4.5Security Checks

def test_auth_error_no_info_leakage(base_url):
    """Error responses should not reveal whether email exists."""
    r1 = requests.post(f"{base_url}/auth/login",
        json={"email": "exists@test.com", "password": "wrong"})
    r2 = requests.post(f"{base_url}/auth/login",
        json={"email": "nonexistent@test.com", "password": "wrong"})
    # Both should return the same error message (no user enumeration)
    assert r1.json().get("message") == r2.json().get("message")

def test_brute_force_protection(base_url):
    """Multiple failed logins should trigger rate limiting or lockout."""
    for i in range(10):
        r = requests.post(f"{base_url}/auth/login",
            json={"email": "target@test.com", "password": f"wrong{i}"})
        if r.status_code == 429:
            break
    assert r.status_code == 429 or r.status_code == 423  # Rate limited or locked