- Add test_revoked_token_cannot_be_used to CLI tests
- Add test_session_authentication_via_login to verify session cookies work
- Add test_invalid_session_cookie_fails to verify unauthenticated requests fail
- Add test_logout_invalidates_session to verify logout clears sessions
- Add test_fake_session_cookie_fails to verify forged cookies don't work
- Enable cookies feature for reqwest in dev-dependencies
All 70 tests pass (8 unit + 46 server + 16 CLI) ✅
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
- Add sessions table to store session tokens with expiration
- Create Session domain model and SessionRepository trait
- Implement SqlSessionRepository for session persistence
- Update is_authenticated() to validate tokens against database
- Sessions expire after 30 days
- Session tokens hashed with SHA-256 before storage
- Delete sessions from database on logout
- Update all page handlers to properly validate sessions
This prevents session hijacking by ensuring only valid, unexpired
tokens stored in the database can authenticate requests.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
- Remove unused post/put/delete/get helper methods from TestApp
- Create shared test server instance for all CLI tests using once_cell
- Use API directly to create tokens for testing (avoids interactive CLI issues)
- Simplify CLI test structure with server_info() and create_token() helpers
- Update all CLI tests to use shared server infrastructure
- Server tests (42 tests) still pass ✅
Note: CLI tests have stdin handling issues with interactive create-token command.
Using API directly for token creation in tests as workaround.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
- Update all server tests to use spawn_app_with_auth() helper
- spawn_app_with_auth() creates admin user and test token automatically
- Add helper methods (post/put/delete/get) to TestApp for authenticated requests
- Update create_roaster_with_payload to include auth token when available
- Add bearer_auth() to all write operation test requests
- Fix auth_api test to expect 2 tokens (test helper + test-created)
- All 42 server tests now pass
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
Rename roasters.rs to roasters_api.rs and roasts.rs to roasts_api.rs
to make it clear these files only test the /api/v1 endpoints, not the
page endpoints.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
Remove pagination and sorting tests from roasters and roasts test
files as these will be addressed in a future pull request.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
Move tests/server.rs to tests/server/main.rs and update module
paths to make the server tests more self-contained. All test
imports now use crate::helpers instead of crate::server::helpers.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
Tokio is already included in the main dependencies, no need to
duplicate it in dev-dependencies.
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
- Extract roaster creation into reusable helper functions
- Add create_test_roaster_with_name for flexible roaster creation
- Replace generic 'Test' values with more descriptive test data
- Reduce code duplication in roast tests
Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
