feat: implement user authentication and session management

.gitignore

@@ -30,3 +30,5 @@
 
 # Ignore master key for decrypting credentials and more.
 /config/master.key
+
+.DS_Store

app/controllers/application_controller.rb

@@ -10,12 +10,17 @@ class ApplicationController < ActionController::API
   private
   def authenticate!
     token = request.headers["Authorization"]&.split(" ")&.last
-    @current_user = Session.find_by(token:)&.user
+    @current_session = Session.find_by(token: token)
+    raise Unauthorized unless @current_session
 
-    raise Unauthorized unless @current_user
+    @current_user = @current_session.user
   end
 
   def current_user
     @current_user
   end
+
+  def current_session
+    @current_session
+  end
 end

app/controllers/sessions_controller.rb

@@ -1,12 +1,26 @@
 class SessionsController < ApplicationController
-  before_action :authenticate_user, only: [:destroy]
+  skip_before_action :authenticate!, only: [ :create ]
 
   def create
-    user = User.find_by(email: params[:email])
+    user = User.find_by(email: login_params[:email])
 
+    unless user.present? && user.authenticate(login_params[:password])
+      raise Unauthorized
+    end
+
+    session = user.sessions.create!
+
+    render_success(user: user, token: session.token)
   end
 
   def destroy
+    @current_session.destroy!
+    render_success(nil)
+  end
 
+  private
+
+  def login_params
+    params.permit(:email, :password)
   end
 end

app/controllers/users_controller.rb

@@ -1,6 +1,15 @@
 class UsersController < ApplicationController
-  def create
+  skip_before_action :authenticate!, only: [ :create ]
 
+  def create
+    user = User.new(user_params)
+
+    if user.save
+      session = user.sessions.create!
+      render_success({ user: user, token: session.token }, :created)
+    else
+      render_error("Failed to create user", :unprocessable_entity, details: user.errors.full_messages)
+    end
   end
 
   def show
@@ -10,4 +19,10 @@ class UsersController < ApplicationController
   def destroy
 
   end
+
+  private
+
+  def user_params
+    params.require(:user).permit(:name, :email, :password, :password_confirmation)
+  end
 end

app/models/session.rb

@@ -1,3 +1,25 @@
+# == Schema Information
+#
+# Table name: sessions
+#
+#  id         :bigint           not null, primary key
+#  ip_address :string
+#  token      :string
+#  user_agent :string
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_sessions_on_token    (token) UNIQUE
+#  index_sessions_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
 class Session < ApplicationRecord
+  has_secure_token
   belongs_to :user
 end

bruno/auth/login-invalid.bru

@@ -0,0 +1,35 @@
+meta {
+  name: Login - Invalid Credentials
+  type: http
+  seq: 4
+}
+
+post {
+  url: {{baseUrl}}/login
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "email": "nonexistent@example.com",
+    "password": "wrongpassword"
+  }
+}
+
+assert {
+  res.status: equals 401
+  res.body.success: equals false
+}
+
+tests {
+  test("Invalid login returns error envelope", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(false);
+    expect(data).to.have.property("error");
+    expect(data.error).to.have.property("message");
+  });
+}

bruno/auth/login.bru

@@ -0,0 +1,64 @@
+meta {
+  name: Login
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/login
+  body: json
+  auth: none
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "email": "{{userEmail}}",
+    "password": "password123"
+  }
+}
+
+assert {
+  res.status: 200
+  res.body.success: true
+  res("data.token"): isNotEmpty
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.data && body.data.token) {
+    bru.setVar("authToken", body.data.token);
+    bru.setVar("userId", body.data.user.id);
+  }
+}
+
+tests {
+  test("Login returns wrapped success response", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(true);
+    expect(data).to.have.property("data");
+  });
+  
+  test("Data contains user object and token string", function() {
+    const data = res.getBody();
+    expect(data.data).to.have.property("user");
+    expect(data.data).to.have.property("token");
+  });
+  
+  test("User object has correct shape", function() {
+    const data = res.getBody();
+    expect(data.data.user).to.have.property("id");
+    expect(data.data.user).to.have.property("email");
+    expect(data.data.user).to.have.property("name");
+  });
+  
+  test("Token is a non-empty string", function() {
+    const data = res.getBody();
+    expect(data.data.token).to.be.a("string");
+    expect(data.data.token.length).to.be.greaterThan(0);
+  });
+}

