first commit

backend/tests/test_auth.py

@@ -0,0 +1,95 @@
+import uuid
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+client = TestClient(app)
+
+
+def _unique_email() -> str:
+    return f"test-{uuid.uuid4().hex}@example.com"
+
+
+def _register(email: str | None = None, password: str = "securepass1") -> tuple[str, dict]:
+    address = email or _unique_email()
+    response = client.post(
+        "/api/auth/register",
+        json={"email": address, "password": password, "full_name": "Test User"},
+    )
+    return address, response
+
+
+def test_register_login_and_me() -> None:
+    email, register_response = _register()
+    assert register_response.status_code == 201
+    token = register_response.json()["access_token"]
+    assert token
+
+    login_response = client.post("/api/auth/login", json={"email": email, "password": "securepass1"})
+    assert login_response.status_code == 200
+    assert login_response.json()["token_type"] == "bearer"
+
+    me_response = client.get("/api/auth/me", headers={"Authorization": f"Bearer {token}"})
+    assert me_response.status_code == 200
+    body = me_response.json()
+    assert body["email"] == email
+    assert body["full_name"] == "Test User"
+    assert body["is_active"] is True
+    assert "hashed_password" not in body
+
+
+def test_register_duplicate_email() -> None:
+    email, first = _register()
+    assert first.status_code == 201
+    second = client.post(
+        "/api/auth/register",
+        json={"email": email, "password": "securepass1"},
+    )
+    assert second.status_code == 409
+
+
+def test_register_password_too_short() -> None:
+    response = client.post(
+        "/api/auth/register",
+        json={"email": _unique_email(), "password": "short"},
+    )
+    assert response.status_code == 422
+
+
+def test_login_invalid_credentials() -> None:
+    email, register_response = _register()
+    assert register_response.status_code == 201
+
+    wrong_password = client.post("/api/auth/login", json={"email": email, "password": "wrongpassword"})
+    assert wrong_password.status_code == 401
+
+    unknown = client.post("/api/auth/login", json={"email": "nobody@example.com", "password": "securepass1"})
+    assert unknown.status_code == 401
+
+
+def test_me_requires_auth() -> None:
+    response = client.get("/api/auth/me")
+    assert response.status_code == 401
+
+
+def test_me_rejects_invalid_token() -> None:
+    response = client.get("/api/auth/me", headers={"Authorization": "Bearer not-a-valid-jwt"})
+    assert response.status_code == 401
+
+
+def test_passwords_are_hashed_in_database() -> None:
+    from app.db.session import SessionLocal
+    from app.services.users import get_user_by_email
+
+    email, register_response = _register(password="anotherpass9")
+    assert register_response.status_code == 201
+
+    db = SessionLocal()
+    try:
+        user = get_user_by_email(db, email)
+        assert user is not None
+        assert user.hashed_password != "anotherpass9"
+        assert user.hashed_password.startswith("$2")
+    finally:
+        db.close()