feat: persist authentication sessions in postgres

tests/test_api.py

@@ -1,6 +1,11 @@
-from fastapi.testclient import TestClient
+import hashlib
 
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+
+from pk_lab_server.db import SessionLocal
 from pk_lab_server.main import app
+from pk_lab_server.models import AuthSession
 
 
 def test_health_and_seeded_tests():
@@ -20,6 +25,17 @@ def test_login_complete_and_read_result():
         assert login.status_code == 200
         token = login.json()["token"]
         headers = {"Authorization": f"Bearer {token}"}
+        with SessionLocal() as db:
+            stored = db.scalar(
+                select(AuthSession).where(
+                    AuthSession.token_hash == hashlib.sha256(token.encode()).hexdigest()
+                )
+            )
+            assert stored is not None
+            assert stored.token_hash != token
+        assert client.get(
+            "/api/v1/me/results", headers={"Authorization": "Bearer forged-token"}
+        ).status_code == 401
         detail = client.get("/api/v1/tests/rice").json()
         left, right = detail["candidates"][:2]
         created = client.post(
@@ -43,4 +59,5 @@ def test_login_complete_and_read_result():
         assert created.status_code == 201, created.text
         history = client.get("/api/v1/me/results?test_slug=rice", headers=headers).json()
         assert history[0]["champion_name"] == "蛋炒饭"
-
+        assert client.post("/api/v1/auth/logout", headers=headers).status_code == 204
+        assert client.get("/api/v1/me/results", headers=headers).status_code == 401