def test_api_requires_key(client):
    assert client.get("/api/accounts").status_code == 401
    r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
    assert r.status_code == 200


def test_login_flow(client):
    r = client.post("/login", data={"username": "admin", "password": "falsch"},
                    follow_redirects=False)
    assert r.status_code == 401
    r = client.post("/login", data={"username": "admin", "password": "geheim"},
                    follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 200  # Cookie reicht