Initial Claude implementation

tests/test_auth.py

@@ -0,0 +1,63 @@
+async def test_register_login_me_refresh_logout(client, seeded):
+    # Register
+    resp = await client.post(
+        "/api/auth/register",
+        json={"email": "alice@example.com", "password": "secret123", "full_name": "Alice"},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["email"] == "alice@example.com"
+
+    # Login (OAuth2 form: username == email)
+    resp = await client.post(
+        "/api/auth/login",
+        data={"username": "alice@example.com", "password": "secret123"},
+    )
+    assert resp.status_code == 200, resp.text
+    tokens = resp.json()
+    access, refresh = tokens["access_token"], tokens["refresh_token"]
+
+    # /me with bearer token
+    resp = await client.get("/api/users/me", headers={"Authorization": f"Bearer {access}"})
+    assert resp.status_code == 200
+    assert resp.json()["email"] == "alice@example.com"
+
+    # Refresh rotates tokens
+    resp = await client.post("/api/auth/refresh", json={"refresh_token": refresh})
+    assert resp.status_code == 200, resp.text
+    new_refresh = resp.json()["refresh_token"]
+    assert new_refresh != refresh
+
+    # Old refresh token is now revoked
+    resp = await client.post("/api/auth/refresh", json={"refresh_token": refresh})
+    assert resp.status_code == 401
+
+    # Logout (revokes all) then the rotated refresh token is dead too
+    relogin = await client.post(
+        "/api/auth/login",
+        data={"username": "alice@example.com", "password": "secret123"},
+    )
+    new_access = relogin.json()["access_token"]
+    resp = await client.post(
+        "/api/auth/logout",
+        json={},
+        headers={"Authorization": f"Bearer {new_access}"},
+    )
+    assert resp.status_code == 204
+    resp = await client.post("/api/auth/refresh", json={"refresh_token": new_refresh})
+    assert resp.status_code == 401
+
+
+async def test_login_wrong_password(client, seeded):
+    await client.post(
+        "/api/auth/register",
+        json={"email": "bob@example.com", "password": "secret123"},
+    )
+    resp = await client.post(
+        "/api/auth/login",
+        data={"username": "bob@example.com", "password": "wrong"},
+    )
+    assert resp.status_code == 401
+
+
+async def test_me_requires_auth(client):
+    assert (await client.get("/api/users/me")).status_code == 401