Mirror test layout, domcontentloaded waits, backup DB writes outside threads

tests/api/auth/__init__.py

@@ -0,0 +1 @@
+# retoor <retoor@molodetz.nl>

tests/api/auth/login.py

@@ -0,0 +1,24 @@
+# retoor <retoor@molodetz.nl>
+from tests.conftest import ADMIN_PASSWORD, ADMIN_USERNAME
+
+
+def test_login_wrong_password(anon):
+    response = anon.post("/auth/login", data={"username": ADMIN_USERNAME, "password": "verkeerd-wachtwoord"})
+    assert response.status_code in (400, 401, 200)
+    assert "session" not in "".join(response.cookies.keys()).lower() or response.status_code != 302
+
+
+def test_login_and_logout(anon):
+    response = anon.post("/auth/login", data={"username": ADMIN_USERNAME, "password": ADMIN_PASSWORD})
+    assert response.status_code in (302, 303)
+    assert anon.get("/admin").status_code == 200
+    cookie = response.headers.get("set-cookie", "").lower()
+    assert "httponly" in cookie and "samesite=lax" in cookie
+    assert anon.post("/auth/logout").status_code in (302, 303)
+    assert anon.get("/admin").status_code in (302, 303, 401)
+
+
+def test_admin_redirects_anonymous(anon):
+    response = anon.get("/admin")
+    assert response.status_code in (302, 303)
+    assert "/auth/login" in response.headers["location"]