Add auth foundation and app DB management

tests/test_app.py

@@ -5,9 +5,11 @@ import pytest
 from alembic import command
 from fastapi.testclient import TestClient
 
+from app.auth_db import reset_auth_db_caches
 from app.config import get_settings
 from app.main import create_app
-from tests.conftest import _make_alembic_config, _make_poo_alembic_config
+from scripts.app_db_adopt import APP_BASELINE_REVISION, adopt_or_initialize_app_db
+from tests.conftest import _make_alembic_config, _make_app_alembic_config, _make_poo_alembic_config
 
 
 async def _run_lifespan(app) -> None:
@@ -15,6 +17,13 @@ async def _run_lifespan(app) -> None:
         return None
 
 
+def _prepare_app_db(tmp_path) -> str:
+    app_database_path = tmp_path / "app_ready.db"
+    app_database_url = f"sqlite:///{app_database_path}"
+    command.upgrade(_make_app_alembic_config(app_database_url), "head")
+    return app_database_url
+
+
 def test_app_starts(client: TestClient) -> None:
     response = client.get("/")
     assert response.status_code == 200
@@ -26,26 +35,79 @@ def test_status_endpoint(client: TestClient) -> None:
     assert response.json() == {"status": "ok"}
 
 
+def test_app_start_fails_when_app_db_missing(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
+    poo_database_path = tmp_path / "poo_ready.db"
+    location_database_path = tmp_path / "location_ready.db"
+    command.upgrade(_make_poo_alembic_config(f"sqlite:///{poo_database_path}"), "head")
+    command.upgrade(_make_alembic_config(f"sqlite:///{location_database_path}"), "head")
+
+    monkeypatch.setenv("APP_DATABASE_URL", f"sqlite:///{tmp_path / 'missing_app.db'}")
+    monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
+    monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "test-password")
+    monkeypatch.setenv("LOCATION_DATABASE_URL", f"sqlite:///{location_database_path}")
+    monkeypatch.setenv("POO_DATABASE_URL", f"sqlite:///{poo_database_path}")
+    get_settings.cache_clear()
+    reset_auth_db_caches()
+
+    app = create_app()
+    with pytest.raises(RuntimeError, match="Run 'python scripts/app_db_adopt.py' first"):
+        anyio.run(_run_lifespan, app)
+
+    get_settings.cache_clear()
+    reset_auth_db_caches()
+
+
+def test_app_db_adoption_initializes_new_database(tmp_path) -> None:
+    database_url = f"sqlite:///{tmp_path / 'app_init.db'}"
+
+    result = adopt_or_initialize_app_db(database_url)
+
+    assert result == "initialized"
+    conn = sqlite3.connect(tmp_path / "app_init.db")
+    try:
+        revision = conn.execute("SELECT version_num FROM alembic_version").fetchone()[0]
+        assert revision == APP_BASELINE_REVISION
+        tables = {
+            row[0]
+            for row in conn.execute(
+                "SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'"
+            ).fetchall()
+        }
+        assert {"auth_users", "auth_sessions", "alembic_version"} <= tables
+    finally:
+        conn.close()
+
+
 def test_app_start_fails_when_location_db_missing(
     tmp_path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
+    app_database_url = _prepare_app_db(tmp_path)
+    monkeypatch.setenv("APP_DATABASE_URL", app_database_url)
+    monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
+    monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "test-password")
     poo_database_path = tmp_path / "poo_ready.db"
     command.upgrade(_make_poo_alembic_config(f"sqlite:///{poo_database_path}"), "head")
 
     monkeypatch.setenv("LOCATION_DATABASE_URL", f"sqlite:///{tmp_path / 'missing.db'}")
     monkeypatch.setenv("POO_DATABASE_URL", f"sqlite:///{poo_database_path}")
     get_settings.cache_clear()
+    reset_auth_db_caches()
 
     app = create_app()
     with pytest.raises(RuntimeError, match="Run 'python scripts/location_db_adopt.py' first"):
         anyio.run(_run_lifespan, app)
 
     get_settings.cache_clear()
+    reset_auth_db_caches()
 
 
 def test_app_start_fails_when_location_db_exists_but_is_not_adopted(
     tmp_path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
+    app_database_url = _prepare_app_db(tmp_path)
+    monkeypatch.setenv("APP_DATABASE_URL", app_database_url)
+    monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
+    monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "test-password")
     poo_database_path = tmp_path / "poo_ready.db"
     command.upgrade(_make_poo_alembic_config(f"sqlite:///{poo_database_path}"), "head")
 
@@ -70,17 +132,23 @@ def test_app_start_fails_when_location_db_exists_but_is_not_adopted(
     monkeypatch.setenv("LOCATION_DATABASE_URL", f"sqlite:///{database_path}")
     monkeypatch.setenv("POO_DATABASE_URL", f"sqlite:///{poo_database_path}")
     get_settings.cache_clear()
+    reset_auth_db_caches()
 
     app = create_app()
     with pytest.raises(RuntimeError, match="is not yet Alembic-managed"):
         anyio.run(_run_lifespan, app)
 
     get_settings.cache_clear()
+    reset_auth_db_caches()
 
 
 def test_app_start_fails_when_location_db_revision_mismatches(
     tmp_path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
+    app_database_url = _prepare_app_db(tmp_path)
+    monkeypatch.setenv("APP_DATABASE_URL", app_database_url)
+    monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
+    monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "test-password")
     poo_database_path = tmp_path / "poo_ready.db"
     command.upgrade(_make_poo_alembic_config(f"sqlite:///{poo_database_path}"), "head")
 
@@ -95,9 +163,11 @@ def test_app_start_fails_when_location_db_revision_mismatches(
     monkeypatch.setenv("LOCATION_DATABASE_URL", f"sqlite:///{database_path}")
     monkeypatch.setenv("POO_DATABASE_URL", f"sqlite:///{poo_database_path}")
     get_settings.cache_clear()
+    reset_auth_db_caches()
 
     app = create_app()
     with pytest.raises(RuntimeError, match="Location DB revision mismatch"):
         anyio.run(_run_lifespan, app)
 
     get_settings.cache_clear()
+    reset_auth_db_caches()