first round of review

backend/tests/test_auth.py

@@ -6,7 +6,9 @@ users will create invites first via the helper function.
 import pytest
 
 from auth import COOKIE_NAME
-from tests.helpers import unique_email, create_invite_for_registration
+from models import ROLE_REGULAR
+from tests.helpers import unique_email, create_invite_for_godfather
+from tests.conftest import create_user_with_roles
 
 
 # Registration tests (with invite)
@@ -15,9 +17,10 @@ async def test_register_success(client_factory):
     """Can register with valid invite code."""
     email = unique_email("register")
     
-    # Create invite
+    # Create godfather user and invite
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("godfather"))
+        godfather = await create_user_with_roles(db, unique_email("godfather"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     response = await client_factory.post(
         "/api/auth/register",
@@ -44,10 +47,11 @@ async def test_register_duplicate_email(client_factory):
     """Cannot register with already-used email."""
     email = unique_email("duplicate")
     
-    # Create two invites
+    # Create godfather and two invites
     async with client_factory.get_db_session() as db:
-        invite1 = await create_invite_for_registration(db, unique_email("gf1"))
-        invite2 = await create_invite_for_registration(db, unique_email("gf2"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite1 = await create_invite_for_godfather(db, godfather.id)
+        invite2 = await create_invite_for_godfather(db, godfather.id)
     
     # First registration
     await client_factory.post(
@@ -76,7 +80,8 @@ async def test_register_duplicate_email(client_factory):
 async def test_register_invalid_email(client_factory):
     """Cannot register with invalid email format."""
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     response = await client_factory.post(
         "/api/auth/register",
@@ -133,7 +138,8 @@ async def test_login_success(client_factory):
     email = unique_email("login")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     await client_factory.post(
         "/api/auth/register",
@@ -161,7 +167,8 @@ async def test_login_wrong_password(client_factory):
     email = unique_email("wrongpass")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     await client_factory.post(
         "/api/auth/register",
@@ -214,7 +221,8 @@ async def test_get_me_success(client_factory):
     email = unique_email("me")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     reg_response = await client_factory.post(
         "/api/auth/register",
@@ -269,7 +277,8 @@ async def test_cookie_from_register_works_for_me(client_factory):
     email = unique_email("tokentest")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     reg_response = await client_factory.post(
         "/api/auth/register",
@@ -294,7 +303,8 @@ async def test_cookie_from_login_works_for_me(client_factory):
     email = unique_email("logintoken")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     await client_factory.post(
         "/api/auth/register",
@@ -325,8 +335,9 @@ async def test_multiple_users_isolated(client_factory):
     email2 = unique_email("user2")
     
     async with client_factory.get_db_session() as db:
-        invite1 = await create_invite_for_registration(db, unique_email("gf1"))
-        invite2 = await create_invite_for_registration(db, unique_email("gf2"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite1 = await create_invite_for_godfather(db, godfather.id)
+        invite2 = await create_invite_for_godfather(db, godfather.id)
     
     resp1 = await client_factory.post(
         "/api/auth/register",
@@ -366,7 +377,8 @@ async def test_password_is_hashed(client_factory):
     email = unique_email("hashtest")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     await client_factory.post(
         "/api/auth/register",
@@ -389,7 +401,8 @@ async def test_case_sensitive_password(client_factory):
     email = unique_email("casetest")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     await client_factory.post(
         "/api/auth/register",
@@ -413,7 +426,8 @@ async def test_logout_success(client_factory):
     email = unique_email("logout")
     
     async with client_factory.get_db_session() as db:
-        invite_code = await create_invite_for_registration(db, unique_email("gf"))
+        godfather = await create_user_with_roles(db, unique_email("gf"), "pass123", [ROLE_REGULAR])
+        invite_code = await create_invite_for_godfather(db, godfather.id)
     
     reg_response = await client_factory.post(
         "/api/auth/register",