feat: email-first login with allow-check and access forward

backend/tests/test_auth.py

@@ -268,3 +268,51 @@ async def test_approve_survives_delivery_failure(client, session, monkeypatch):
     body = approved.json()
     assert body["request"]["status"] == "approved"
     assert body["email_sent"] is False
+
+
+async def test_magic_request_for_known_user(client, session):
+    _get_or_make_user(session, MEMBER)
+    response = await client.post(
+        "/api/auth/magic/request", json={"email": MEMBER}
+    )
+    assert response.status_code == 200, response.text
+    body = response.json()
+    assert body["message"] == "login link sent"
+    assert body["email_sent"] is False  # no SMTP in tests
+    assert "token" not in response.text
+    tokens = session.exec(
+        select(MagicLinkToken).where(
+            MagicLinkToken.user_id
+            == service.get_user_by_email(session, MEMBER).id
+        )
+    ).all()
+    assert len(tokens) == 1
+
+
+async def test_magic_request_unknown_email_403(client):
+    response = await client.post(
+        "/api/auth/magic/request", json={"email": "stranger@example.com"}
+    )
+    assert response.status_code == 403
+
+
+async def test_magic_request_admin_email_creates_admin(client, session):
+    response = await client.post(
+        "/api/auth/magic/request", json={"email": ADMIN}
+    )
+    assert response.status_code == 200, response.text
+    user = service.get_user_by_email(session, ADMIN)
+    assert user is not None and user.role == "admin"
+
+
+async def test_magic_request_rate_limit(client, session):
+    _get_or_make_user(session, MEMBER)
+    for _ in range(service.MAGIC_LINKS_PER_EMAIL_PER_HOUR):
+        response = await client.post(
+            "/api/auth/magic/request", json={"email": MEMBER}
+        )
+        assert response.status_code == 200, response.text
+    limited = await client.post(
+        "/api/auth/magic/request", json={"email": MEMBER}
+    )
+    assert limited.status_code == 429