erp-nutzfahrzeuge/test_report.md

# Test Report - T01: Auth + User Management + RBAC + Base Frontend Layout + i18n

## Backend Tests

**Command**: `cd backend && python -m pytest tests/ --cov=app --cov-report=term-missing -v`

**Result**: 50 passed in 20.40s

### Coverage
| Module | Stmts | Miss | Cover |
|--------|-------|------|-------|
| app/routers/auth.py | 24 | 0 | 100% |
| app/routers/users.py | 35 | 1 | 97% |
| app/services/auth_service.py | 86 | 4 | 95% |
| **TOTAL** | 359 | 25 | 93% |

### Test Files
- `tests/test_health.py` (3 tests): health check, no-auth, root endpoint
- `tests/test_auth.py` (12 tests): login valid/invalid/inactive/nonexistent, refresh valid/invalid/access-rejected, me with/without/invalid/refresh token
- `tests/test_users.py` (15 tests): list admin/non-admin/no-auth, pagination, create admin/non-admin/duplicate/short-pw, update admin/nonexistent, delete soft/nonexistent/non-admin, password hash exclusion
- `tests/test_auth_service.py` (20 tests): hash/verify, get_by_email/id found/notfound, authenticate valid/wrong/inactive/nonexistent, token pair, refresh valid/invalid/nonexistent, create success/duplicate, list pagination, update success/notfound/role, deactivate success/notfound

## Frontend Tests

**Command**: `cd frontend && npx vitest run`

**Result**: 16 passed in 2.15s

### Test Files
- `tests/auth.test.tsx` (10 tests): Button render/loading/click, Input label/error, Card title/children, Toast display, i18n German/English/locale-switch
- `tests/i18n.test.tsx` (6 tests): de.json ≥20 keys, en.json ≥20 keys, matching keys, translation function, parameter interpolation, fallback for unknown keys

## TypeScript Check

**Command**: `cd frontend && npx tsc --noEmit`

**Result**: Exit 0, no errors

## Smoke Test

- Backend: FastAPI app starts, health endpoint returns {"status":"ok"}, login endpoint accepts credentials and returns JWT tokens
- Frontend: Login page renders with email/password inputs and submit button, Toast notifications work on error, i18n switches between DE/EN live
- Database: PostgreSQL test DB (erp_test) created, tables auto-created/dropped per test, all async operations work correctly
- Auth: bcrypt password hashing works, JWT access (15min) + refresh (7d) tokens generated and verified, RBAC enforces admin-only on /users endpoints