add auth

backend/tests/conftest.py

@@ -31,6 +31,10 @@ for name in (
     "TELEGRAM_BOT_TOKEN",
     "TELEGRAM_CHAT_ID",
     "SLACK_WEBHOOK_URL",
+    "AUTH_PASSWORD",
+    "TELEGRAM_OWNER_ID",
+    "TELEGRAM_BOT_USERNAME",
+    "API_TOKEN",
 ):
     os.environ.pop(name, None)
 

backend/tests/test_auth.py

@@ -0,0 +1,67 @@
+"""Login gate: closed only once a password or Telegram login is configured."""
+
+from __future__ import annotations
+
+from app.services import auth_service
+
+
+def test_open_by_default(client):
+    assert client.get("/api/settings").status_code == 200
+
+
+def test_password_hash_round_trips():
+    hashed = auth_service.hash_password("correct horse battery staple")
+    assert auth_service.verify_password("correct horse battery staple", hashed)
+    assert not auth_service.verify_password("wrong", hashed)
+
+
+def test_login_flow(client):
+    from app.db import SessionLocal
+    from app.services import settings_service
+
+    db = SessionLocal()
+    try:
+        settings = settings_service.load_settings(db)
+        settings.auth.password_hash = auth_service.hash_password("s3cret!!")
+        settings_service.save_settings(db, settings)
+    finally:
+        db.close()
+
+    # Locked out without a session.
+    assert client.get("/api/settings").status_code == 401
+    assert client.get("/api/auth/me").json()["login_required"] is True
+
+    bad = client.post("/api/auth/login", json={"username": "timka", "password": "nope"})
+    assert bad.status_code == 401
+
+    ok = client.post("/api/auth/login", json={"username": "timka", "password": "s3cret!!"})
+    assert ok.status_code == 200
+    assert "kadence_session" in client.cookies
+
+    assert client.get("/api/settings").status_code == 200
+    assert client.get("/api/auth/me").json()["authenticated"] is True
+
+    client.post("/api/auth/logout")
+    assert client.get("/api/settings").status_code == 401
+
+
+def test_api_token_still_works_once_login_is_configured(client, monkeypatch):
+    from app.config import env_settings
+    from app.db import SessionLocal
+    from app.services import settings_service
+
+    env_settings.cache_clear()
+    monkeypatch.setenv("API_TOKEN", "desktop-secret")
+    env_settings.cache_clear()
+
+    db = SessionLocal()
+    try:
+        settings = settings_service.load_settings(db)
+        settings.auth.password_hash = auth_service.hash_password("s3cret!!")
+        settings_service.save_settings(db, settings)
+    finally:
+        db.close()
+
+    assert client.get("/api/settings").status_code == 401
+    assert client.get("/api/settings", headers={"X-API-Token": "desktop-secret"}).status_code == 200
+    env_settings.cache_clear()