From 5151b32f3e43f964a9c1e69ddfdbbe83e88376ef Mon Sep 17 00:00:00 2001
From: Colin Maudry <colin@maudry.com>
Date: Mon, 20 Apr 2026 22:56:58 +0200
Subject: [PATCH] =?UTF-8?q?tests/auth/test=5Fcsrf.py=20:=20v=C3=A9rifie=20?=
 =?UTF-8?q?que=20CSRF=20est=20actif=20(#73)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 tests/auth/test_csrf.py | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 tests/auth/test_csrf.py

diff --git a/tests/auth/test_csrf.py b/tests/auth/test_csrf.py
new file mode 100644
index 0000000..c03839d
--- /dev/null
+++ b/tests/auth/test_csrf.py
@@ -0,0 +1,31 @@
+import pytest
+from flask import Flask
+
+from src.auth.setup import init_auth
+
+
+@pytest.fixture
+def csrf_app(users_db_path, monkeypatch):
+    monkeypatch.setenv("WTF_CSRF_ENABLED", "True")
+    monkeypatch.setenv("SECRET_KEY", "test-secret-key")
+    app = Flask(__name__)
+    app.config["WTF_CSRF_ENABLED"] = True
+    init_auth(app)
+    return app
+
+
+@pytest.fixture
+def csrf_client(csrf_app):
+    return csrf_app.test_client()
+
+
+def test_post_without_csrf_rejected(csrf_client, users_db_path):
+    resp = csrf_client.post(
+        "/auth/signup",
+        data={
+            "email": "a@b.c",
+            "password": "password12",
+            "password_confirm": "password12",
+        },
+    )
+    assert resp.status_code == 400  # CSRF failed