feat: Admin-Seite mit Passwortaenderung und Regel-Neuanwendung

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/tests/test_auth.py

@@ -28,3 +28,35 @@ def test_logout_flow(client):
 def test_tampered_session_cookie_rejected(client):
     client.cookies.set("fb_session", "gui.invalid-signature")
     assert client.get("/api/accounts").status_code == 401
+
+
+def test_current_password_hash_falls_back_to_env_when_no_env_file(client, monkeypatch):
+    # `client`-Fixture setzt FB_GUI_PASSWORD_HASH direkt und keine FB_ENV_FILE,
+    # der Default-Pfad /data/.env existiert im Testlauf nicht -> Fallback.
+    from app.auth import current_password_hash
+    from app.config import get_settings
+    assert current_password_hash() == get_settings().gui_password_hash
+
+
+def test_current_password_hash_reads_from_env_file_when_present(
+    client_with_env_file,
+):
+    from app.auth import current_password_hash, verify_password
+    _client, password = client_with_env_file
+    assert verify_password(password, current_password_hash())
+
+
+def test_current_password_hash_cache_invalidates_on_file_change(
+    client_with_env_file, env_file,
+):
+    from app.auth import current_password_hash, hash_password, verify_password
+    path, password = env_file
+    first = current_password_hash()
+    assert verify_password(password, first)
+
+    new_hash = hash_password("andereswort999")
+    path.write_text(f"FB_PASSWORD='andereswort999'\nFB_GUI_PASSWORD_HASH='{new_hash}'\n")
+
+    second = current_password_hash()
+    assert second == new_hash
+    assert verify_password("andereswort999", second)