AUTH-02 → AUTH-05: các trường hợp sai/thiếu

def test_auth_02_sai_password(api_context):
    """AUTH-02: sai password -> van HTTP 200 (khong phai 401), body {"reason": "Bad credentials"}."""
    response = api_context.post("/auth", data={"username": "admin", "password": "sai-mat-khau"})
    assert response.status == 200  # sai mat khau van tra 200, khong phai 401
    body = response.json()
    assert "token" not in body  # khong duoc cap token
    assert body.get("reason") == "Bad credentials"  # body phai bao dung ly do
 
 
def test_auth_03_sai_username(api_context):
    """AUTH-03: sai username -> giong AUTH-02, van 200 + Bad credentials."""
    response = api_context.post("/auth", data={"username": "khong-ton-tai", "password": "password123"})
    assert response.status == 200  # sai username van tra 200, khong phai 401
    body = response.json()
    assert "token" not in body  # khong duoc cap token
    assert body.get("reason") == "Bad credentials"  # body phai bao dung ly do
 
 
def test_auth_04_thieu_password(api_context):
    """AUTH-04: thieu han field password -> van 200 + Bad credentials, khong bi loi 500."""
    response = api_context.post("/auth", data={"username": "admin"})
    assert response.status == 200  # thieu password van tra 200, khong bi loi 500
    assert response.json().get("reason") == "Bad credentials"  # body phai bao dung ly do
 
 
def test_auth_05_thieu_username(api_context):
    """AUTH-05: thieu han field username -> van 200 + Bad credentials."""
    response = api_context.post("/auth", data={"password": "password123"})
    assert response.status == 200  # thieu username van tra 200
    assert response.json().get("reason") == "Bad credentials"  # body phai bao dung ly do