feat: authentication — register, login, JWT, tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_auth.py

@@ -0,0 +1,66 @@
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_register_success(client: AsyncClient):
+    resp = await client.post("/api/auth/register", json={
+        "username": "newuser",
+        "email": "new@example.com",
+        "password": "pass123",
+    })
+    assert resp.status_code == 201
+    data = resp.json()
+    assert data["username"] == "newuser"
+    assert data["role"] == "user"
+    assert "password" not in data
+
+
+@pytest.mark.asyncio
+async def test_register_duplicate(client: AsyncClient):
+    payload = {"username": "dupuser", "email": "dup@example.com", "password": "pass123"}
+    await client.post("/api/auth/register", json=payload)
+    resp = await client.post("/api/auth/register", json=payload)
+    assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_login_success(client: AsyncClient):
+    await client.post("/api/auth/register", json={
+        "username": "loginuser",
+        "email": "login@example.com",
+        "password": "pass123",
+    })
+    resp = await client.post("/api/auth/login", json={
+        "username": "loginuser",
+        "password": "pass123",
+    })
+    assert resp.status_code == 200
+    assert "access_token" in resp.json()
+
+
+@pytest.mark.asyncio
+async def test_login_wrong_password(client: AsyncClient):
+    await client.post("/api/auth/register", json={
+        "username": "wrongpw",
+        "email": "wrongpw@example.com",
+        "password": "pass123",
+    })
+    resp = await client.post("/api/auth/login", json={
+        "username": "wrongpw",
+        "password": "wrong",
+    })
+    assert resp.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_me_authenticated(auth_client: AsyncClient):
+    resp = await auth_client.get("/api/auth/me")
+    assert resp.status_code == 200
+    assert "username" in resp.json()
+
+
+@pytest.mark.asyncio
+async def test_me_unauthenticated(client: AsyncClient):
+    resp = await client.get("/api/auth/me")
+    assert resp.status_code == 403