- Replace password-based token creation with direct DB inserts in CLI helpers
- Use INSERT OR IGNORE for concurrent test thread safety on shared user
- Update server test helpers with passkey/registration_token repos and WebAuthn state
- Remove password-based auth tests, keep bearer token validation tests
- Set BREWLOG_RP_ID, RP_ORIGIN, OPENROUTER_API_KEY, FOURSQUARE_API_KEY in test env
- Use localhost instead of 127.0.0.1 for WebAuthn RP ID compatibility
- Add test_revoked_token_cannot_be_used to CLI tests
- Add test_session_authentication_via_login to verify session cookies work
- Add test_invalid_session_cookie_fails to verify unauthenticated requests fail
- Add test_logout_invalidates_session to verify logout clears sessions
- Add test_fake_session_cookie_fails to verify forged cookies don't work
- Enable cookies feature for reqwest in dev-dependencies
All 70 tests pass (8 unit + 46 server + 16 CLI) ✅
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
- Update all server tests to use spawn_app_with_auth() helper
- spawn_app_with_auth() creates admin user and test token automatically
- Add helper methods (post/put/delete/get) to TestApp for authenticated requests
- Update create_roaster_with_payload to include auth token when available
- Add bearer_auth() to all write operation test requests
- Fix auth_api test to expect 2 tokens (test helper + test-created)
- All 42 server tests now pass
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
