" \
  -d '{"email":"qa@example.com","password":"solace1234","name":"QA"}' | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
curl -s "$API/api/auth/me" -H "Authorization: Bearer $TOKEN"
curl -s "$API/api/companions" -H "Authorization: Bearer $TOKEN"
```

## Testing Google session (DB seed)
```
mongosh --eval "
use('test_database');
var userId = 'user_' + Date.now();
var sessionToken = 'test_session_' + Date.now();
db.users.insertOne({user_id:userId,email:'g'+Date.now()+'@example.com',name:'G User',created_at:new Date().toISOString(),subscription_status:'none'});
db.user_sessions.insertOne({user_id:userId,session_token:sessionToken,expires_at:new Date(Date.now()+7*24*3600*1000).toISOString(),created_at:new Date().toISOString()});
print('Session token: ' + sessionToken);
"
```
Then set cookie `session_token` or use `Authorization: Bearer <sessionToken>`.

## Browser cookie
```
await page.context.add_cookies([{ "name":"session_token","value":"<TOKEN>","domain":"<host>","path":"/","httpOnly":true,"secure":true,"sameSite":"None" }])
```

## Checklist
- users have `user_id` (custom), queries use `{"_id":0}`.
- Bearer token works for both JWT and session tokens (resolve_user handles both).
- Dashboard auto-starts a 7-day trial on first load.