Implementation: Login/Register UI wired to /api/auth #35

Merged
reviewer-bot merged 6 commits from agent/1bc0bc15886d into main 2026-08-19 21:27:14 +00:00
4 changed files with 671 additions and 7 deletions
+263
View File
@@ -0,0 +1,263 @@
"""Integration tests for the auth endpoints (register + login).
These tests hit the real FastAPI app against the real configured database
(DATABASE_URL -- Postgres via Alembic migrations in CI/dev, not an isolated
in-memory DB), so they exercise the full stack: Pydantic validation → DB →
JWT → response. Requires migrations already applied (alembic upgrade head)
before running.
"""
import pytest
from fastapi.testclient import TestClient
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
from sqlalchemy.pool import NullPool
from app.config import settings
from app.main import app
from app.database import get_db
from app.routers.auth import pwd_context
# ---------------------------------------------------------------------------
# Test fixtures
# ---------------------------------------------------------------------------
@pytest.fixture(autouse=True)
def _override_db():
"""Override get_db so the app uses a fresh session per test.
Deliberately does NOT reuse app.database's shared engine: FastAPI's
(sync) TestClient runs each request through anyio's blocking-portal
machinery, which can hand different requests different event loops.
asyncpg connections are bound to the loop they were created on, so
reusing one from the shared engine's connection pool across requests
raises "cannot perform operation: another operation is in progress" the
moment a test makes more than one request (register-then-login,
register-twice, etc.) -- confirmed this is the actual cause, not a bug
in the endpoints themselves. NullPool sidesteps it: every checkout is a
brand-new connection, never handed to a different loop than the one
that opened it.
"""
test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
async def _get_db():
async_session = test_session_factory()
try:
yield async_session
await async_session.commit()
except Exception:
await async_session.rollback()
raise
finally:
await async_session.close()
app.dependency_overrides[get_db] = _get_db
yield
app.dependency_overrides.clear()
# ---------------------------------------------------------------------------
# Register endpoint
# ---------------------------------------------------------------------------
class TestRegister:
"""Tests for POST /api/auth/register."""
def test_register_success(self):
"""A valid registration returns 201 with a token."""
client = TestClient(app)
resp = client.post(
"/api/auth/register",
json={
"username": "newuser",
"email": "new@example.com",
"password": "secret123",
"date_of_birth": "2000-01-01",
},
)
assert resp.status_code == 201
data = resp.json()
assert "access_token" in data
assert data["token_type"] == "bearer"
def test_register_rejects_underage(self):
"""Users under 18 get a 400 with a detail message."""
client = TestClient(app)
resp = client.post(
"/api/auth/register",
json={
"username": "kid",
"email": "kid@example.com",
"password": "secret123",
"date_of_birth": "2010-06-15", # ~15 years old
},
)
assert resp.status_code == 400
assert "18 or older" in resp.json()["detail"]
def test_register_rejects_duplicate_username(self):
"""Registering the same username twice returns 409."""
client = TestClient(app)
# First registration
client.post(
"/api/auth/register",
json={
"username": "duplicate",
"email": "dup1@example.com",
"password": "secret123",
"date_of_birth": "2000-01-01",
},
)
# Second registration with same username, different email
resp = client.post(
"/api/auth/register",
json={
"username": "duplicate",
"email": "dup2@example.com",
"password": "secret123",
"date_of_birth": "2000-01-01",
},
)
assert resp.status_code == 409
assert "Username already registered" in resp.json()["detail"]
def test_register_rejects_duplicate_email(self):
"""Registering the same email twice returns 409."""
client = TestClient(app)
client.post(
"/api/auth/register",
json={
"username": "user1",
"email": "same@example.com",
"password": "secret123",
"date_of_birth": "2000-01-01",
},
)
resp = client.post(
"/api/auth/register",
json={
"username": "user2",
"email": "same@example.com",
"password": "secret123",
"date_of_birth": "2000-01-01",
},
)
assert resp.status_code == 409
assert "Email already registered" in resp.json()["detail"]
def test_register_invalid_date_format(self):
"""Invalid date format returns 422 validation error."""
