[Socialite] Need help testing controller method that uses Socialite's userFromToken

[furatamasensei]

I have been looking for about a week and did some trial and errors but still can't find any solution for this. All I want to do is to assert the returned response from the endpoint that points to a method loginDriver inside my AuthController, but the Socialite implementation was triggered and throws an exception.

The implementation works when I test it manually using real device but I need it to be tested via PHPUnit.

I went to the docs about Mocking, but I'm not sure what to put in shouldReceive for this to work. To help you get a better idea, please have a look at my implementation.

Any kind of help would be very appreciated.

AuthTest.php

public function test_user_can_login_using_auth_driver()
{
    $response = $this->postJson(route('auth.login.driver'), [
        'driver' => 'google',
        'driver_token' => "this is generated natively on client's device (android/ios), how can i fake this????",
        'device_name' => "someone's android/ios"
    ]);

    $response->assertOk();
    $response->assertJsonStructure(['access_token', 'user']);
}

AuthController.php

/**
 * Authenticate the user using auth driver like google and facebook.
 *
 * Since we are working with devices that natively support social auth,
 * user can just select their account from there and it will generate an
 * access token for each login method (driver) they choose.
 * 
 * All we need to do here is to check if the token is valid and returns their data,
 * and check if it has been registered locally in the database, if it's none,
 * then create a new account for them. No need to redirect to anywhere.
 * 
 * @param  \App\Http\Requests\RequestLoginDriver  $request
 * @return \Illuminate\Http\Response
 */
public function loginDriver(RequestLoginDriver $request)
{
    $soci = Socialite::driver($request->driver)->userFromToken($request->driver_token);

    if (!$soci) {
        throw ValidationException::withMessages([
            'messages' => ['The given credentials does not match any records']
        ]);
    }

    $user = User::firstOrCreate(
        ['email' => $soci->getEmail()],
        ['name' => $soci->getNickname(), 'password' => Hash::make(Str::uuid())]
    );

    $token = $user->createToken($request->device_name)->plainTextToken;

    return response()->json([
        'access_token' => $token,
        'user' => $user,
    ]);
}

RequestLoginDriver.php

class RequestLoginDriver extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'driver' => 'required|string|in:google,facebook',
            'driver_token' => 'required|string',
            'device_name' => 'required|string',
        ];
    }
}

[murilolivorato]

maybe this can help you -
https://medium.com/@murilolivorato/login-with-facebook-in-a-vue-laravel-app-popup-redirect-oauth-04e4c077f6a4

[sts19813]

You do not need a real provider token for this test. Mock the provider returned by Socialite::driver(), then make its userFromToken() method return a Socialite user.

For example:

use Laravel\Socialite\Facades\Socialite;
use Laravel\Socialite\Two\User as SocialiteUser;
use Mockery;

public function test_it_logs_in_a_user_with_a_social_provider_token(): void
{
    $socialUser = (new SocialiteUser)->map([
        'id' => 'google-123',
        'nickname' => 'Jane',
        'name' => 'Jane Doe',
        'email' => 'jane@example.test',
        'avatar' => null,
    ]);

    $provider = Mockery::mock();

    $provider->shouldReceive('userFromToken')
        ->once()
        ->with('fake-provider-token')
        ->andReturn($socialUser);

    Socialite::shouldReceive('driver')
        ->once()
        ->with('google')
        ->andReturn($provider);

    // Replace this URL with the route that calls your login method.
    $response = $this->postJson('/api/auth/driver', [
        'driver' => 'google',
        'driver_token' => 'fake-provider-token',
        'device_name' => 'phpunit',
    ]);

    $response
        ->assertOk()
        ->assertJsonStructure([
            'access_token',
            'user',
        ]);

    $this->assertDatabaseHas('users', [
        'email' => 'jane@example.test',
        'name' => 'Jane',
    ]);
}

This leaves your request validation, firstOrCreate(), relationship update, Sanctum token creation, and JSON response in the test. Only the external OAuth provider call is replaced.

Using an explicit provider mock is also important for this particular method: newer Socialite versions have Socialite::fake() for common redirect/callback tests, but the fake is primarily built around user(). Since your controller calls userFromToken(), mocking that method directly is clear, version-independent, and guarantees that the test cannot make an HTTP request to Google/Facebook.

You can add a second test where userFromToken() throws the provider exception to verify your error response as well.

Socialite documentation: https://laravel.com/docs/socialite