Feature: JWT Token Validation

  Scenario: Valid JWT token grants access
    Given a JWT token signed with the correct secret
    And the token has not expired
    And the token contains valid claims (sub, exp, iat)
    When I make a request with the token in Authorization header
    Then the request should return status 200
    And the user context should be populated from token claims

  Scenario: Expired JWT token is rejected
    Given a JWT token that expired 1 hour ago
    When I make a request with the expired token
    Then the request should return status 401
    And the response should indicate "Token has expired"

  Scenario: JWT with invalid signature is rejected
    Given a JWT token signed with an incorrect secret
    When I make a request with the invalid token
    Then the request should return status 401
    And the response should indicate "Invalid token signature"

  Scenario: JWT with missing required claims is rejected
    Given a JWT token without the "sub" claim
    When I make a request with the token
    Then the request should return status 401
    And the response should indicate "Invalid token claims"

  Scenario: JWT extracted from cookie when header missing
    Given a valid JWT token stored in the "jwt_token" cookie
    And no Authorization header is present
    When I make a request with the cookie
    Then the request should return status 200
    And the user should be authenticated from the cookie token

  Scenario Outline: JWT audience/issuer validation
    Given REQUIRE_TOKEN_EXPIRATION is <exp_required>
    And a JWT token with <token_state>
    When I make a request with the token
    Then the request should return status <status>

    Examples:
      | exp_required | token_state      | status |
      | true         | no exp claim     | 401    |
      | false        | no exp claim     | 200    |
      | true         | valid exp claim  | 200    |

Feature: Basic Authentication

  Scenario: Valid Basic Auth credentials grant access
    Given BASIC_AUTH_USER is "admin"
    And BASIC_AUTH_PASSWORD is "secure-password-123"
    When I make a request with Authorization: Basic <base64(admin:secure-password-123)>
    Then the request should return status 200
    And the user should be authenticated as admin

  Scenario: Invalid Basic Auth password is rejected
    Given BASIC_AUTH_USER is "admin"
    And BASIC_AUTH_PASSWORD is "secure-password-123"
    When I make a request with Authorization: Basic <base64(admin:wrong-password)>
    Then the request should return status 401
    And the response should indicate "Invalid credentials"

  Scenario: Invalid Basic Auth username is rejected
    Given BASIC_AUTH_USER is "admin"
    When I make a request with Authorization: Basic <base64(wronguser:any-password)>
    Then the request should return status 401

  Scenario: Malformed Basic Auth header is rejected
    When I make a request with Authorization: Basic not-valid-base64!!!
    Then the request should return status 401
    And the response should indicate "Invalid authorization header"

  Scenario: Basic Auth with empty password is rejected
    When I make a request with Authorization: Basic <base64(admin:)>
    Then the request should return status 401

  Scenario: Basic Auth header without credentials is rejected
    When I make a request with Authorization: Basic
    Then the request should return status 401

Feature: API Token Authentication

  Scenario: Valid API token in Authorization: Bearer header grants access
    Given an active API token exists in the database
    When I make a request with Authorization: Bearer <token-value>
    Then the request should return status 200
    And the user context should match the token owner

  Scenario: Valid API token in Authorization Bearer header grants access
    Given an active API token exists in the database
    When I make a request with Authorization: Bearer <token-value>
    Then the request should return status 200

  Scenario: Revoked API token is rejected
    Given an API token that has been revoked
    When I make a request with the revoked token
    Then the request should return status 401
    And the response should indicate "Token revoked"

  Scenario: Expired API token is rejected
    Given an API token with expires_at in the past
    When I make a request with the expired token
    Then the request should return status 401
    And the response should indicate "Token expired"

  Scenario: Non-existent API token is rejected
    When I make a request with Authorization: Bearer non-existent-token-12345
    Then the request should return status 401
    And the response should indicate "Invalid token"

  Scenario: Inactive API token is rejected
    Given an API token with is_active=false
    When I make a request with the inactive token
    Then the request should return status 401

