Backend and frontend testing stacks (pytest + vitest) and a few initial tests.

backend/apps/accounts/tests/test_otp_limits.py

@@ -0,0 +1,13 @@
+import pytest
+from django.test import override_settings
+
+from apps.accounts.models import OtpChannel
+from apps.accounts.services.otp import OtpRateLimitError, create_and_send_otp
+
+
+@pytest.mark.django_db
+@override_settings(OTP_MAX_PER_WINDOW=1, OTP_WINDOW_MINUTES=15, OTP_RESEND_COOLDOWN_SECONDS=0)
+def test_otp_rate_limit():
+    create_and_send_otp("+966512345678", OtpChannel.SMS)
+    with pytest.raises(OtpRateLimitError):
+        create_and_send_otp("+966512345678", OtpChannel.SMS)

backend/apps/accounts/tests/test_phone.py

@@ -0,0 +1,21 @@
+import pytest
+
+from apps.accounts.services.phone import normalize_phone_number
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        ("+966512345678", "+966512345678"),
+        ("0512345678", "+966512345678"),
+        ("512345678", "+966512345678"),
+        ("00966512345678", "+966512345678"),
+    ],
+)
+def test_normalize_phone_number_valid(raw, expected):
+    assert normalize_phone_number(raw) == expected
+
+
+def test_normalize_phone_number_invalid():
+    with pytest.raises(ValueError):
+        normalize_phone_number("12345")

backend/apps/accounts/tests/test_phone_auth.py

@@ -0,0 +1,31 @@
+import pytest
+from django.urls import reverse
+
+from apps.accounts.models import PhoneOTP, User
+
+
+@pytest.mark.django_db
+def test_phone_auth_creates_user_and_issues_tokens(client):
+    request_url = reverse("phone_auth_request")
+    verify_url = reverse("phone_auth_verify")
+
+    response = client.post(
+        request_url,
+        {"phone_number": "0512345678", "channel": "sms", "first_name": "Sara"},
+        content_type="application/json",
+    )
+    assert response.status_code == 201
+    request_id = response.json()["request_id"]
+
+    otp = PhoneOTP.objects.filter(phone_number="+966512345678").order_by("-created_at").first()
+    assert otp is not None
+    assert str(otp.id) == request_id
+
+    bad = client.post(
+        verify_url,
+        {"request_id": request_id, "code": "000000"},
+        content_type="application/json",
+    )
+    assert bad.status_code == 400
+
+    assert User.objects.filter(phone_number="+966512345678").exists()

backend/pytest.ini

@@ -0,0 +1,4 @@
+[pytest]
+DJANGO_SETTINGS_MODULE = salon_api.settings
+python_files = tests.py test_*.py *_tests.py
+addopts = -q

backend/requirements-dev.txt

@@ -0,0 +1,2 @@
+pytest>=8.0
+pytest-django>=4.8