feat(auth): implement user and device authentication

backend-api/cmd/api/main_test.go

@@ -5,9 +5,13 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"net/http/httptest"
+	"path/filepath"
 	"testing"
 	"time"
 
+	"cmroubao/backend-api/internal/config"
+	"cmroubao/backend-api/internal/platform/database"
 	"cmroubao/backend-api/internal/platform/migration"
 )
 
@@ -114,6 +118,45 @@ func TestRequireCurrentMigrationsHidesStatusFailure(t *testing.T) {
 	}
 }
 
+func TestBuildRouterRegistersProtectedLogoutRoute(t *testing.T) {
+	ctx := context.Background()
+	db, err := database.Open(
+		ctx,
+		filepath.Join(t.TempDir(), "api.db"),
+	)
+	if err != nil {
+		t.Fatalf("database.Open() error = %v", err)
+	}
+	defer db.Close()
+	runner, err := migration.New(db)
+	if err != nil {
+		t.Fatalf("migration.New() error = %v", err)
+	}
+	if _, err := runner.Up(ctx); err != nil {
+		t.Fatalf("migration.Up() error = %v", err)
+	}
+	router, err := buildRouter(ctx, config.Config{
+		AssetDirectory: filepath.Join(t.TempDir(), "assets"),
+	}, db)
+	if err != nil {
+		t.Fatalf("buildRouter() error = %v", err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/logout", nil)
+	response := httptest.NewRecorder()
+
+	router.ServeHTTP(response, request)
+
+	if response.Code != http.StatusSeeOther ||
+		response.Header().Get("Location") !=
+			"/login?next=%2Ftasks" {
+		t.Fatalf(
+			"status/location = %d / %q",
+			response.Code,
+			response.Header().Get("Location"),
+		)
+	}
+}
+
 type stubMigrationStatusReader struct {
 	statuses []migration.Status
 	err      error