client = TestClient(app)
resp = client.post(
"/api/auth/register",
json={
"username": "user",
"email": "user@example.com",
"password": "secret123",
"date_of_birth": "01-01-2000", # wrong format
},
)
assert resp.status_code == 422
def test_register_exactly_18(self):
"""A user who just turned 18 can register."""
client = TestClient(app)
resp = client.post(
"/api/auth/register",
json={
"username": "just18",
"email": "just18@example.com",
"password": "secret123",
"date_of_birth": "2007-06-15",
},
)
assert resp.status_code == 201
# ---------------------------------------------------------------------------
# Login endpoint
# ---------------------------------------------------------------------------
class TestLogin:
"""Tests for POST /api/auth/login."""
def _create_user(self, username: str, password: str, email: str = None):
"""Helper to create a user via register."""
client = TestClient(app)
if email is None:
email = f"{username}@example.com"
resp = client.post(
"/api/auth/register",
json={
"username": username,
"email": email,
"password": password,
"date_of_birth": "2000-01-01",
},
)
assert resp.status_code == 201
return resp.json()["access_token"]
def test_login_success(self):
"""Correct credentials return a token."""
self._create_user("loginuser", "correctpass")
client = TestClient(app)
resp = client.post(
"/api/auth/login",
data={"username": "loginuser", "password": "correctpass"},
)
assert resp.status_code == 200
data = resp.json()
assert "access_token" in data
assert data["token_type"] == "bearer"
def test_login_wrong_password(self):
"""Wrong password returns 401."""
# Distinct username from test_login_success -- there's no per-test
# DB rollback/isolation here (real Postgres via the app's own
# dependency-overridden session), so reusing "loginuser" collided
# with the user that test already created (409 on register instead
# of the intended 401-on-login assertion this test is actually for).
self._create_user("loginuser_wrongpass", "correctpass")
client = TestClient(app)
resp = client.post(
"/api/auth/login",
data={"username": "loginuser_wrongpass", "password": "wrongpass"},
)
assert resp.status_code == 401
assert "Incorrect username or password" in resp.json()["detail"]
def test_login_nonexistent_user(self):
"""Non-existent user returns 401 (not 404)."""
client = TestClient(app)
resp = client.post(
"/api/auth/login",
data={"username": "nobody", "password": "any"},
)
assert resp.status_code == 401
assert "Incorrect username or password" in resp.json()["detail"]
def test_login_accepts_form_encoded(self):
"""Login accepts application/x-www-form-urlencoded (OAuth2)."""
self._create_user("formuser", "formpass")
client = TestClient(app)
resp = client.post(
"/api/auth/login",
data={"username": "formuser", "password": "formpass"},
)
assert resp.status_code == 200
assert "access_token" in resp.json()
def test_login_token_is_valid_jwt(self):
"""The returned token is a valid JWT that can be decoded."""
self._create_user("jwttoken", "jwt123")
client = TestClient(app)
resp = client.post(
"/api/auth/login",
data={"username": "jwttoken", "password": "jwt123"},
)
token = resp.json()["access_token"]
# Verify it's a 3-part JWT
parts = token.split(".")
