feat(tests): add authentication and proxy tests with fixtures

tests/api/test_auth.py

@@ -0,0 +1,112 @@
+import importlib
+from datetime import UTC, datetime, timedelta
+
+from core.security import AuthContext, get_auth_context
+from models.auth import AccessTokenPayload, AuthUserDocument
+
+auth_router_module = importlib.import_module("api.auth.router")
+
+
+def test_login_success_returns_bearer_token(client, monkeypatch: object):
+    user = AuthUserDocument(username="admin", password_hash="stored-hash")
+
+    async def fake_get_user_by_username(username: str) -> AuthUserDocument | None:
+        assert username == "admin"
+        return user
+
+    def fake_verify_password(plain_password: str, password_hash: str) -> bool:
+        return plain_password == "secret" and password_hash == "stored-hash"
+
+    def fake_create_access_token(*, subject: str) -> str:
+        assert subject == "admin"
+        return "token-123"
+
+    monkeypatch.setattr(
+        auth_router_module,
+        "get_user_by_username",
+        fake_get_user_by_username,
+    )
+    monkeypatch.setattr(auth_router_module, "verify_password", fake_verify_password)
+    monkeypatch.setattr(
+        auth_router_module,
+        "create_access_token",
+        fake_create_access_token,
+    )
+
+    response = client.post(
+        "/auth/login",
+        json={"username": "admin", "password": "secret"},
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"access_token": "token-123", "token_type": "bearer"}
+
+
+def test_login_invalid_credentials_returns_401(client, monkeypatch: object):
+    async def fake_get_user_by_username(_: str) -> None:
+        return None
+
+    monkeypatch.setattr(
+        auth_router_module,
+        "get_user_by_username",
+        fake_get_user_by_username,
+    )
+
+    response = client.post(
+        "/auth/login",
+        json={"username": "admin", "password": "wrong"},
+    )
+
+    assert response.status_code == 401
+    assert response.json()["detail"] == "Invalid username or password"
+    assert response.headers["www-authenticate"] == "Bearer"
+
+
+def test_logout_revokes_active_token(client, monkeypatch: object):
+    captured: dict[str, object] = {}
+
+    async def fake_revoke_token(*, jti: str, expires_at: datetime) -> None:
+        captured["jti"] = jti
+        captured["expires_at"] = expires_at
+
+    monkeypatch.setattr(auth_router_module, "revoke_token", fake_revoke_token)
+
+    response = client.post("/auth/logout")
+
+    assert response.status_code == 204
+    assert captured["jti"] == "test-jti"
+    assert isinstance(captured["expires_at"], datetime)
+
+
+def test_logout_skips_revocation_when_token_is_expired(
+    client,
+    fake_user: AuthUserDocument,
+    monkeypatch: object,
+):
+    state = {"called": False}
+
+    async def fake_revoke_token(*, jti: str, expires_at: datetime) -> None:
+        state["called"] = True
+
+    monkeypatch.setattr(auth_router_module, "revoke_token", fake_revoke_token)
+
+    expired_payload = AccessTokenPayload(
+        sub=fake_user.username,
+        jti="expired-jti",
+        exp=int((datetime.now(UTC) - timedelta(minutes=1)).timestamp()),
+    )
+    expired_context = AuthContext(
+        token="expired-token",
+        user=fake_user,
+        payload=expired_payload,
+    )
+
+    async def override_auth_context() -> AuthContext:
+        return expired_context
+
+    client.app.dependency_overrides[get_auth_context] = override_auth_context
+
+    response = client.post("/auth/logout")
+
+    assert response.status_code == 204
+    assert state["called"] is False