  Scenario: API token usage is logged
    Given a valid API token
    When I make a request with the token
    Then a TokenUsageLog entry should be created
    And the entry should include timestamp, endpoint, and IP address

Feature: Email/Password Authentication

  Scenario: Valid email and password grants access
    Given a user exists with email "user@example.com"
    And the user's password is "ValidPass123!"
    When I POST to /auth/login with email and password
    Then the request should return status 200
    And the response should contain a JWT access token
    And the response should contain a refresh token

  Scenario: Invalid password is rejected
    Given a user exists with email "user@example.com"
    When I POST to /auth/login with email and wrong password
    Then the request should return status 401
    And the response should indicate "Invalid credentials"
    And an EmailAuthEvent should be logged with success=false

  Scenario: Non-existent email is rejected
    When I POST to /auth/login with email "nobody@example.com"
    Then the request should return status 401
    And the response should indicate "Invalid credentials"
    And the error should NOT reveal that the email doesn't exist

  Scenario: Inactive user cannot login
    Given a user exists with is_active=false
    When I POST to /auth/login with the user's credentials
    Then the request should return status 401
    And the response should indicate "Account disabled"

  Scenario: Password change required redirects appropriately
    Given a user with password_change_required=true
    When I POST to /auth/login with valid credentials
    Then the request should return status 200
    And the response should include password_change_required=true
    And limited access should be granted until password is changed

  Scenario: Successful login logs authentication event
    Given a valid user
    When I POST to /auth/login with valid credentials
    Then an EmailAuthEvent should be created
    And the event should include client_ip and user_agent
    And the event should have success=true

  Scenario: Failed login attempts are tracked
    Given a valid user
    When I POST to /auth/login with wrong password 5 times
    Then 5 EmailAuthEvent entries should be created with success=false
    And the security logger should detect potential brute force

Feature: Proxy Header Authentication

  Scenario: Trusted proxy header authenticates user
    Given TRUST_PROXY_AUTH is true
    And PROXY_USER_HEADER is "X-Authenticated-User"
    When I make a request with X-Authenticated-User: admin@example.com
    Then the request should be authenticated as admin@example.com

  Scenario: Proxy header ignored when trust disabled
    Given TRUST_PROXY_AUTH is false
    When I make a request with X-Authenticated-User: admin@example.com
    Then the request should return status 401
    And proxy headers should be ignored

  Scenario: Platform admin email grants admin access
    Given TRUST_PROXY_AUTH is true
    And PLATFORM_ADMIN_EMAIL is "superadmin@example.com"
    When I make a request with X-Authenticated-User: superadmin@example.com
    Then the user should have is_admin=true

  Scenario: Empty proxy header is rejected
    Given TRUST_PROXY_AUTH is true
    When I make a request with X-Authenticated-User: (empty)
    Then the request should return status 401

  Scenario: Malformed email in proxy header is rejected
    Given TRUST_PROXY_AUTH is true
    When I make a request with X-Authenticated-User: not-an-email
    Then the request should return status 401
    And the response should indicate "Invalid user identifier"

Feature: Authentication Failure Handling

  Scenario: No authentication provided returns 401
    Given AUTH_REQUIRED is true
    When I make a request without any authentication
    Then the request should return status 401
    And the response should indicate "Authentication required"

  Scenario: Error messages don't reveal internal details
    When I make a request with an invalid JWT token
    Then the response should NOT contain stack traces
    And the response should NOT contain internal error messages
    And the response should NOT contain file paths

  Scenario: Authentication errors are logged
    When authentication fails for any reason
    Then the failure should be logged with:
      | Field | Value |
      | level | WARNING or ERROR |
      | reason | failure type |
      | client_ip | request IP |
      | endpoint | request path |

  Scenario: Multiple auth methods tried in order
    Given a request with both Authorization header and Authorization: Bearer
    When the request is processed
    Then Bearer token should be tried first
    And API key should be tried if Bearer fails
    And the first successful auth should be used

  Scenario: Malformed Authorization header type is rejected
    When I make a request with Authorization: Digest abc123
    Then the request should return status 401
    And only Bearer and Basic types should be accepted