fix(auth): correct local cookie security configuration

validation-suite/backend/mercury/tests/test_validation_workflow.py

@@ -4,18 +4,22 @@ import re
 from datetime import date
 from pathlib import Path
 
-from sqlalchemy import create_engine
+from sqlalchemy import create_engine, select
 from sqlalchemy.orm import Session
 
 from app.db.base import Base
 from app.models.customer import Customer, CustomerType
 from app.models.contact import Contact
 from app.models.device import Device
+from app.models.equipment import Equipment
 from app.models.user import User, UserRole
 from app.models.location import Location
 from app.models.validation import Validation, ValidationStatus
 from app.services.validation_workflow import ValidationWorkflowService
 from app.services.auth_service import AuthService
+from app.services.reference_masterdata import ReferenceMasterdataImportService
+from app.api.v1.auth import login as auth_login
+from app.schemas.auth import LoginRequest
 from app.schemas.domain import ValidationCreate
 from app.modules.orion.service import OrionReportService
 from app.modules.orion.assets import SCHUBAMED_LOGO_PATH, schubamed_logo_uri
@@ -229,6 +233,93 @@ def test_login_updates_last_login_at():
     assert user.last_login_at is not None
 
 
+def test_login_response_contains_user_and_expires_in():
+    from app.core.security import hash_password
+    from app.core.config import settings
+
+    db = session()
+    user = User(
+        email="response@schubamed.de",
+        first_name="Response",
+        last_name="Test",
+        role=UserRole.PRUEFER.value,
+        password_hash=hash_password("VerySecretPass123"),
+        is_active=True,
+        must_change_password=True,
+    )
+    db.add(user)
+    db.flush()
+
+    response = auth_login(LoginRequest(email="response@schubamed.de", password="VerySecretPass123"), db)
+
+    assert response.expires_in == settings.access_token_minutes * 60
+    assert response.user.email == "response@schubamed.de"
+    assert response.user.must_change_password is True
+
+
+def test_login_rejects_inactive_user_with_403():
+    from app.core.security import hash_password
+    from fastapi import HTTPException
+
+    db = session()
+    user = User(
+        email="inactive@schubamed.de",
+        first_name="Inactive",
+        last_name="User",
+        role=UserRole.PRUEFER.value,
+        password_hash=hash_password("VerySecretPass123"),
+        is_active=False,
+        must_change_password=False,
+    )
+    db.add(user)
+    db.flush()
+
+    try:
+        AuthService(db).login("inactive@schubamed.de", "VerySecretPass123")
+    except HTTPException as exc:
+        assert exc.status_code == 403
+    else:
+        raise AssertionError("Inactive user was accepted")
+
+
+def test_reference_masterdata_import_is_idempotent_and_links_entities(tmp_path):
+    db = session()
+    reference = next(
+        candidate
+        for parent in Path(__file__).resolve().parents
+        if (candidate := parent / "docs/reference/reports/Erstvalidierung_Dr.Durmaz_Steri_12-25.docx").exists()
+    )
+
+    first = ReferenceMasterdataImportService(db).import_reference_docx(reference)
+    second = ReferenceMasterdataImportService(db).import_reference_docx(reference)
+
+    assert "customer" in first.created
+    assert "location" in first.created
+    assert "device" in first.created
+    assert first.validation_id is None
+    assert "customer" in second.unchanged
+    assert "device" in second.unchanged
+    assert db.scalar(select(Customer).where(Customer.name == "Urologische Praxis Dr. Durmaz")) is not None
+    assert db.scalar(select(Device).where(Device.serial_number == "EXN250688")) is not None
+    assert db.scalar(select(Equipment).where(Equipment.serial_number == "15125738")) is not None
+
+
+def test_reference_masterdata_import_can_create_validation():
+    db = session()
+    reference = next(
+        candidate
+        for parent in Path(__file__).resolve().parents
+        if (candidate := parent / "docs/reference/reports/Erstvalidierung_Dr.Durmaz_Steri_12-25.docx").exists()
+    )
+
+    result = ReferenceMasterdataImportService(db).import_reference_docx(reference, create_validation=True)
+
+    assert result.validation_id is not None
+    validation = db.get(Validation, result.validation_id)
+    assert validation is not None
+    assert validation.status == ValidationStatus.draft.value
+
+
 def test_revalidation_date_uses_calendar_months():
     db = session()
     customer, location, device = seed(db)