# Auth Testing Playbook — Em Tiyatro Admin

## Credentials
- admin@emtiyatro.com / admin123 (seeded on startup, .env password change aware)

## Step 1: MongoDB Verification
```
mongosh
use test_database
db.users.find({role: "admin"}).pretty()
```
Verify: password_hash starts with `$2b$`, unique index on users.email, index on login_attempts.identifier.

## Step 2: API Testing
```
curl -c cookies.txt -X POST http://localhost:8001/api/auth/login -H "Content-Type: application/json" -d '{"email":"admin@emtiyatro.com","password":"admin123"}'
curl -b cookies.txt http://localhost:8001/api/auth/me
# Or Bearer:
TOKEN=$(curl -s -X POST http://localhost:8001/api/auth/login -H "Content-Type: application/json" -d '{"email":"admin@emtiyatro.com","password":"admin123"}' | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
curl -H "Authorization: Bearer $TOKEN" http://localhost:8001/api/admin/summary
```

## Notes
- Brute force: 5 failed attempts per ip:email → 15 min lockout (HTTP 429)
- Token: 12h access token (HS256), no refresh token (single-admin panel)
- Frontend stores token in localStorage `admin_token`, sends Bearer header