bruno/auth/logout.bru

@@ -0,0 +1,38 @@
+meta {
+  name: Logout
+  type: http
+  seq: 3
+}
+
+delete {
+  url: {{baseUrl}}/logout
+  body: none
+  auth: none
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+  res.body.success: equals true
+}
+
+script:post-response {
+  bru.deleteVar("authToken");
+  bru.deleteVar("userId");
+}
+
+tests {
+  test("Logout returns { success: true }", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(true);
+  });
+  
+  test("Logout response has no data envelope", function() {
+    const data = res.getBody();
+    expect(data).to.not.have.property("data");
+  });
+}

bruno/auth/signup.bru

@@ -0,0 +1,60 @@
+meta {
+  name: Signup
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/signup
+  body: json
+  auth: none
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "user": {
+      "name": "Test User",
+      "email": "test@example.com",
+      "password": "password123",
+      "password_confirmation": "password123"
+    }
+  }
+}
+
+assert {
+  res.status: equals 200
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.data && body.data.token) {
+    bru.setVar("authToken", body.data.token);
+    bru.setVar("userId", body.data.user.id);
+    bru.setVar("userEmail", "test@example.com");
+  }
+}
+
+tests {
+  test("Signup returns wrapped success response", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(true);
+  });
+  
+  test("Signup response contains data envelope", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("data");
+  });
+  
+  test("Data contains user and token", function() {
+    const data = res.getBody();
+    expect(data.data).to.have.property("user");
+    expect(data.data).to.have.property("token");
+    expect(data.data.user).to.have.property("id");
+    expect(data.data.user).to.have.property("email");
+  });
+}

bruno/auth/unauthorized.bru

@@ -0,0 +1,28 @@
+meta {
+  name: Unauthorized Access
+  type: http
+  seq: 5
+}
+
+get {
+  url: {{baseUrl}}/users/{{userId}}
+}
+
+headers {
+  Authorization: Bearer invalid_token_here
+}
+
+assert {
+  res.status: equals 401
+  res.body.success: equals false
+}
+
+tests {
+  test("Invalid token returns 401 with error shape", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(false);
+    expect(data).to.have.property("error");
+    expect(data.error).to.have.property("message");
+  });
+}

bruno/bruno.json

@@ -0,0 +1,8 @@
+{
+  "version": "1",
+  "name": "Price Point API",
+  "type": "collection",
+  "ignore": [
+    "node_modules"
+  ]
+}

bruno/chains/create-chain.bru

@@ -0,0 +1,49 @@
+meta {
+  name: Create Chain
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/chains
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "chain": {
+      "name": "Test Chain Store"
+    }
+  }
+}
+
+assert {
+  res.status: equals 201
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.id) {
+    bru.setVar("chainId", body.id);
+  }
+}
+
+tests {
+  test("Create chain returns chain object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Created chain has correct name", function() {
+    const data = res.getBody();
+    expect(data.name).to.equal("Test Chain Store");
+  });
+}

bruno/chains/delete-chain.bru

@@ -0,0 +1,23 @@
+meta {
+  name: Delete Chain
+  type: http
+  seq: 5
+}
+
+delete {
+  url: {{baseUrl}}/chains/{{chainId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 204
+}
+
+tests {
+  test("Delete chain returns 204 no content", function() {
+    expect(res.getStatus()).to.equal(204);
+  });
+}

bruno/chains/get-chain.bru

@@ -0,0 +1,32 @@
+meta {
+  name: Get Chain
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{baseUrl}}/chains/{{chainId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Get chain returns chain object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Chain id matches requested id", function() {
+    const data = res.getBody();
+    expect(data.id).to.equal(Number(bru.getVar("chainId")));
+  });
+}

bruno/chains/list-chains.bru

@@ -0,0 +1,32 @@
+meta {
+  name: List Chains
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/chains
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("List chains returns an array", function() {
+    const data = res.getBody();
+    expect(data).to.be.an("array");
+  });
+
+  test("Each chain has correct shape", function() {
+    const data = res.getBody();
+    data.forEach(function(chain) {
+      expect(chain).to.have.property("id");
+      expect(chain).to.have.property("name");
+    });
+  });
+}

