devplacepy/tests/e2e/auth/resetpassword.py

# retoor <retoor@molodetz.nl>

import hashlib
import time
from datetime import datetime, timedelta, timezone
from playwright.sync_api import expect
from tests.conftest import BASE_URL
from devplacepy.database import get_table
from devplacepy.utils import hash_password, generate_uid


def test_reset_password_page_loads(page, app_server):
    page.goto(
        f"{BASE_URL}/auth/reset-password/sometoken", wait_until="domcontentloaded"
    )
    assert page.is_visible("input#password")
    assert page.is_visible("input#confirm_password")


def test_reset_password_mismatch_shows_error(page, app_server):
    page.goto(
        f"{BASE_URL}/auth/reset-password/sometoken", wait_until="domcontentloaded"
    )
    page.fill("#password", "abcdef1")
    page.fill("#confirm_password", "different1")
    page.click("button:has-text('Reset Password')")
    page.locator(".auth-error").wait_for(state="visible")


def test_reset_password_full_flow(page, app_server):
    uname = f"reset_{int(time.time() * 1000)}"
    email = f"{uname}@t.dev"
    uid = generate_uid()
    get_table("users").insert(
        {
            "uid": uid,
            "username": uname,
            "terms_version": "1",
            "email": email,
            "password_hash": hash_password("oldpass123"),
            "bio": "",
            "location": "",
            "git_link": "",
            "website": "",
            "role": "Member",
            "is_active": True,
            "level": 1,
            "xp": 0,
            "stars": 0,
            "created_at": datetime.now(timezone.utc).isoformat(),
        }
    )
    token = f"tok{uid[:8]}"
    get_table("password_resets").insert(
        {
            "uid": generate_uid(),
            "user_uid": uid,
            "token": hashlib.sha256(token.encode()).hexdigest(),
            "expires_at": (datetime.now(timezone.utc) + timedelta(hours=1)).isoformat(),
            "used": False,
            "created_at": datetime.now(timezone.utc).isoformat(),
        }
    )
    page.goto(f"{BASE_URL}/auth/reset-password/{token}", wait_until="domcontentloaded")
    page.fill("#password", "newpass456")
    page.fill("#confirm_password", "newpass456")
    page.click("button:has-text('Reset Password')")
    page.wait_for_url("**/auth/login", wait_until="domcontentloaded")
    page.fill("#email", email)
    page.fill("#password", "newpass456")
    page.click("button:has-text('Sign in')")
    page.wait_for_url("**/feed", wait_until="domcontentloaded")
    assert "/feed" in page.url