Refactor backend: Split models and proxmox_client into modules, add alembic

backend/tests/test_api_auth.py

@@ -0,0 +1,111 @@
+import pytest
+from app.models import User, ActiveSession
+from app.auth import verify_password
+
+@pytest.mark.integration
+class TestAPIAuthentication:
+    def test_login_success(self, client, seed_users):
+        response = client.post(
+            "/api/auth/login",
+            json={"username": "testuser", "password": "UserPass123!"}
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert "access_token" in data
+        assert data["token_type"] == "bearer"
+
+    def test_login_wrong_password(self, client, seed_users):
+        response = client.post(
+            "/api/auth/login",
+            json={"username": "testuser", "password": "wrongpassword"}
+        )
+        assert response.status_code == 401
+        assert "Incorrect username or password" in response.json()["detail"]
+
+    def test_login_user_not_found(self, client, seed_users):
+        response = client.post(
+            "/api/auth/login",
+            json={"username": "nonexistent", "password": "somepassword"}
+        )
+        assert response.status_code == 401
+
+    def test_get_me(self, client, user_headers):
+        response = client.get("/api/auth/me", headers=user_headers)
+        assert response.status_code == 200
+        data = response.json()
+        assert data["username"] == "testuser"
+        assert data["email"] == "testuser@example.com"
+        assert data["is_admin"] is False
+        assert "permissions" in data
+
+    def test_logout(self, client, user_headers, db_session):
+        # Verify authenticated endpoint works before logout
+        me_resp = client.get("/api/auth/me", headers=user_headers)
+        assert me_resp.status_code == 200
+        
+        # Logout
+        logout_resp = client.post("/api/auth/logout", headers=user_headers)
+        assert logout_resp.status_code == 200
+        assert logout_resp.json()["message"] == "Successfully logged out"
+        
+        # Verify request is rejected after logout because session is terminated
+        me_resp2 = client.get("/api/auth/me", headers=user_headers)
+        assert me_resp2.status_code == 401
+
+    def test_change_password(self, client, user_headers, db_session, seed_users):
+        response = client.post(
+            "/api/auth/change-password",
+            headers=user_headers,
+            data={"old_password": "UserPass123!", "new_password": "NewSecurePass123!"}
+        )
+        assert response.status_code == 200
+        assert response.json()["message"] == "Password changed successfully"
+        
+        db_session.refresh(seed_users["user"])
+        assert verify_password("NewSecurePass123!", seed_users["user"].hashed_password)
+
+    def test_register_user_by_admin(self, client, admin_headers, db_session):
+        response = client.post(
+            "/api/auth/register",
+            headers=admin_headers,
+            json={
+                "username": "newuser",
+                "email": "newuser@example.com",
+                "full_name": "New User",
+                "password": "NewUserPassword123!"
+            }
+        )
+        assert response.status_code == 201
+        data = response.json()
+        assert data["username"] == "newuser"
+        assert data["email"] == "newuser@example.com"
+        
+        user = db_session.query(User).filter(User.username == "newuser").first()
+        assert user is not None
+
+    def test_register_user_denied_for_standard_user(self, client, user_headers):
+        response = client.post(
+            "/api/auth/register",
+            headers=user_headers,
+            json={
+                "username": "anotheruser",
+                "email": "another@example.com",
+                "full_name": "Another User",
+                "password": "AnotherPassword123!"
+            }
+        )
+        assert response.status_code == 403
+
+    def test_list_users_by_admin(self, client, admin_headers):
+        response = client.get("/api/users", headers=admin_headers)
+        assert response.status_code == 200
+        data = response.json()
+        assert len(data) >= 2
+
+    def test_delete_user_by_admin(self, client, admin_headers, db_session, seed_users):
+        target_user = seed_users["user"]
+        response = client.delete(f"/api/users/{target_user.id}", headers=admin_headers)
+        assert response.status_code == 204
+        
+        deleted_user = db_session.query(User).filter(User.id == target_user.id).first()
+        assert deleted_user is None