feat: FastAPI-App mit API-Key- und Session-Auth

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/tests/conftest.py

@@ -1,9 +1,10 @@
 import pytest
+from fastapi.testclient import TestClient
 from sqlalchemy import create_engine
 from sqlalchemy.orm import Session
 from sqlalchemy.pool import StaticPool
 
-from app.db import Base
+from app.db import Base, get_session
 
 
 @pytest.fixture
@@ -15,3 +16,19 @@ def db():
     Base.metadata.create_all(engine)
     with Session(engine) as session:
         yield session
+
+
+@pytest.fixture
+def client(db, monkeypatch):
+    monkeypatch.setenv("FB_API_KEY", "test-key")
+    from app.config import get_settings
+    get_settings.cache_clear()
+    from app.auth import hash_password
+    monkeypatch.setenv("FB_GUI_PASSWORD_HASH", hash_password("geheim"))
+    get_settings.cache_clear()
+    from app.main import app
+    app.dependency_overrides[get_session] = lambda: iter([db])
+    with TestClient(app) as c:
+        yield c
+    app.dependency_overrides.clear()
+    get_settings.cache_clear()

finance/tests/test_auth.py

@@ -0,0 +1,14 @@
+def test_api_requires_key(client):
+    assert client.get("/api/accounts").status_code == 401
+    r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
+    assert r.status_code == 200
+
+
+def test_login_flow(client):
+    r = client.post("/login", data={"username": "admin", "password": "falsch"},
+                    follow_redirects=False)
+    assert r.status_code == 401
+    r = client.post("/login", data={"username": "admin", "password": "geheim"},
+                    follow_redirects=False)
+    assert r.status_code == 303
+    assert client.get("/api/accounts").status_code == 200  # Cookie reicht