From 5f00cb6844744de961eb87c7f25d61a03997e759 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 10 Sep 2025 18:16:51 +0200
Subject: [PATCH 01/16] refactor: cleaning up check_password bcrypt/argon2
 implementation

---
 server/user/models.py | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/server/user/models.py b/server/user/models.py
index 8de25367..a611200a 100644
--- a/server/user/models.py
+++ b/server/user/models.py
@@ -13,25 +13,32 @@ class User(Base):
     def set_password(self, password):
         self.password = argon2.generate_password_hash(password)
 
-    def check_password(self, passwd):
+    def check_password(self, password):
         """
         Check if the passwordhash  is in Argon2 or Bcrypt(old) format
         Resets the password hash to argon2 format if stored in bcrypt
         Returns value for login route
         """
+
+        # check password (if bcrypt hash)
+        try:
+            if bcrypt.check_password_hash(self.password, password):
+                self.set_password(password)
+                # pwd in bcrypt form and correct
+                return True
+        except ValueError as error:
+            print(error)
+
+        # check password (if argon2 hash)
         try:
-            if bcrypt.check_password_hash(self.password, passwd):
-                bpass = True
+            if argon2.check_password_hash(self.password, password):
+                self.set_password(password)
+                # pwd in argon2 form and correct
+                return True
         except ValueError as error:
             print(error)
-            bpass = False
-        if argon2.check_password_hash(self.password, passwd):
-            return True
-        elif not argon2.check_password_hash(self.password, passwd) and not bpass:
-            return False
-        elif not argon2.check_password_hash(self.password, passwd) and bpass:
-            self.set_password(passwd)
-            return True
+
+        return False
 
     def update_bio(self, new_bio):
         self.bio = new_bio

From 43721502f71d84280136bcb6e45daa2c5d623aa6 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Mon, 15 Sep 2025 12:56:10 +0200
Subject: [PATCH 02/16] refactor: standardizing signin response message

---
 server/src/client/app/src/pages/auth/SignIn.js | 6 +++---
 server/user/views.py                           | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignIn.js b/server/src/client/app/src/pages/auth/SignIn.js
index 7f5f17ea..f59a5799 100755
--- a/server/src/client/app/src/pages/auth/SignIn.js
+++ b/server/src/client/app/src/pages/auth/SignIn.js
@@ -46,11 +46,11 @@ function SignIn() {
       })
       .then(response => {
         console.log(response.data);
-        if (response.data.msg === "NotConfirmed") {
+        if (response.data.msg === "UserNotConfirmed") {
           setConfirm(true);
-        } else if (response.data.msg === "Wrong username or password") {
+        } else if (response.data.msg === "WrongUsernameOrPassword") {
           setNotExist(true);
-        } else if (response.data.msg === "wrong password") {
+        } else if (response.data.msg === "WrongPassword") {
           setWrongPass(true);
         } else {
           localStorage.setItem("token", response.data.access_token);
diff --git a/server/user/views.py b/server/user/views.py
index 05b21b8d..ddc527fc 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -55,16 +55,16 @@ def login():
         user = session.query(User).filter_by(username=jobj["email"]).first()
         print(jobj)
         if user is None:
-            print("user does not exist")
-            return jsonify({"msg": "Wrong username or password"}), 200
+            print("User does not exist")
+            return jsonify({"msg": "WrongUsernameOrPassword"}), 200
 
         elif not user.check_password(jobj["password"]):
             print("Wrong password")
-            return jsonify({"msg": "wrong password"}), 200
+            return jsonify({"msg": "WrongPassword"}), 200
 
         elif user.active == 0:
             print("User not confirmed")
-            return jsonify({"msg": "NotConfirmed"}), 200
+            return jsonify({"msg": "UserNotConfirmed"}), 200
 
         else:
             user_g = session.query(UserGroups).filter_by(user_id=user.id).first()

From 595447c649178f510cc0a4e65c4649805b929232 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Mon, 15 Sep 2025 13:09:18 +0200
Subject: [PATCH 03/16] refactor: minor SignUp cleanup