bruno/chains/update-chain.bru

@@ -0,0 +1,36 @@
+meta {
+  name: Update Chain
+  type: http
+  seq: 4
+}
+
+patch {
+  url: {{baseUrl}}/chains/{{chainId}}
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "chain": {
+      "name": "Updated Chain Name"
+    }
+  }
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Update chain returns updated object", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data.name).to.equal("Updated Chain Name");
+  });
+}

bruno/collection.bru

@@ -0,0 +1,22 @@
+meta {
+  name: Price Point API
+}
+
+headers {
+  Content-Type: application/json
+}
+
+tests {
+  test("Response status is not a server error", function() {
+    expect(res.getStatus()).to.be.below(500);
+  });
+  
+  test("Response time is under 2 seconds", function() {
+    expect(res.getResponseTime()).to.be.below(2000);
+  });
+  
+  test("Response body is valid JSON", function() {
+    const body = res.getBody();
+    expect(body).to.not.be.undefined;
+  });
+}

bruno/environments/Local.bru

@@ -0,0 +1,4 @@
+vars {
+  baseUrl: http://localhost:3000
+  userEmail: test@example.com
+}

bruno/price-reports/create-price-report.bru

@@ -0,0 +1,57 @@
+meta {
+  name: Create Price Report
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/products/{{productId}}/price_reports
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "price_report": {
+      "price": "9.99",
+      "discount_price": "7.99",
+      "store_id": {{storeId}}
+    }
+  }
+}
+
+assert {
+  res.status: equals 201
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.id) {
+    bru.setVar("priceReportId", body.id);
+  }
+}
+
+tests {
+  test("Create price report returns report object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("price");
+    expect(data).to.have.property("discount_price");
+    expect(data).to.have.property("store_id");
+    expect(data).to.have.property("product_id");
+    expect(data).to.have.property("user_id");
+    expect(data).to.have.property("reported_at");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Price report has correct values", function() {
+    const data = res.getBody();
+    expect(data.product_id).to.equal(Number(bru.getVar("productId")));
+    expect(data.store_id).to.equal(Number(bru.getVar("storeId")));
+  });
+}

bruno/price-reports/delete-price-report.bru

@@ -0,0 +1,23 @@
+meta {
+  name: Delete Price Report
+  type: http
+  seq: 5
+}
+
+delete {
+  url: {{baseUrl}}/price_reports/{{priceReportId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 204
+}
+
+tests {
+  test("Delete price report returns 204 no content", function() {
+    expect(res.getStatus()).to.equal(204);
+  });
+}

bruno/price-reports/get-price-report.bru

@@ -0,0 +1,37 @@
+meta {
+  name: Get Price Report
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{baseUrl}}/price_reports/{{priceReportId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Get price report returns report object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("price");
+    expect(data).to.have.property("discount_price");
+    expect(data).to.have.property("store_id");
+    expect(data).to.have.property("product_id");
+    expect(data).to.have.property("user_id");
+    expect(data).to.have.property("reported_at");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Price report id matches requested id", function() {
+    const data = res.getBody();
+    expect(data.id).to.equal(Number(bru.getVar("priceReportId")));
+  });
+}

bruno/price-reports/list-price-reports.bru

@@ -0,0 +1,35 @@
+meta {
+  name: List Price Reports
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/products/{{productId}}/price_reports
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("List price reports returns an array", function() {
+    const data = res.getBody();
+    expect(data).to.be.an("array");
+  });
+
+  test("Each price report has correct shape", function() {
+    const data = res.getBody();
+    data.forEach(function(report) {
+      expect(report).to.have.property("id");
+      expect(report).to.have.property("price");
+      expect(report).to.have.property("store_id");
+      expect(report).to.have.property("product_id");
+      expect(report).to.have.property("user_id");
+    });
+  });
+}

bruno/price-reports/update-price-report.bru

@@ -0,0 +1,43 @@
+meta {
+  name: Update Price Report
+  type: http
+  seq: 4
+}
+
+patch {
+  url: {{baseUrl}}/price_reports/{{priceReportId}}
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "price_report": {
+      "price": "12.99",
+      "discount_price": "10.99"
+    }
+  }
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Update price report returns updated object", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("price");
+    expect(data).to.have.property("discount_price");
+  });
+
+  test("Updated values are reflected", function() {
+    const data = res.getBody();
+    expect(String(data.price)).to.equal("12.99");
+    expect(String(data.discount_price)).to.equal("10.99");
+  });
+}

