updates

Backend/src/tests/conftest.py

@@ -177,7 +177,7 @@ def test_staff_user(db_session, test_staff_role):
 
 @pytest.fixture
 def auth_token(client, test_user):
-    """Get authentication token for test user."""
+    """Get authentication token for test user (from cookies)."""
     response = client.post(
         "/api/auth/login",
         json={
@@ -186,13 +186,16 @@ def auth_token(client, test_user):
         }
     )
     if response.status_code == 200:
-        return response.json()["data"]["token"]
+        # Token is now in httpOnly cookie, return cookie value for testing
+        # In real usage, cookies are sent automatically
+        cookie_token = response.cookies.get("accessToken")
+        return cookie_token
     return None
 
 
 @pytest.fixture
 def admin_token(client, test_admin_user):
-    """Get authentication token for admin user."""
+    """Get authentication token for admin user (from cookies)."""
     response = client.post(
         "/api/auth/login",
         json={
@@ -201,13 +204,15 @@ def admin_token(client, test_admin_user):
         }
     )
     if response.status_code == 200:
-        return response.json()["data"]["token"]
+        # Token is now in httpOnly cookie
+        cookie_token = response.cookies.get("accessToken")
+        return cookie_token
     return None
 
 
 @pytest.fixture
 def staff_token(client, test_staff_user):
-    """Get authentication token for staff user."""
+    """Get authentication token for staff user (from cookies)."""
     response = client.post(
         "/api/auth/login",
         json={
@@ -216,21 +221,39 @@ def staff_token(client, test_staff_user):
         }
     )
     if response.status_code == 200:
-        return response.json()["data"]["token"]
+        # Token is now in httpOnly cookie
+        cookie_token = response.cookies.get("accessToken")
+        return cookie_token
     return None
 
 
 @pytest.fixture
-def authenticated_client(client, auth_token):
-    """Create an authenticated test client."""
-    client.headers.update({"Authorization": f"Bearer {auth_token}"})
+def authenticated_client(client, test_user):
+    """Create an authenticated test client (uses cookies)."""
+    # Login to set cookies
+    response = client.post(
+        "/api/auth/login",
+        json={
+            "email": "test@example.com",
+            "password": "testpassword123"
+        }
+    )
+    # Cookies are automatically sent with subsequent requests
     return client
 
 
 @pytest.fixture
-def admin_client(client, admin_token):
-    """Create an authenticated admin test client."""
-    client.headers.update({"Authorization": f"Bearer {admin_token}"})
+def admin_client(client, test_admin_user):
+    """Create an authenticated admin test client (uses cookies)."""
+    # Login to set cookies
+    response = client.post(
+        "/api/auth/login",
+        json={
+            "email": "admin@example.com",
+            "password": "adminpassword123"
+        }
+    )
+    # Cookies are automatically sent with subsequent requests
     return client