---
 .../src/client/app/src/pages/auth/SignIn.js   | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignIn.js b/server/src/client/app/src/pages/auth/SignIn.js
index f59a5799..68724925 100755
--- a/server/src/client/app/src/pages/auth/SignIn.js
+++ b/server/src/client/app/src/pages/auth/SignIn.js
@@ -75,12 +75,15 @@ function SignIn() {
       )}
       <Grid item md={7} xs={10}>
         <Wrapper>
+          {/** Header **/}
           <Typography component="h1" variant="h4" align="center" gutterBottom>
             Welcome back!
           </Typography>
           <Typography component="h2" variant="body1" align="center">
             Sign in to continue
           </Typography>
+
+          {/** Start Error Banner **/}
           {errorlog && (
             <Typography component="h3" align="center" style={{ color: "red" }}>
               <FontAwesomeIcon
@@ -90,7 +93,8 @@ function SignIn() {
               {errormsg}
             </Typography>
           )}
-          {wrongpass && (
+          {/* User with this email & password could not be found */}
+          {(wrongpass || notexist) && (
             <Typography component="h3" align="center" style={{ color: "red" }}>
               <FontAwesomeIcon
                 icon="exclamation-triangle"
@@ -99,6 +103,7 @@ function SignIn() {
               Wrong username or password
             </Typography>
           )}
+          {/* User's account not yet confirmed */}
           {confirmflag && (
             <Typography
               component="h3"
@@ -110,15 +115,9 @@ function SignIn() {
               <a href="/auth/confirmation-token">(resend activation token)</a>
             </Typography>
           )}
-          {notexist && (
-            <Typography component="h3" align="center" style={{ color: "red" }}>
-              <FontAwesomeIcon
-                icon="exclamation-triangle"
-                style={{ marginRight: 5 }}
-              />
-              Wrong username or password
-            </Typography>
-          )}
+          {/** End Error Banner **/}
+
+          {/** Start Entry Fields **/}
           <form onSubmit={sendtoflask}>
             <FormControl margin="normal" required fullWidth>
               <InputLabel htmlFor="email">Email Address</InputLabel>
@@ -156,6 +155,7 @@ function SignIn() {
               Forgot password
             </Button>
           </form>
+          {/** End Entry Fields **/}
         </Wrapper>
       </Grid>
       <Grid item md={7} xs={10}>

From 4600cd5930ed53510889afc7d498da558476a287 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 17 Sep 2025 19:54:05 +0200
Subject: [PATCH 04/16] refactor/fix: expanding login tests and fixing login()

---
 server/user/views.py      |   2 +-
 tests/test_user_routes.py | 152 ++++++++++++++++++++++++++++++--------
 2 files changed, 123 insertions(+), 31 deletions(-)

diff --git a/server/user/views.py b/server/user/views.py
index ddc527fc..b7daf4da 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -52,7 +52,7 @@ def login():
     jobj = request.get_json()
     with Session() as session:
         # need to inspect jobj. Is `email` actually username or is there also a `username`?
-        user = session.query(User).filter_by(username=jobj["email"]).first()
+        user = session.query(User).filter_by(email=jobj["email"]).first()
         print(jobj)
         if user is None:
             print("User does not exist")
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index e7fccf9b..7f265c5e 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -6,34 +6,112 @@
 from server.user.models import User
 
 
-@pytest.fixture(scope="module")
-def test_user():
-    user1 = User(email="abc@abc.com", username="abc")
-    user1.set_password("abcabc")
-    with Session() as session:
-        session.add(user1)
+@pytest.fixture
+def db_session(test_client, valid_user, unconfirmed_user):
+    # setup
+    session = Session()
+    session.add(valid_user)
+    session.add(unconfirmed_user)
+    session.commit()
+    
+    try:
+        # test
+        yield session
+    finally:
+        # cleanup
+        session.delete(valid_user)
+        session.delete(unconfirmed_user)
         session.commit()
-        yield
 
 
-def test_confirm_user(test_client, init_database):
-    with Session() as session:
-        user = session.query(User).filter_by(email="ff@ff.com").first()
-    url = "?token=" + str(user.activation_code)
+@pytest.fixture(scope="function")
+def valid_user():
+    user = User(
+        email="abc@abc.com",
+        username="abc",
+        ip_address="1.2.3.4",
+        created_on="0000",
+        company="0000",
+        country="0000",
+        bio="No Bio",
+        active=1
+    )
+    user.set_password("abcabc")
+    
+    return user
+
+
+@pytest.fixture(scope="function")
+def unconfirmed_user():
+    user = User(
+        email="ff@ff.com",
+        username="ff",
+        ip_address="1.2.3.4",
+        created_on="0000",
+        company="0000",
+        country="0000",
+        bio="No Bio",
+        active=0
+    )
+    user.set_password("ff")
+    
+    return user
+
+
+def login(test_client, email, password):
     response = test_client.post(
-        "/confirmation", json={"url": url, "password": "ff"}, follow_redirects=True
+        "/login", json={"email": email, "password": password}, follow_redirects=True
     )
-    assert response.status_code == 200
+    return response
 