bruno/products/create-product.bru

@@ -0,0 +1,52 @@
+meta {
+  name: Create Product
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/products
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "product": {
+      "name": "Test Product",
+      "barcode": "1234567890123"
+    }
+  }
+}
+
+assert {
+  res.status: equals 201
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.id) {
+    bru.setVar("productId", body.id);
+  }
+}
+
+tests {
+  test("Create product returns product object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("barcode");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Created product has correct values", function() {
+    const data = res.getBody();
+    expect(data.name).to.equal("Test Product");
+    expect(data.barcode).to.equal("1234567890123");
+  });
+}

bruno/products/delete-product.bru

@@ -0,0 +1,23 @@
+meta {
+  name: Delete Product
+  type: http
+  seq: 5
+}
+
+delete {
+  url: {{baseUrl}}/products/{{productId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 204
+}
+
+tests {
+  test("Delete product returns 204 no content", function() {
+    expect(res.getStatus()).to.equal(204);
+  });
+}

bruno/products/get-product.bru

@@ -0,0 +1,33 @@
+meta {
+  name: Get Product
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{baseUrl}}/products/{{productId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Get product returns product object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("barcode");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Product id matches requested id", function() {
+    const data = res.getBody();
+    expect(data.id).to.equal(Number(bru.getVar("productId")));
+  });
+}

bruno/products/list-products.bru

@@ -0,0 +1,33 @@
+meta {
+  name: List Products
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/products
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("List products returns an array", function() {
+    const data = res.getBody();
+    expect(data).to.be.an("array");
+  });
+
+  test("Each product has correct shape", function() {
+    const data = res.getBody();
+    data.forEach(function(product) {
+      expect(product).to.have.property("id");
+      expect(product).to.have.property("name");
+      expect(product).to.have.property("barcode");
+    });
+  });
+}

bruno/products/update-product.bru

@@ -0,0 +1,37 @@
+meta {
+  name: Update Product
+  type: http
+  seq: 4
+}
+
+patch {
+  url: {{baseUrl}}/products/{{productId}}
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "product": {
+      "name": "Updated Product Name"
+    }
+  }
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Update product returns updated object", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("barcode");
+    expect(data.name).to.equal("Updated Product Name");
+  });
+}

bruno/stores/create-store.bru

@@ -0,0 +1,56 @@
+meta {
+  name: Create Store
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/stores
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "store": {
+      "name": "Test Store Location",
+      "latitude": 40.7128,
+      "longitude": -74.006,
+      "chain_id": {{chainId}}
+    }
+  }
+}
+
+assert {
+  res.status: equals 201
+}
+
+script:post-response {
+  const body = res.getBody();
+  if (body && body.id) {
+    bru.setVar("storeId", body.id);
+  }
+}
+
+tests {
+  test("Create store returns store object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("latitude");
+    expect(data).to.have.property("longitude");
+    expect(data).to.have.property("chain_id");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Created store has correct values", function() {
+    const data = res.getBody();
+    expect(data.name).to.equal("Test Store Location");
+    expect(data.chain_id).to.equal(Number(bru.getVar("chainId")));
+  });
+}

bruno/stores/delete-store.bru

@@ -0,0 +1,23 @@
+meta {
+  name: Delete Store
+  type: http
+  seq: 5
+}
+
+delete {
+  url: {{baseUrl}}/stores/{{storeId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 204
+}
+
+tests {
+  test("Delete store returns 204 no content", function() {
+    expect(res.getStatus()).to.equal(204);
+  });
+}

bruno/stores/get-store.bru

@@ -0,0 +1,35 @@
+meta {
+  name: Get Store
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{baseUrl}}/stores/{{storeId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Get store returns store object directly", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data).to.have.property("latitude");
+    expect(data).to.have.property("longitude");
+    expect(data).to.have.property("chain_id");
+    expect(data).to.have.property("created_at");
+    expect(data).to.have.property("updated_at");
+  });
+
+  test("Store id matches requested id", function() {
+    const data = res.getBody();
+    expect(data.id).to.equal(Number(bru.getVar("storeId")));
+  });
+}