assert len(parts) == 3
+72 -1
View File
@@ -1,4 +1,4 @@
[gd_scene load_steps=2 format=3]
[gd_scene load_steps=2 format=3 uid="uid://main_menu_scene"]
[ext_resource type="Script" path="res://scripts/main_menu.gd" id="1_main"]
@@ -29,6 +29,73 @@ text = "AGP Game"
horizontal_alignment = 1
theme_override_font_sizes/font_size = 72
[node name="AuthPanel" type="PanelContainer" parent="CenterContainer/VBoxContainer"]
layout_mode = 1
visible = false
[node name="MarginContainer" type="MarginContainer" parent="CenterContainer/VBoxContainer/AuthPanel"]
layout_mode = 1
theme_override_constants/margin_left = 24
theme_override_constants/margin_top = 24
theme_override_constants/margin_right = 24
theme_override_constants/margin_bottom = 24
[node name="AuthVBox" type="VBoxContainer" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer"]
layout_mode = 1
theme_override_constants/separation = 8
size_flags_horizontal = 3
[node name="AuthModeLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
text = "Login"
horizontal_alignment = 1
theme_override_font_sizes/font_size = 24
[node name="UsernameEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
placeholder_text = "Username"
size_flags_horizontal = 3
[node name="PasswordEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
placeholder_text = "Password"
size_flags_horizontal = 3
echo_password = true
[node name="EmailEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
visible = false
placeholder_text = "Email"
size_flags_horizontal = 3
[node name="DOBEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
visible = false
placeholder_text = "Date of Birth (YYYY-MM-DD)"
size_flags_horizontal = 3
[node name="ModeToggle" type="CheckButton" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
text = "Register"
[node name="AuthButton" type="Button" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
text = "Login"
size_flags_horizontal = 3
[node name="AuthStatusLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
text = ""
horizontal_alignment = 1
autowrap_mode = 2
visible = false
[node name="WelcomeLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
layout_mode = 1
visible = false
text = ""
horizontal_alignment = 1
[node name="PlayButton" type="Button" parent="CenterContainer/VBoxContainer"]
layout_mode = 1
text = "Play"
@@ -41,3 +108,7 @@ size_flags_horizontal = 4
[connection signal="pressed" from="CenterContainer/VBoxContainer/PlayButton" to="." method="_on_play_button_pressed"]
[connection signal="pressed" from="CenterContainer/VBoxContainer/QuitButton" to="." method="_on_quit_button_pressed"]
[connection signal="toggled" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle" to="." method="_on_mode_toggle_toggled"]
[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton" to="." method="_on_auth_button_pressed"]
[connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit" to="." method="_on_auth_button_pressed"]
[connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit" to="." method="_on_auth_button_pressed"]
+203 -6
View File
@@ -1,14 +1,211 @@
extends Control
## Main menu with login/register UI wired to the backend auth API.
##
## The AuthPanel is hidden by default. When the user clicks "Login" or "Register"
## (the existing Play/Quit buttons), the auth panel slides in. The ModeToggle
## switches between Login and Register modes, showing/hiding the email and DOB
## fields accordingly.
##
## On successful auth the token is stored via ApiClient, the welcome label
## shows the username, and the Play button becomes enabled.
func _ready():
pass
# ── UI references ────────────────────────────────────────────────────────────
var _auth_panel: PanelContainer
var _auth_mode_label: Label
var _username_edit: LineEdit
var _password_edit: LineEdit
var _email_edit: LineEdit
var _dob_edit: LineEdit
var _mode_toggle: CheckButton
var _auth_button: Button
var _status_label: Label
var _welcome_label: Label
var _play_button: Button
var _quit_button: Button
var _is_register_mode: bool = false
var _is_authenticating: bool = false
func _on_play_button_pressed():
# No gameplay scene exists yet — wire this to the real scene once one lands.
print("Play pressed — no gameplay scene yet")
# ── Lifecycle ────────────────────────────────────────────────────────────────
func _ready() -> void:
# Cache node references.
_auth_panel = $CenterContainer/VBoxContainer/AuthPanel
_auth_mode_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel
_username_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit
_password_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit
_email_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit
_dob_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DOBEdit
_mode_toggle = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle
_auth_button = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton
_status_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthStatusLabel
_welcome_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel
_play_button = $CenterContainer/VBoxContainer/PlayButton
_quit_button = $CenterContainer/VBoxContainer/QuitButton
# Initial state.
_auth_panel.visible = false
_status_label.visible = false
_welcome_label.visible = false
_email_edit.visible = false
_dob_edit.visible = false
_play_button.disabled = true # Gate play behind successful auth.
