feat: auth module with bcrypt password verification and session tokens

tests/test_auth.py

@@ -0,0 +1,58 @@
+"""Tests for auth module — bcrypt password verification and session tokens."""
+
+import sys
+import os
+
+# Add backend to sys.path so we can import auth
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "backend"))
+
+import bcrypt
+import pytest
+
+from auth import verify_password, create_session_token, validate_session_token
+
+TEST_PASSWORD = "test_password_123"
+TEST_EMAIL = "test@example.com"
+
+
+@pytest.fixture(autouse=True)
+def set_auth_env(monkeypatch):
+    """Set up AUTH_PASS_HASH env var with a bcrypt-hashed test password."""
+    hashed = bcrypt.hashpw(TEST_PASSWORD.encode(), bcrypt.gensalt()).decode()
+    monkeypatch.setenv("AUTH_PASS_HASH", hashed)
+    monkeypatch.setenv("AUTH_USER", TEST_EMAIL)
+
+
+def test_verify_password_correct():
+    """Correct password returns True."""
+    assert verify_password(TEST_PASSWORD) is True
+
+
+def test_verify_password_wrong():
+    """Wrong password returns False."""
+    assert verify_password("wrong_password_xyz") is False
+
+
+def test_verify_password_empty():
+    """Empty password returns False."""
+    assert verify_password("") is False
+
+
+def test_create_session_token():
+    """create_session_token returns a non-None string of length > 20."""
+    token = create_session_token(TEST_EMAIL)
+    assert token is not None
+    assert isinstance(token, str)
+    assert len(token) > 20
+
+
+def test_validate_session_token_valid():
+    """Valid token returns the associated email."""
+    token = create_session_token(TEST_EMAIL)
+    assert validate_session_token(token) == TEST_EMAIL
+
+
+def test_validate_session_token_invalid_and_empty():
+    """Invalid/bogus token returns None; empty token returns None."""
+    assert validate_session_token("bogus_token_that_does_not_exist") is None
+    assert validate_session_token("") is None