bruno/stores/list-stores.bru

@@ -0,0 +1,35 @@
+meta {
+  name: List Stores
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/stores
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("List stores returns an array", function() {
+    const data = res.getBody();
+    expect(data).to.be.an("array");
+  });
+
+  test("Each store has correct shape", function() {
+    const data = res.getBody();
+    data.forEach(function(store) {
+      expect(store).to.have.property("id");
+      expect(store).to.have.property("name");
+      expect(store).to.have.property("latitude");
+      expect(store).to.have.property("longitude");
+      expect(store).to.have.property("chain_id");
+    });
+  });
+}

bruno/stores/update-store.bru

@@ -0,0 +1,36 @@
+meta {
+  name: Update Store
+  type: http
+  seq: 4
+}
+
+patch {
+  url: {{baseUrl}}/stores/{{storeId}}
+  body: json
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{authToken}}
+}
+
+body:json {
+  {
+    "store": {
+      "name": "Updated Store Name"
+    }
+  }
+}
+
+assert {
+  res.status: equals 200
+}
+
+tests {
+  test("Update store returns updated object", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("id");
+    expect(data).to.have.property("name");
+    expect(data.name).to.equal("Updated Store Name");
+  });
+}

bruno/users/delete-user.bru

@@ -0,0 +1,26 @@
+meta {
+  name: Delete User
+  type: http
+  seq: 2
+}
+
+delete {
+  url: {{baseUrl}}/users/{{userId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+  res.body.success: equals true
+}
+
+tests {
+  test("Delete user returns { success: true }", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(true);
+  });
+}

bruno/users/get-user.bru

@@ -0,0 +1,34 @@
+meta {
+  name: Get User
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/users/{{userId}}
+}
+
+headers {
+  Authorization: Bearer {{authToken}}
+}
+
+assert {
+  res.status: equals 200
+  res.body.success: equals true
+}
+
+tests {
+  test("Get user returns wrapped success response", function() {
+    const data = res.getBody();
+    expect(data).to.have.property("success");
+    expect(data.success).to.equal(true);
+    expect(data).to.have.property("data");
+  });
+
+  test("User data has correct shape", function() {
+    const data = res.getBody();
+    expect(data.data).to.have.property("id");
+    expect(data.data).to.have.property("email");
+    expect(data.data).to.have.property("name");
+  });
+}

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_05_30_204821) do
+ActiveRecord::Schema[8.0].define(version: 2026_06_09_155729) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_catalog.plpgsql"
 
@@ -81,6 +81,17 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_30_204821) do
     t.index ["barcode"], name: "index_products_on_barcode", unique: true
   end
 
+  create_table "sessions", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.string "token"
+    t.string "user_agent"
+    t.string "ip_address"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["token"], name: "index_sessions_on_token", unique: true
+    t.index ["user_id"], name: "index_sessions_on_user_id"
+  end
+
   create_table "stores", force: :cascade do |t|
     t.string "name"
     t.float "latitude"
@@ -118,6 +129,7 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_30_204821) do
   add_foreign_key "price_reports", "products"
   add_foreign_key "price_reports", "stores"
   add_foreign_key "price_reports", "users"
+  add_foreign_key "sessions", "users"
   add_foreign_key "stores", "chains"
   add_foreign_key "votes", "users"
 end

sig/application_controller.rbs

@@ -0,0 +1,3 @@
+class ApplicationController
+  @current_user: User
+end

test/fixtures/sessions.yml

@@ -1,5 +1,26 @@
 # Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html
 
+# == Schema Information
+#
+# Table name: sessions
+#
+#  id         :bigint           not null, primary key
+#  ip_address :string
+#  token      :string
+#  user_agent :string
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_sessions_on_token    (token) UNIQUE
+#  index_sessions_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
 one:
   user: one
   token: MyString

test/models/session_test.rb

@@ -1,3 +1,24 @@
+# == Schema Information
+#
+# Table name: sessions
+#
+#  id         :bigint           not null, primary key
+#  ip_address :string
+#  token      :string
+#  user_agent :string
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_sessions_on_token    (token) UNIQUE
+#  index_sessions_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
 require "test_helper"
 
 class SessionTest < ActiveSupport::TestCase