Merge lavoro/daitarn-trafilo-login

src/frontend/flask_app/tests/test_auth.py

@@ -136,3 +136,67 @@ class TestLanguageSwitch:
         with client.session_transaction() as sess:
             # Invalid language should NOT be stored
             assert sess.get("language") != "xx"
+
+
+class TestPinLogin:
+    """Login Operatore con nome + PIN (#59)."""
+
+    USER = {
+        "id": 7, "username": "mario", "display_name": "Mario Rossi",
+        "roles": ["MeasurementTec"], "is_admin": False,
+        "language_pref": "it", "theme_pref": "light", "active": True,
+    }
+
+    def test_login_page_has_pin_view_and_password_link(self, client):
+        resp = client.get("/auth/login")
+        assert b"pin-pad.js" in resp.data
+        assert b"pin-pad" in resp.data  # tastierino presente nel markup
+        assert b'name="password"' in resp.data  # form password ancora presente
+
+    def test_pin_users_listed(self, client, mock_api_client):
+        mock_api_client.get.return_value = [
+            {"id": 7, "display_name": "Mario Rossi", "secret": "x"},
+        ]
+        resp = client.get("/auth/pin-users")
+        assert resp.status_code == 200
+        assert resp.get_json() == [{"id": 7, "display_name": "Mario Rossi"}]
+
+    def test_pin_users_empty_on_error(self, client, mock_api_client):
+        mock_api_client.get.return_value = {"error": True, "detail": "boom"}
+        assert client.get("/auth/pin-users").get_json() == []
+
+    def test_pin_users_empty_list_falls_back(self, client, mock_api_client):
+        mock_api_client.get.return_value = []
+        assert client.get("/auth/pin-users").get_json() == []
+
+    def test_login_pin_success_sets_session(self, client, mock_api_client):
+        mock_api_client.post.return_value = {"api_key": "pin-key", "user": self.USER}
+        mock_api_client.get.return_value = {}
+        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "1234"})
+        assert resp.status_code == 200
+        assert resp.get_json()["ok"] is True
+        assert resp.get_json()["redirect"]
+        mock_api_client.post.assert_called_once_with(
+            "/api/auth/login-pin", data={"user_id": 7, "pin": "1234"})
+        with client.session_transaction() as sess:
+            assert sess["api_key"] == "pin-key"
+            assert sess["user_id"] == 7
+            assert sess.permanent is True
+
+    def test_login_pin_wrong_pin_401(self, client, mock_api_client):
+        mock_api_client.post.return_value = {"error": True, "status_code": 401, "detail": "x"}
+        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "0000"})
+        assert resp.status_code == 401
+        assert resp.get_json()["detail"] == "PIN errato"
+
+    def test_login_pin_locked_423_shows_detail(self, client, mock_api_client):
+        mock_api_client.post.return_value = {
+            "error": True, "status_code": 423, "detail": "Utente bloccato fino alle 10:15"}
+        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "0000"})
+        assert resp.status_code == 423
+        assert "10:15" in resp.get_json()["detail"]
+
+    def test_login_pin_invalid_pin_422(self, client, mock_api_client):
+        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "12"})
+        assert resp.status_code == 422
+        mock_api_client.post.assert_not_called()