Remove mastodon posts on delete and OTP

backend/tests/test_user_config.py

@@ -4,6 +4,7 @@
 from fastapi.testclient import TestClient
 
 from backend.app.main import app
+from backend.app.services.otp_service import current_code
 
 
 client = TestClient(app)
@@ -75,3 +76,30 @@ def test_user_config_api_and_profile_page():
 
     updated_profile = client.get('/api/user/me', headers=headers).json()
     assert updated_profile['avatar_url'] == avatar_url
+
+
+def test_user_can_enable_and_use_otp():
+    login = client.post('/api/auth/login', json={'username': 'alice', 'password': 'secret123'}).json()
+    headers = {'Authorization': f"Bearer {login['access_token']}"}
+    setup = client.post('/api/user/otp/setup', headers=headers)
+    assert setup.status_code == 200
+    secret = setup.json()['secret']
+    assert setup.json()['otpauth_url'].startswith('otpauth://totp/')
+
+    enabled = client.post('/api/user/otp', headers=headers, json={
+        'action': 'enable', 'code': current_code(secret),
+    })
+    assert enabled.status_code == 200
+    assert enabled.json()['enabled'] is True
+    assert client.post('/api/auth/login', json={'username': 'alice', 'password': 'secret123'}).status_code == 401
+
+    otp_login = client.post('/api/auth/login', json={
+        'username': 'alice', 'password': 'secret123', 'otp': current_code(secret),
+    })
+    assert otp_login.status_code == 200
+
+    disabled = client.post('/api/user/otp', headers=headers, json={
+        'action': 'disable', 'code': current_code(secret),
+    })
+    assert disabled.status_code == 200
+    assert disabled.json()['enabled'] is False