api auth

tests/test_app.py

@@ -163,3 +163,40 @@ def test_only_admin_can_change_global_vat(tmp_path):
     response = client.post('/admin/global-vat', data={'enabled':'on','name':'CPN','rate':'8','start':'2026-07-01','end':'2026-07-31'}, headers={'X-Requested-With':'XMLHttpRequest'})
     assert response.status_code == 200
     assert response.json['ok'] is True
+
+
+def test_api_bearer_token_authentication(tmp_path):
+    app = make_app(tmp_path, "bearer.db")
+    client = app.test_client()
+
+    token_response = client.post('/api/auth/token', data={
+        'username': 'admin@example.com',
+        'password': 'admin123!',
+    })
+    assert token_response.status_code == 200
+    token = token_response.json['access_token']
+    assert token_response.json['token_type'] == 'Bearer'
+
+    fresh_client = app.test_client()
+    response = fresh_client.get('/api/me', headers={
+        'Authorization': f'Bearer {token}',
+    })
+    assert response.status_code == 200
+    assert response.json['data']['email'] == 'admin@example.com'
+
+
+def test_api_rejects_invalid_bearer_token(tmp_path):
+    app = make_app(tmp_path, "invalid-bearer.db")
+    response = app.test_client().get('/api/me', headers={
+        'Authorization': 'Bearer invalid-token',
+    })
+    assert response.status_code == 401
+    assert response.json['ok'] is False
+
+
+def test_openapi_contains_password_flow(tmp_path):
+    app = make_app(tmp_path, "openapi-auth.db")
+    spec = app.test_client().get('/openapi.json').json
+    password_flow = spec['components']['securitySchemes']['oauth2Password']['flows']['password']
+    assert password_flow['tokenUrl'] == '/api/auth/token'
+    assert '/api/auth/token' in spec['paths']