 
-def test_login(test_client, init_database):
+def test_confirm_user(test_client, init_database, unconfirmed_user):
+    url = "?token=" + str(unconfirmed_user.activation_code)
     response = test_client.post(
-        "/login", json={"email": "ff@ff.com", "password": "ff"}, follow_redirects=True
+        "/confirmation", json={"url": url, "password": "ff"}, follow_redirects=True
     )
     assert response.status_code == 200
 
 
-def test_profile(test_client, init_database):
+def test_login(test_client, init_database, db_session, valid_user):
+    response = login(test_client, valid_user.email, "abcabc")
+
+    user = db_session.query(User).filter_by(email=valid_user.email).first()
+
+    assert response.json["access_token"]
+    assert response.status_code == 200
+
+
+def test_login_wrong_password(test_client, init_database, db_session, valid_user):
+    response = login(test_client, valid_user.email, "wrongpassword")
+
+    user = db_session.query(User).filter_by(email=valid_user.email).first()
+
+    assert response.json["msg"] == "WrongPassword"
+    assert response.status_code == 200
+
+
+def test_login_user_not_existent(test_client, init_database, db_session, valid_user):
+    response = login(test_client, "fake@user.com", "wrongpassword")
+
+    user = db_session.query(User).filter_by(email=valid_user.email).first()
+
+    assert response.json["msg"] == "WrongUsernameOrPassword"
+    assert response.status_code == 200
+
+
+def test_login_user_not_confirmed(test_client, init_database, db_session, unconfirmed_user):
+    response = login(test_client, unconfirmed_user.email, "ff")
+
+    user = db_session.query(User).filter_by(email=unconfirmed_user.email).first()
+
+    assert response.json["msg"] == "UserNotConfirmed"
+    assert response.status_code == 200
+
+
+def test_profile(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.get("/profile", headers=headers)
@@ -43,7 +121,9 @@ def test_profile(test_client, init_database):
         assert session.query(User).filter_by(email="ff@ff.com").first() == user
 
 
-def test_profile_changes(test_client, init_database):
+def test_profile_changes(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.post(
@@ -54,48 +134,60 @@ def test_profile_changes(test_client, init_database):
             "first_name": "ssd",
             "last_name": "sds",
             "image": "",
-            "email": "ff@ff.com",
+            "email": valid_user.email,
         },
     )
+
     assert response.status_code == 200
 
 
-def test_api_key_get(test_client, init_database):
+def test_api_key_get(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.get("/api-key", headers=headers)
+
     assert response.status_code == 200
 
 
-def test_api_key_post(test_client, init_database):
+def test_api_key_post(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.post("/api-key", headers=headers)
+
     assert response.status_code == 200
 
 
-def test_logout(test_client, init_database):
+def test_logout(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.get("/logout", headers=headers)
+
     assert response.status_code == 200
 
 
-def test_forgot_token(test_client, init_database):
-    with Session() as session:
-        user = session.query(User).filter_by(email="ff@ff.com").first()
-    url = "?token=" + str(user.forgotten_password_code)
+def test_forgot_token(test_client, init_database, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
+    url = "?token=" + str(valid_user.forgotten_password_code)
     response = test_client.post(
         "/forgot-token", json={"url": url}, follow_redirects=True
     )
+
     assert response.status_code == 200
 
 
-def test_reset_password(test_client, init_database):
-    with Session() as session:
-        user = session.query(User).filter_by(email="ff@ff.com").first()
-    url = "?token=" + str(user.forgotten_password_code)
+def test_reset_password(test_client, init_databas, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
+    url = "?token=" + str(valid_user.forgotten_password_code)
     response = test_client.post(
-        "/forgot-token", json={"url": url, "password": "ff"}, follow_redirects=True
+        "/forgot-token", json={"url": url, "password": "abcabc"}, follow_redirects=True
     )
+
     assert response.status_code == 200

From 38a82a77828107cb2055bd127ae4c53e3bdbabd3 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 17 Sep 2025 22:14:01 +0200
Subject: [PATCH 05/16] tests/fix: refactoring all existing user_routes tests.
 all passing.

