feat: add authenticated HTTP service

tests/api/test_auth.py

@@ -0,0 +1,46 @@
+from fastapi.testclient import TestClient
+
+
+def test_login_sets_scoped_secure_cookie(app_client: TestClient) -> None:
+    response = app_client.post(
+        "/auth/login", json={"username": "admin", "password": "secret-password"}
+    )
+    assert response.status_code == 200
+    cookie = response.headers["set-cookie"]
+    assert "HttpOnly" in cookie and "SameSite=lax" in cookie
+    assert "Secure" in cookie and "Path=/" in cookie
+    assert response.json()["csrf_token"]
+
+
+def test_unauthenticated_request_is_refused(app_client: TestClient) -> None:
+    response = app_client.get("/collections")
+    assert response.status_code == 401
+    assert response.json()["error"]["code"] == "unauthenticated"
+
+
+def test_csrf_required_for_unsafe_request(authenticated: tuple[TestClient, str]) -> None:
+    client, csrf = authenticated
+    assert client.post("/collections", json={"name": "Books"}).status_code == 403
+    response = client.post(
+        "/collections", json={"name": "Books"}, headers={"X-CSRF-Token": csrf}
+    )
+    assert response.status_code == 201
+
+
+def test_session_rotates_csrf_and_logout(authenticated: tuple[TestClient, str]) -> None:
+    client, old_csrf = authenticated
+    session = client.get("/auth/session")
+    assert session.status_code == 200
+    new_csrf = session.json()["csrf_token"]
+    assert new_csrf != old_csrf
+    assert client.post("/auth/logout", headers={"X-CSRF-Token": old_csrf}).status_code == 403
+    assert client.post("/auth/logout", headers={"X-CSRF-Token": new_csrf}).status_code == 204
+    assert client.get("/auth/session").status_code == 401
+
+
+def test_login_rejects_cross_origin(app_client: TestClient) -> None:
+    response = app_client.post(
+        "/auth/login", json={"username": "admin", "password": "secret-password"},
+        headers={"Origin": "https://evil.example"},
+    )
+    assert response.status_code == 403