feat: add login, session cookies, and get_current_user

backend/tests/test_auth.py

@@ -19,3 +19,28 @@ async def test_register_duplicate_username_rejected(client):
     await client.post("/auth/register", json={"username": "medium1", "password": "spookyspooky"})
     response = await client.post("/auth/register", json={"username": "medium1", "password": "anotherpass"})
     assert response.status_code == 409
+
+
+@pytest.mark.asyncio
+async def test_login_sets_cookie_and_me_returns_user(client):
+    await client.post("/auth/register", json={"username": "medium2", "password": "spookyspooky"})
+    login_resp = await client.post("/auth/login", json={"username": "medium2", "password": "spookyspooky"})
+    assert login_resp.status_code == 200
+    assert "qm_session" in login_resp.cookies
+
+    me_resp = await client.get("/auth/me")
+    assert me_resp.status_code == 200
+    assert me_resp.json()["username"] == "medium2"
+
+
+@pytest.mark.asyncio
+async def test_login_wrong_password_rejected(client):
+    await client.post("/auth/register", json={"username": "medium3", "password": "spookyspooky"})
+    response = await client.post("/auth/login", json={"username": "medium3", "password": "wrongpass"})
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_me_without_cookie_rejected(client):
+    response = await client.get("/auth/me")
+    assert response.status_code == 401