test: add auth and session unit tests (20 test cases)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/auth.rs

@@ -234,6 +234,86 @@ fn validate_password_strength(password: &str) -> Result<()> {
     Ok(())
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_setup_user_and_verify_password() {
+        let dir = tempfile::tempdir().unwrap();
+        let auth = AuthManager::new(dir.path().to_path_buf());
+
+        assert!(!auth.is_setup().await.unwrap());
+
+        auth.setup_user("password123").await.unwrap();
+
+        assert!(auth.is_setup().await.unwrap());
+        assert!(auth.verify_password("password123").await.unwrap());
+        assert!(!auth.verify_password("wrong").await.unwrap());
+    }
+
+    #[tokio::test]
+    async fn test_verify_password_no_user() {
+        let dir = tempfile::tempdir().unwrap();
+        let auth = AuthManager::new(dir.path().to_path_buf());
+
+        assert!(!auth.verify_password("anything").await.unwrap());
+    }
+
+    #[tokio::test]
+    async fn test_onboarding_lifecycle() {
+        let dir = tempfile::tempdir().unwrap();
+        let auth = AuthManager::new(dir.path().to_path_buf());
+
+        assert!(!auth.is_onboarding_complete().await.unwrap());
+
+        auth.complete_onboarding().await.unwrap();
+        assert!(auth.is_onboarding_complete().await.unwrap());
+
+        auth.reset_onboarding().await.unwrap();
+        assert!(!auth.is_onboarding_complete().await.unwrap());
+    }
+
+    #[tokio::test]
+    async fn test_onboarding_persists_to_user() {
+        let dir = tempfile::tempdir().unwrap();
+        let auth = AuthManager::new(dir.path().to_path_buf());
+
+        auth.setup_user("password123").await.unwrap();
+        let user = auth.get_user().await.unwrap().unwrap();
+        assert!(!user.onboarding_complete);
+
+        auth.complete_onboarding().await.unwrap();
+        let user = auth.get_user().await.unwrap().unwrap();
+        assert!(user.onboarding_complete);
+    }
+
+    #[test]
+    fn test_validate_password_strength_valid() {
+        assert!(validate_password_strength("MyP@ssw0rd!123").is_ok());
+    }
+
+    #[test]
+    fn test_validate_password_strength_too_short() {
+        assert!(validate_password_strength("Ab1!").is_err());
+    }
+
+    #[test]
+    fn test_validate_password_strength_no_uppercase() {
+        assert!(validate_password_strength("mypassword1!xx").is_err());
+    }
+
+    #[test]
+    fn test_validate_password_strength_no_digit() {
+        assert!(validate_password_strength("MyPassword!!xx").is_err());
+    }
+
+    #[test]
+    fn test_validate_password_strength_no_special() {
+        assert!(validate_password_strength("MyPassword1234").is_err());
+    }
+}
+
 /// Change the archipelago user's SSH/login password.
 /// Uses usermod + openssl to bypass PAM (avoids "Authentication token manipulation" errors).
 /// Uses absolute paths (/usr/bin/openssl, /usr/sbin/usermod) for systemd's minimal PATH.