Refactor authentication routes to use '/auth' prefix in API calls

backend/tests/test_child_api.py

@@ -29,7 +29,7 @@ def add_test_user():
     })
 
 def login_and_set_cookie(client):
-    resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
+    resp = client.post('/auth/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
     assert resp.status_code == 200
     # Set cookie for subsequent requests
     token = resp.headers.get("Set-Cookie")
@@ -40,7 +40,7 @@ def login_and_set_cookie(client):
 def client():
     app = Flask(__name__)
     app.register_blueprint(child_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     with app.test_client() as client:

backend/tests/test_child_override_api.py

@@ -46,7 +46,7 @@ def add_test_user():
 
 def login_and_set_cookie(client):
     """Login and set authentication cookie."""
-    resp = client.post('/login', json={
+    resp = client.post('/auth/login', json={
         "email": TEST_EMAIL,
         "password": TEST_PASSWORD
     })
@@ -59,7 +59,7 @@ def client():
     app = Flask(__name__)
     app.register_blueprint(child_override_api)
     app.register_blueprint(child_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     

backend/tests/test_image_api.py

@@ -36,7 +36,7 @@ def add_test_user():
     })
 
 def login_and_set_cookie(client):
-    resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
+    resp = client.post('/auth/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
     assert resp.status_code == 200
     token = resp.headers.get("Set-Cookie")
     assert token and "token=" in token
@@ -65,7 +65,7 @@ def remove_test_data():
 def client():
     app = Flask(__name__)
     app.register_blueprint(image_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     with app.test_client() as c:

backend/tests/test_reward_api.py

@@ -28,7 +28,7 @@ def add_test_user():
     })
 
 def login_and_set_cookie(client):
-    resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
+    resp = client.post('/auth/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
     assert resp.status_code == 200
     token = resp.headers.get("Set-Cookie")
     assert token and "token=" in token
@@ -37,7 +37,7 @@ def login_and_set_cookie(client):
 def client():
     app = Flask(__name__)
     app.register_blueprint(reward_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     with app.test_client() as client:

backend/tests/test_task_api.py

@@ -27,7 +27,7 @@ def add_test_user():
     })
 
 def login_and_set_cookie(client):
-    resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
+    resp = client.post('/auth/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
     assert resp.status_code == 200
     token = resp.headers.get("Set-Cookie")
     assert token and "token=" in token
@@ -36,7 +36,7 @@ def login_and_set_cookie(client):
 def client():
     app = Flask(__name__)
     app.register_blueprint(task_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     with app.test_client() as client:

backend/tests/test_user_api.py

@@ -48,7 +48,7 @@ def add_test_users():
 
 def login_and_get_token(client, email, password):
     """Login and extract JWT token from response."""
-    resp = client.post('/login', json={"email": email, "password": password})
+    resp = client.post('/auth/login', json={"email": email, "password": password})
     assert resp.status_code == 200
     # Extract token from Set-Cookie header
     set_cookie = resp.headers.get("Set-Cookie")
@@ -61,7 +61,7 @@ def client():
     """Setup Flask test client with registered blueprints."""
     app = Flask(__name__)
     app.register_blueprint(user_api)
-    app.register_blueprint(auth_api)
+    app.register_blueprint(auth_api, url_prefix='/auth')
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'supersecretkey'
     app.config['FRONTEND_URL'] = 'http://localhost:5173'  # Needed for email_sender
@@ -100,7 +100,7 @@ def test_mark_user_for_deletion_success(authenticated_client):
 
 def test_login_for_marked_user_returns_403(client):
     """Test that login for a marked-for-deletion user returns 403 Forbidden."""
-    response = client.post('/login', json={
+    response = client.post('/auth/login', json={
         "email": MARKED_EMAIL,
         "password": MARKED_PASSWORD
     })
@@ -118,7 +118,7 @@ def test_mark_for_deletion_requires_auth(client):
 
 def test_login_blocked_for_marked_user(client):
     """Test that login is blocked for users marked for deletion."""
-    response = client.post('/login', json={
+    response = client.post('/auth/login', json={
         "email": MARKED_EMAIL,
         "password": MARKED_PASSWORD
     })
@@ -129,7 +129,7 @@ def test_login_blocked_for_marked_user(client):
 
 def test_login_succeeds_for_unmarked_user(client):
     """Test that login works normally for users not marked for deletion."""
-    response = client.post('/login', json={
+    response = client.post('/auth/login', json={
         "email": TEST_EMAIL,
         "password": TEST_PASSWORD
     })
@@ -139,7 +139,7 @@ def test_login_succeeds_for_unmarked_user(client):
 
 def test_password_reset_ignored_for_marked_user(client):
     """Test that password reset requests return 403 for marked users."""
-    response = client.post('/request-password-reset', json={"email": MARKED_EMAIL})
+    response = client.post('/auth/request-password-reset', json={"email": MARKED_EMAIL})
     assert response.status_code == 403
     data = response.get_json()
     assert 'error' in data
@@ -147,7 +147,7 @@ def test_password_reset_ignored_for_marked_user(client):
 
 def test_password_reset_works_for_unmarked_user(client):
     """Test that password reset works normally for unmarked users."""
-    response = client.post('/request-password-reset', json={"email": TEST_EMAIL})
+    response = client.post('/auth/request-password-reset', json={"email": TEST_EMAIL})
     assert response.status_code == 200
     data = response.get_json()
     assert 'message' in data