claude rework

src/views/auth/login.rs

@@ -43,3 +43,69 @@ pub async fn login(credentials: web::Json<Login>) -> HttpResponse {
         false => HttpResponse::Unauthorized().await.unwrap(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use actix_web::http::StatusCode;
+    use actix_web::{test, web, App};
+
+    use super::login;
+    use crate::database::establish_connection;
+    use crate::test_helpers::{delete_user, insert_user, unique_suffix};
+
+    #[actix_web::test]
+    async fn login_succeeds_with_correct_credentials() {
+        let mut connection = establish_connection();
+        let user = insert_user(&mut connection, "correct-password");
+
+        let app = test::init_service(App::new().route("/login", web::post().to(login))).await;
+        let req = test::TestRequest::post()
+            .uri("/login")
+            .set_json(serde_json::json!({
+                "username": user.username,
+                "password": "correct-password"
+            }))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::OK, resp.status());
+        assert!(resp.headers().contains_key("token"));
+
+        delete_user(&mut connection, user.id);
+    }
+
+    #[actix_web::test]
+    async fn login_fails_with_wrong_password() {
+        let mut connection = establish_connection();
+        let user = insert_user(&mut connection, "correct-password");
+
+        let app = test::init_service(App::new().route("/login", web::post().to(login))).await;
+        let req = test::TestRequest::post()
+            .uri("/login")
+            .set_json(serde_json::json!({
+                "username": user.username,
+                "password": "wrong-password"
+            }))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::UNAUTHORIZED, resp.status());
+
+        delete_user(&mut connection, user.id);
+    }
+
+    #[actix_web::test]
+    async fn login_fails_for_unknown_user() {
+        let app = test::init_service(App::new().route("/login", web::post().to(login))).await;
+        let req = test::TestRequest::post()
+            .uri("/login")
+            .set_json(serde_json::json!({
+                "username": format!("does-not-exist-{}", unique_suffix()),
+                "password": "whatever"
+            }))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::NOT_FOUND, resp.status());
+    }
+}

src/views/auth/logout.rs

@@ -1,3 +1,25 @@
-pub async fn logout() -> String {
-    "logout view".to_string()
+use actix_web::HttpResponse;
+
+// JWT auth is stateless and there is no token blacklist, so logging out is
+// purely a client-side action (discarding the stored token). This endpoint
+// exists so the frontend has something to call and gets a clean response.
+pub async fn logout() -> HttpResponse {
+    HttpResponse::Ok().finish()
+}
+
+#[cfg(test)]
+mod tests {
+    use actix_web::http::StatusCode;
+    use actix_web::{test, web, App};
+
+    use super::logout;
+
+    #[actix_web::test]
+    async fn logout_returns_ok() {
+        let app = test::init_service(App::new().route("/logout", web::post().to(logout))).await;
+        let req = test::TestRequest::post().uri("/logout").to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::OK, resp.status());
+    }
 }