iUUUUpdatexz

tests/api/auth/login.py

@@ -181,3 +181,45 @@ def test_rate_limit_block_recorded(monkeypatch):
         event_key="security.rate_limit.block", result="denied"
     )
     assert event is not None
+
+
+def _member_with_null_is_active():
+    session, name = _member()
+    row = _db_user(name)
+    get_table("users").update({"uid": row["uid"], "is_active": None}, ["uid"])
+    refresh_snapshot()
+    return name, row
+
+
+def test_login_works_when_is_active_was_never_written(seeded_db):
+    name, _row = _member_with_null_is_active()
+    response = requests.post(
+        f"{BASE_URL}/auth/login",
+        headers=JSON_audit_log,
+        data={"email": f"{name}@t.dev", "password": "secret123"},
+        allow_redirects=False,
+    )
+    assert response.status_code == 200, response.text[:300]
+
+
+def test_api_key_works_when_is_active_was_never_written(seeded_db):
+    _name, row = _member_with_null_is_active()
+    response = requests.get(
+        f"{BASE_URL}/profile",
+        headers={**JSON_audit_log, "X-API-KEY": row["api_key"]},
+        allow_redirects=False,
+    )
+    assert response.status_code == 200, response.text[:300]
+
+
+def test_an_explicitly_disabled_account_still_cannot_log_in(seeded_db):
+    session, name = _member()
+    row = _db_user(name)
+    get_table("users").update({"uid": row["uid"], "is_active": False}, ["uid"])
+    refresh_snapshot()
+    response = requests.get(
+        f"{BASE_URL}/profile",
+        headers={**JSON_audit_log, "X-API-KEY": row["api_key"]},
+        allow_redirects=False,
+    )
+    assert response.status_code == 401