sciagent code + Gitea Actions CI/CD

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

be0/tests/test_registration_otp.py

@@ -0,0 +1,135 @@
+"""
+Registration OTP API (PostgreSQL + mocked outbound mail).
+
+  export INITIATIVE_DATABASE_URL="postgresql+asyncpg://initiative:initiative_secret@127.0.0.1:15432/initiatives"
+  # Ensure migrations through 014_registration_otp.sql are applied.
+  cd be0 && python -m unittest tests.test_registration_otp -v
+
+Optional live login smoke (**credentials must never be committed**):
+
+  export TEST_LIVE_AUTH_EMAIL="nltanh@ump.edu.vn"
+  export TEST_LIVE_AUTH_PASSWORD='<paste password locally>'
+  cd be0 && python -m unittest tests.test_registration_otp.LiveAuthLoginOptionalTests.test_login_with_env_credentials -v
+"""
+
+from __future__ import annotations
+
+import os
+import unittest
+import uuid
+from unittest.mock import patch
+
+from sqlalchemy import select
+
+from tests.auth_register_staff_fixture import register_staff_fields
+
+_RUN_DB = os.getenv("INITIATIVE_DATABASE_URL", "").strip().lower().startswith("postgresql")
+
+_TEST_PASSWORD = "Testpass1!"
+
+
+@unittest.skipUnless(
+    _RUN_DB,
+    "Set INITIATIVE_DATABASE_URL=postgresql+asyncpg://.../initiatives",
+)
+class RegistrationOtpApiTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self) -> None:
+        from src.initiative_db import engine as eng
+
+        await eng.dispose_engine()
+        await eng.init_engine()
+
+    async def asyncTearDown(self) -> None:
+        from src.initiative_db import engine as eng
+
+        await eng.dispose_engine()
+
+    async def _delete_user(self, email: str) -> None:
+        from src.initiative_db.engine import get_session
+        from src.initiative_db.models import User
+
+        async with get_session() as session:
+            user = (
+                await session.execute(select(User).where(User.email == email))
+            ).scalar_one_or_none()
+            if user is not None:
+                await session.delete(user)
+
+    async def test_register_verify_otp_then_login(self) -> None:
+        from fastapi.testclient import TestClient
+
+        from main import app
+
+        email = f"otp-{uuid.uuid4().hex[:12]}@ump.edu.vn"
+        captured: list[str] = []
+
+        async def grab(_to: str, raw: str) -> None:
+            captured.append(raw)
+
+        try:
+            with patch.dict(os.environ, {"AUTH_MAIL_LOG_ONLY": "1"}):
+                with patch("src.auth_api.deliver_registration_otp_email", side_effect=grab):
+                    with TestClient(app) as client:
+                        r = client.post(
+                            "/api/v1/auth/register",
+                            json={
+                                "fullName": "OTP Tester",
+                                "email": email,
+                                "password": _TEST_PASSWORD,
+                                "passwordConfirm": _TEST_PASSWORD,
+                                **register_staff_fields(),
+                            },
+                        )
+            self.assertEqual(r.status_code, 200, r.text)
+            self.assertTrue(captured)
+            otp = captured[0]
+            self.assertEqual(len(otp), 6)
+            self.assertTrue(otp.isdigit())
+
+            with TestClient(app) as client:
+                blocked = client.post(
+                    "/api/v1/auth/login",
+                    json={"email": email, "password": _TEST_PASSWORD},
+                )
+                self.assertEqual(blocked.status_code, 403, blocked.text)
+
+                bad = client.post("/api/v1/auth/verify-otp", json={"email": email, "otp": "000000"})
+                self.assertEqual(bad.status_code, 400, bad.text)
+
+                ok = client.post("/api/v1/auth/verify-otp", json={"email": email, "otp": otp})
+                self.assertEqual(ok.status_code, 200, ok.text)
+
+                lg = client.post(
+                    "/api/v1/auth/login",
+                    json={"email": email, "password": _TEST_PASSWORD},
+                )
+                self.assertEqual(lg.status_code, 200, lg.text)
+                self.assertTrue(lg.json().get("accessToken"))
+        finally:
+            await self._delete_user(email)
+
+
+_LIVE_PW = os.getenv("TEST_LIVE_AUTH_PASSWORD", "").strip()
+_LIVE_EMAIL = os.getenv("TEST_LIVE_AUTH_EMAIL", "nltanh@ump.edu.vn").strip().lower()
+
+
+@unittest.skipUnless(
+    _RUN_DB and bool(_LIVE_PW),
+    "Set INITIATIVE_DATABASE_URL and TEST_LIVE_AUTH_PASSWORD for optional login smoke "
+    "(use TEST_LIVE_AUTH_EMAIL to override default nltanh@ump.edu.vn).",
+)
+class LiveAuthLoginOptionalTests(unittest.TestCase):
+    """Uses secrets from env only — passwords must never appear in source control."""
+
+    def test_login_with_env_credentials(self) -> None:
+        from fastapi.testclient import TestClient
+
+        from main import app
+
+        with TestClient(app) as client:
+            r = client.post(
+                "/api/v1/auth/login",
+                json={"email": _LIVE_EMAIL, "password": _LIVE_PW},
+            )
+        self.assertEqual(r.status_code, 200, r.text)
+        self.assertTrue(r.json().get("accessToken"))