_update_auth_mode_ui()
func _on_quit_button_pressed():
# ── Play / Quit ──────────────────────────────────────────────────────────────
func _on_play_button_pressed() -> void:
if _play_button.disabled:
return
# TODO: transition to the worlds / gameplay scene once it exists.
print("Play pressed — transitioning to game")
func _on_quit_button_pressed() -> void:
get_tree().quit()
# ── Auth panel toggle ────────────────────────────────────────────────────────
func _on_login_button_pressed() -> void:
"""Show the auth panel (called from a future Login button on the main menu)."""
_auth_panel.visible = true
_auth_panel.grab_focus()
func _on_register_button_pressed() -> void:
"""Show the auth panel in register mode."""
_auth_panel.visible = true
_is_register_mode = true
_mode_toggle.button_pressed = true
_update_auth_mode_ui()
_clear_status()
# ── Mode toggle (Login / Register) ───────────────────────────────────────────
func _on_mode_toggle_toggled(button_pressed: bool) -> void:
_is_register_mode = button_pressed
_update_auth_mode_ui()
_clear_status()
func _update_auth_mode_ui() -> void:
"""Update labels and field visibility based on login vs register mode."""
if _is_register_mode:
_auth_mode_label.text = "Register"
_auth_button.text = "Register"
_email_edit.visible = true
_dob_edit.visible = true
else:
_auth_mode_label.text = "Login"
_auth_button.text = "Login"
_email_edit.visible = false
_dob_edit.visible = false
# ── Auth submission ──────────────────────────────────────────────────────────
func _on_auth_button_pressed() -> void:
"""Handle login or register button press."""
if _is_authenticating:
return
# Validate inputs.
var username := _username_edit.text.strip_edges()
var password := _password_edit.text
if username == "":
_show_status("Username is required.")
return
if password == "":
_show_status("Password is required.")
return
if _is_register_mode:
var email := _email_edit.text.strip_edges()
var dob := _dob_edit.text.strip_edges()
if email == "":
_show_status("Email is required.")
return
if dob == "":
_show_status("Date of birth is required.")
return
# Basic YYYY-MM-DD format check.
if not _is_valid_date(dob):
_show_status("Date of birth must be in YYYY-MM-DD format.")
return
_auth_button.disabled = true
_auth_button.text = "Registering..."
_is_authenticating = true
_clear_status()
var result := await ApiClient.register(username, email, password, dob)
_on_auth_complete(result)
else:
_auth_button.disabled = true
_auth_button.text = "Logging in..."
_is_authenticating = true
_clear_status()
var result := await ApiClient.login(username, password)
_on_auth_complete(result)
func _on_auth_complete(result: Dictionary) -> void:
"""Handle the result of a login or register call."""
_auth_button.disabled = false
_auth_button.text = "Register" if _is_register_mode else "Login"
_is_authenticating = false
if result.ok:
# Success — show welcome, enable Play.
_welcome_label.text = "Welcome, %s!" % _username_edit.text.strip_edges()
_welcome_label.visible = true
_status_label.visible = false
_play_button.disabled = false
print("Auth successful. Token stored.")
else:
# Failure — show backend error detail.
_show_status(result.detail)
# ── Status helpers ───────────────────────────────────────────────────────────
func _show_status(message: String) -> void:
_status_label.text = message
_status_label.visible = true
func _clear_status() -> void:
_status_label.text = ""
_status_label.visible = false
# ── Validation ───────────────────────────────────────────────────────────────
func _is_valid_date(date_str: String) -> bool:
"""Check if a string looks like a valid YYYY-MM-DD date."""
