feat: authentication — register, login, JWT, tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -0,0 +1,64 @@
+import asyncio
+import uuid
+
+import pytest
+import pytest_asyncio
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+from app.config import settings
+from app.database import get_db
+from app.main import app
+from app.models import Base
+from app.services.auth import create_access_token
+
+TEST_DB_URL = settings.database_url.replace("/meetproto", "/meetproto_test")
+
+engine_test = create_async_engine(TEST_DB_URL, echo=False)
+async_session_test = async_sessionmaker(engine_test, expire_on_commit=False)
+
+
+@pytest.fixture(scope="session")
+def event_loop():
+    loop = asyncio.new_event_loop()
+    yield loop
+    loop.close()
+
+
+@pytest_asyncio.fixture(autouse=True)
+async def setup_db():
+    async with engine_test.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    yield
+    async with engine_test.begin() as conn:
+        await conn.run_sync(Base.metadata.drop_all)
+
+
+async def override_get_db():
+    async with async_session_test() as session:
+        yield session
+
+
+app.dependency_overrides[get_db] = override_get_db
+
+
+@pytest_asyncio.fixture
+async def client():
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as c:
+        yield c
+
+
+@pytest_asyncio.fixture
+async def auth_client(client: AsyncClient):
+    resp = await client.post("/api/auth/register", json={
+        "username": f"testuser_{uuid.uuid4().hex[:8]}",
+        "email": f"test_{uuid.uuid4().hex[:8]}@example.com",
+        "password": "testpass123",
+    })
+    token = (await client.post("/api/auth/login", json={
+        "username": resp.json()["username"],
+        "password": "testpass123",
+    })).json()["access_token"]
+    client.headers["Authorization"] = f"Bearer {token}"
+    yield client

backend/tests/test_auth.py

@@ -0,0 +1,66 @@
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_register_success(client: AsyncClient):
+    resp = await client.post("/api/auth/register", json={
+        "username": "newuser",
+        "email": "new@example.com",
+        "password": "pass123",
+    })
+    assert resp.status_code == 201
+    data = resp.json()
+    assert data["username"] == "newuser"
+    assert data["role"] == "user"
+    assert "password" not in data
+
+
+@pytest.mark.asyncio
+async def test_register_duplicate(client: AsyncClient):
+    payload = {"username": "dupuser", "email": "dup@example.com", "password": "pass123"}
+    await client.post("/api/auth/register", json=payload)
+    resp = await client.post("/api/auth/register", json=payload)
+    assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_login_success(client: AsyncClient):
+    await client.post("/api/auth/register", json={
+        "username": "loginuser",
+        "email": "login@example.com",
+        "password": "pass123",
+    })
+    resp = await client.post("/api/auth/login", json={
+        "username": "loginuser",
+        "password": "pass123",
+    })
+    assert resp.status_code == 200
+    assert "access_token" in resp.json()
+
+
+@pytest.mark.asyncio
+async def test_login_wrong_password(client: AsyncClient):
+    await client.post("/api/auth/register", json={
+        "username": "wrongpw",
+        "email": "wrongpw@example.com",
+        "password": "pass123",
+    })
+    resp = await client.post("/api/auth/login", json={
+        "username": "wrongpw",
+        "password": "wrong",
+    })
+    assert resp.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_me_authenticated(auth_client: AsyncClient):
+    resp = await auth_client.get("/api/auth/me")
+    assert resp.status_code == 200
+    assert "username" in resp.json()
+
+
+@pytest.mark.asyncio
+async def test_me_unauthenticated(client: AsyncClient):
+    resp = await client.get("/api/auth/me")
+    assert resp.status_code == 403