Added email functionality

backend/tests/test_api.py

@@ -9,6 +9,7 @@ from uuid import uuid4
 from fastapi.testclient import TestClient
 
 from backend.app.main import app
+from backend.app.services.token_service import issue_token
 
 
 client = TestClient(app)
@@ -74,6 +75,41 @@ def test_admin_can_add_list_and_remove_users():
     assert client.put('/api/admin/users/user-1', headers=headers, json={'is_admin': False}).status_code == 400
 
 
+def test_new_user_must_verify_email_before_login():
+    headers = login_headers()
+    username = f'unverified-{uuid4().hex}'
+    created = client.post('/api/admin/users', headers=headers, json={
+        'username': username,
+        'email': f'{username}@example.com',
+        'password': 'secret123',
+    })
+    assert created.status_code == 201
+    assert created.json()['email_verified'] is False
+
+    login = client.post('/api/auth/login', json={'username': username, 'password': 'secret123'})
+    assert login.status_code == 403
+    assert login.json()['detail'] == 'Email address is not verified'
+
+
+def test_email_verification_link_enables_login():
+    headers = login_headers()
+    username = f'verifiable-{uuid4().hex}'
+    created = client.post('/api/admin/users', headers=headers, json={
+        'username': username,
+        'email': f'{username}@example.com',
+        'password': 'secret123',
+    })
+    assert created.status_code == 201
+    user_id = created.json()['id']
+    from backend.app.services.email_verification import create_verification_token
+    verification_token = create_verification_token(user_id)
+
+    verified = client.get('/api/auth/verify-email', params={'token': verification_token})
+    assert verified.status_code == 200
+    assert client.post('/api/auth/login', json={'username': username, 'password': 'secret123'}).status_code == 200
+    assert client.get('/api/auth/verify-email', params={'token': verification_token}).status_code == 400
+
+
 def test_admin_can_remove_user_with_owned_data():
     headers = login_headers()
     username = f'data-owner-{uuid4().hex}'
@@ -84,7 +120,8 @@ def test_admin_can_remove_user_with_owned_data():
     })
     assert create_response.status_code == 201
     user_id = create_response.json()['id']
-    user_headers = login_headers(username)
+    user_token = issue_token(user_id, username)['access_token']
+    user_headers = {'Authorization': f'Bearer {user_token}'}
 
     link_response = client.post('/api/links', headers=user_headers, json={
         'title': 'Owned link',