def test_api_requires_key(client):
    assert client.get("/api/accounts").status_code == 401
    r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
    assert r.status_code == 200


def test_login_flow(client):
    r = client.post("/login", data={"username": "admin", "password": "falsch"},
                    follow_redirects=False)
    assert r.status_code == 401
    r = client.post("/login", data={"username": "admin", "password": "geheim"},
                    follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 200  # Cookie reicht


def test_logout_flow(client):
    r = client.post("/login", data={"username": "admin", "password": "geheim"},
                    follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 200

    r = client.post("/logout", follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 401


def test_tampered_session_cookie_rejected(client):
    client.cookies.set("fb_session", "gui.invalid-signature")
    assert client.get("/api/accounts").status_code == 401