Complete authentication and profile features

backend/tests/test_user_config.py

@@ -19,11 +19,11 @@ def test_user_config_api_and_profile_page():
     assert payload['username'] == 'alice'
 
     update_response = client.put('/api/user/me', json={
-        'username': 'should-not-change',
+        'email': 'alice@example.com',
         'bio': 'Updated bio',
-        'avatar_url': 'https://example.com/new-avatar.png'
     }, headers=headers)
     assert update_response.status_code == 200
+    assert client.get('/api/user/me', headers=headers).json()['username'] == 'alice'
 
     page_response = client.get('/profile')
     assert page_response.status_code == 200
@@ -31,9 +31,23 @@ def test_user_config_api_and_profile_page():
     assert '<output id="username" class="readonly-value">Loading...</output>' in page_response.text
     assert 'name="username"' not in page_response.text
     assert '<textarea id="bio" name="bio" rows="4"></textarea>' in page_response.text
-    assert 'https://example.com/avatar.png' in page_response.text
+    assert 'name="avatar" type="file"' in page_response.text
+    assert 'name="avatar_url"' not in page_response.text
     assert 'value="mastodon.social"' in page_response.text
     assert 'From my #LinkLog: &quot;' in page_response.text
     assert 'id="admin-link"' in page_response.text
     assert 'class="login-button hidden"' in page_response.text
     assert 'id="logout-button" class="logout-button hidden"' in page_response.text
+
+    upload_response = client.post(
+        '/api/user/avatar',
+        headers=headers,
+        files={'avatar': ('avatar.png', b'fake-png-data', 'image/png')},
+    )
+    assert upload_response.status_code == 200
+    avatar_url = upload_response.json()['avatar_url']
+    assert avatar_url.startswith('/media/user-1.png')
+    assert client.get(avatar_url).content == b'fake-png-data'
+
+    updated_profile = client.get('/api/user/me', headers=headers).json()
+    assert updated_profile['avatar_url'] == avatar_url