tests/test_auth.py

"""Test module for authentication functionality"""
from fastapi import status


def test_login_success(client, test_user):
    """Test successful login"""
    response = client.post(
        "/login",
        data=test_user,
        follow_redirects=False
    )
    assert response.status_code == status.HTTP_302_FOUND
    assert response.headers["location"] == "/compare"

    # Verify session is set
    response = client.get("/compare")
    assert response.status_code == status.HTTP_200_OK


def test_login_failure(client):
    """Test login with invalid credentials"""
    response = client.post(
        "/login",
        data={"username": "invalid", "password": "wrong"},
        follow_redirects=False
    )
    assert response.status_code == status.HTTP_401_UNAUTHORIZED
    assert "Invalid credentials" in response.text


def test_session_timeout(client, test_user):
    """Test session timeout behavior"""
    # First login
    client.post("/login", data=test_user)

    # Access protected route should succeed
    response = client.get("/compare")
    assert response.status_code == status.HTTP_200_OK

    # Clear session cookie to simulate timeout
    client.cookies.clear()

    # Access should redirect to login
    response = client.get("/compare", follow_redirects=False)
    assert response.status_code == status.HTTP_302_FOUND
    assert response.headers["location"] == "/login"


def test_session_timeout_page(client):
    """Test session timeout page content"""
    # When session times out, user is redirected to login
    response = client.get("/login")
    assert response.status_code == status.HTTP_200_OK
    assert "Login" in response.text


def test_logout(client, test_user):
    """Test logout functionality"""
    # First login
    client.post("/login", data=test_user)

    # Then logout
    response = client.get("/logout", follow_redirects=False)
    assert response.status_code == status.HTTP_302_FOUND
    assert response.headers["location"] == "/login"

    # Verify can't access protected route anymore
    response = client.get("/compare", follow_redirects=False)
    assert response.status_code == status.HTTP_302_FOUND
    assert response.headers["location"] == "/login"