update function login

scripts/test/smoke.sh

@@ -30,7 +30,7 @@ PY
 }
 
 http_code() {
-  curl -s -o "$1" -w '%{http_code}' "${@:2}"
+  curl -s -o "$1" -w '%{http_code}' "${CURL_OPTS[@]}" "${@:2}"
 }
 
 assert_code() {
@@ -67,15 +67,37 @@ PY
 
 TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
+COOKIE_JAR="$TMP/cookies.txt"
+CURL_OPTS=()
 
 echo "API smoke tests → $BASE"
 echo
 
-# --- Health & static ---
+# --- Health & static (no auth) ---
 assert_code "GET /api/health" 200 "$TMP/health.json" -X GET "$BASE/api/health"
 assert_json_true "health ok" "$TMP/health.json" 'doc.get("ok") is True'
 
+assert_code "GET /api/state without auth" 401 "$TMP/state_unauth.json" -X GET "$BASE/api/state"
+
+assert_code "POST /api/auth/login bad password" 401 "$TMP/login_bad.json" \
+  -X POST "$BASE/api/auth/login" \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"Admin","password":"wrong"}'
+
+assert_code "POST /api/auth/login" 200 "$TMP/login.json" \
+  -X POST "$BASE/api/auth/login" \
+  -H 'Content-Type: application/json' \
+  -c "$COOKIE_JAR" \
+  -d '{"username":"Admin","password":"admin"}'
+assert_json_true "login user" "$TMP/login.json" 'doc.get("user",{}).get("username") == "Admin"'
+
+CURL_OPTS=(-b "$COOKIE_JAR" -c "$COOKIE_JAR")
+
+assert_code "GET /api/auth/me" 200 "$TMP/me.json" -X GET "$BASE/api/auth/me"
+assert_json_true "auth me" "$TMP/me.json" 'doc.get("user",{}).get("group_name") == "Administrators"'
+
 assert_code "GET /" 200 "$TMP/index.html" -X GET "$BASE/"
+assert_code "GET /auth.js" 200 "$TMP/auth.js" -X GET "$BASE/auth.js"
 assert_code "GET /missions.js" 200 "$TMP/missions.js" -X GET "$BASE/missions.js"
 
 assert_code "GET /api/state" 200 "$TMP/state.json" -X GET "$BASE/api/state"
@@ -107,12 +129,12 @@ echo
 assert_json_true "missions available" "$TMP/missions.json" 'len(doc.get("missions", [])) >= 1'
 
 # --- Queue pause/continue (chạy sớm, trước các test enqueue khác) ---
-curl -s -X DELETE "$BASE/api/mission_queue" -o /dev/null || true
-curl -s -X POST "$BASE/api/mission_queue" \
+curl -s "${CURL_OPTS[@]}" -X DELETE "$BASE/api/mission_queue" -o /dev/null || true
+curl -s "${CURL_OPTS[@]}" -X POST "$BASE/api/mission_queue" \
   -H 'Content-Type: application/json' \
   -d "{\"mission_id\":\"$MISSION_ID\"}" -o "$TMP/qpost.json"
 for _ in $(seq 1 30); do
-  curl -s "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
+  curl -s "${CURL_OPTS[@]}" "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
   RUNNER_STATE="$(python3 -c "import json; print(json.load(open('$TMP/runner_poll.json')).get('runner',{}).get('state',''))")"
   if [[ "$RUNNER_STATE" == "running" ]]; then
     break
@@ -127,7 +149,7 @@ if [[ "$RUNNER_STATE" == "running" ]]; then
     -X POST "$BASE/api/mission_queue/continue"
   assert_json_true "runner not paused" "$TMP/cont.json" 'doc.get("state") != "paused"'
   for _ in $(seq 1 15); do
-    curl -s "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
+    curl -s "${CURL_OPTS[@]}" "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
     RUNNER_STATE="$(python3 -c "import json; print(json.load(open('$TMP/runner_poll.json')).get('runner',{}).get('state',''))")"
     if [[ "$RUNNER_STATE" == "running" || "$RUNNER_STATE" == "paused" ]]; then
       break
@@ -138,7 +160,7 @@ if [[ "$RUNNER_STATE" == "running" ]]; then
     assert_code "POST /api/mission_queue/cancel" 200 "$TMP/cancel.json" \
       -X POST "$BASE/api/mission_queue/cancel"
     for _ in $(seq 1 40); do
-      curl -s "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
+      curl -s "${CURL_OPTS[@]}" "$BASE/api/mission_queue" -o "$TMP/runner_poll.json"
       RUNNER_STATE="$(python3 -c "import json; print(json.load(open('$TMP/runner_poll.json')).get('runner',{}).get('state',''))")"
       if [[ "$RUNNER_STATE" == "idle" ]]; then
         break
@@ -191,8 +213,8 @@ else
 fi
 
 # --- Clear queue ---
-curl -s -X DELETE "$BASE/api/mission_queue" -o /dev/null || true
-curl -s -X DELETE "$BASE/api/v2.0.0/mission_queue" -o /dev/null || true
+curl -s "${CURL_OPTS[@]}" -X DELETE "$BASE/api/mission_queue" -o /dev/null || true
+curl -s "${CURL_OPTS[@]}" -X DELETE "$BASE/api/v2.0.0/mission_queue" -o /dev/null || true
 
 # --- MiR v2 enqueue (Cách C REST) ---
 assert_code "POST /api/v2.0.0/mission_queue" 201 "$TMP/v2q.json" \
@@ -204,7 +226,7 @@ assert_json_true "v2 queue entry mission_id" "$TMP/v2q.json" \
 
 assert_code "GET /api/v2.0.0/mission_queue" 200 "$TMP/v2list.json" -X GET "$BASE/api/v2.0.0/mission_queue"
 for _ in $(seq 1 15); do
-  curl -s "$BASE/api/v2.0.0/mission_queue" -o "$TMP/v2list.json"
+  curl -s "${CURL_OPTS[@]}" "$BASE/api/v2.0.0/mission_queue" -o "$TMP/v2list.json"
   if python3 -c "import json; d=json.load(open('$TMP/v2list.json')); exit(0 if isinstance(d,list) and len(d)>=1 else 1)" 2>/dev/null; then
     break
   fi