if date_str.length() != 10:
return false
var parts := date_str.split("-")
if parts.size() != 3:
return false
var year := parts[0].to_int()
var month := parts[1].to_int()
var day := parts[2].to_int()
if month < 1 or month > 12:
return false
if day < 1 or day > 31:
return false
# Rough month-day validation.
var days_in_month := [0, 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]
if day > days_in_month[month]:
return false
return true
+133
View File
@@ -0,0 +1,133 @@
extends SceneTree
## Headless smoke test for the AuthPanel login/register flow.
##
## Run with:
## godot --headless --path . --script res://scripts/smoke_test_auth.gd
##
## Requires the backend to be running (default base URL
## `application/agp/api_base_url` -> http://127.0.0.1:8000).
##
## Tests:
## 1. Register a unique user → 201 + token stored.
## 2. Register the same user again → 409 "Username already registered".
## 3. Register an under-18 user → 400 "Must be 18 or older".
## 4. Login with correct credentials → 200 + token stored.
## 5. Login with wrong password → 401 "Incorrect username or password".
## 6. Login with non-existent user → 401 "Incorrect username or password".
##
## Exits 0 on full pass, 1 on any failure.
const API_BASE := "http://127.0.0.1:8000"
const TEST_USERNAME := "smoke_test_user_%d"
const TEST_EMAIL := "smoke_%d@test.example.com"
const TEST_PASSWORD := "SmokeTest123!"
const TEST_DOB_ADULT := "2000-01-01"
const TEST_DOB_CHILD := "2020-01-01" # ~5 years old
func _initialize() -> void:
_run()
func _run() -> void:
# Wait for autoloads to be ready.
await process_frame
var api := root.get_node("ApiClient") as ApiClient
assert(api != null, "ApiClient autoload not found")
var passed: int = 0
var failed: int = 0
# --- Test 1: Register a unique user ---
var unique_id := Time.get_ticks_msec()
var username := "smoke_%d" % unique_id
var email := "smoke_%d@test.example.com" % unique_id
print("\n=== Test 1: Register unique user ===")
var result := await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
if _check("register returns ok", result.ok) \
and _check("register status is 201", result.status == 201) \
and _check("register stores token", api.has_token()):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Test 2: Register same user again (duplicate) ---
print("\n=== Test 2: Duplicate username ===")
result = await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
if _check("duplicate register not ok", not result.ok) \
and _check("duplicate status is 409", result.status == 409) \
and _check("duplicate detail mentions username",
"username" in result.detail.to_lower()):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Test 3: Register under-18 user ---
print("\n=== Test 3: Under-18 registration ===")
var child_username := "child_%d" % unique_id
var child_email := "child_%d@test.example.com" % unique_id
result = await api.register(child_username, child_email, TEST_PASSWORD, TEST_DOB_CHILD)
if _check("under-18 register not ok", not result.ok) \
and _check("under-18 status is 400", result.status == 400) \
and _check("under-18 detail mentions age",
"18" in result.detail):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Test 4: Login with correct credentials ---
print("\n=== Test 4: Correct login ===")
result = await api.login(username, TEST_PASSWORD)
if _check("login returns ok", result.ok) \
and _check("login status is 200", result.status == 200) \
and _check("login stores token", api.has_token()):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Test 5: Login with wrong password ---
print("\n=== Test 5: Wrong password ===")
result = await api.login(username, "WrongPassword!")
if _check("wrong pwd login not ok", not result.ok) \
and _check("wrong pwd status is 401", result.status == 401) \
and _check("wrong pwd detail",
"Incorrect" in result.detail or "incorrect" in result.detail):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Test 6: Login with non-existent user ---
print("\n=== Test 6: Non-existent user ===")
result = await api.login("nonexistent_user_xyz", TEST_PASSWORD)
if _check("missing user login not ok", not result.ok) \
and _check("missing user status is 401", result.status == 401) \
and _check("missing user detail",
"Incorrect" in result.detail or "incorrect" in result.detail):
passed += 1
else:
failed += 1
print(" detail: ", result.detail)
# --- Summary ---
print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
if failed > 0:
quit(1)
else:
print("SMOKE RESULT: ALL PASS")
quit(0)
func _check(description: String, condition: bool) -> bool:
if condition:
print(" PASS: ", description)
return true
else:
printerr(" FAIL: ", description)
return false