---
 tests/test_user_routes.py | 112 +++++++++++++++++++++++++++-----------
 1 file changed, 79 insertions(+), 33 deletions(-)

diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index 7f265c5e..49ffdc7a 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -9,6 +9,7 @@
 @pytest.fixture
 def db_session(test_client, valid_user, unconfirmed_user):
     # setup
+    print("setup")
     session = Session()
     session.add(valid_user)
     session.add(unconfirmed_user)
@@ -16,9 +17,11 @@ def db_session(test_client, valid_user, unconfirmed_user):
     
     try:
         # test
+        print("test")
         yield session
     finally:
         # cleanup
+        print("cleanup")
         session.delete(valid_user)
         session.delete(unconfirmed_user)
         session.commit()
@@ -34,6 +37,8 @@ def valid_user():
         company="0000",
         country="0000",
         bio="No Bio",
+        session_hash="0000",
+        forgotten_password_code="0000",
         active=1
     )
     user.set_password("abcabc")
@@ -51,6 +56,9 @@ def unconfirmed_user():
         company="0000",
         country="0000",
         bio="No Bio",
+        session_hash="0000",
+        activation_code="0000",
+        forgotten_password_code="0000",
         active=0
     )
     user.set_password("ff")
@@ -65,19 +73,18 @@ def login(test_client, email, password):
     return response
 
 
-def test_confirm_user(test_client, init_database, unconfirmed_user):
+def test_confirm_user(test_client, init_database, db_session, unconfirmed_user):
     url = "?token=" + str(unconfirmed_user.activation_code)
     response = test_client.post(
         "/confirmation", json={"url": url, "password": "ff"}, follow_redirects=True
     )
+
     assert response.status_code == 200
 
 
 def test_login(test_client, init_database, db_session, valid_user):
     response = login(test_client, valid_user.email, "abcabc")
 
-    user = db_session.query(User).filter_by(email=valid_user.email).first()
-
     assert response.json["access_token"]
     assert response.status_code == 200
 
@@ -85,17 +92,13 @@ def test_login(test_client, init_database, db_session, valid_user):
 def test_login_wrong_password(test_client, init_database, db_session, valid_user):
     response = login(test_client, valid_user.email, "wrongpassword")
 
-    user = db_session.query(User).filter_by(email=valid_user.email).first()
-
     assert response.json["msg"] == "WrongPassword"
     assert response.status_code == 200
 
 
-def test_login_user_not_existent(test_client, init_database, db_session, valid_user):
+def test_login_user_not_existent(test_client, init_database, db_session):
     response = login(test_client, "fake@user.com", "wrongpassword")
 
-    user = db_session.query(User).filter_by(email=valid_user.email).first()
-
     assert response.json["msg"] == "WrongUsernameOrPassword"
     assert response.status_code == 200
 
@@ -103,65 +106,90 @@ def test_login_user_not_existent(test_client, init_database, db_session, valid_u
 def test_login_user_not_confirmed(test_client, init_database, db_session, unconfirmed_user):
     response = login(test_client, unconfirmed_user.email, "ff")
 
-    user = db_session.query(User).filter_by(email=unconfirmed_user.email).first()
-
     assert response.json["msg"] == "UserNotConfirmed"
     assert response.status_code == 200
 
 
-def test_profile(test_client, init_database, valid_user):
+def test_get_profile(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.get("/profile", headers=headers)
-    with Session() as session:
-        user = session.query(User).filter_by(email=response.json["email"]).first()
-        assert response.status_code == 200
-        assert session.query(User).filter_by(email="ff@ff.com").first() == user
+    
+    retrieved_profile = response.json
+
+    profile = {
+        "username": valid_user.username,
+        "bio": valid_user.bio,
+        "first_name": valid_user.first_name,
+        "last_name": valid_user.last_name,
+        "email": valid_user.email,
+        "image": valid_user.image,
+        "id": valid_user.id
+    }
+
+    assert response.status_code == 200
+    assert retrieved_profile == profile
 
 
-def test_profile_changes(test_client, init_database, valid_user):
+def test_profile_changes(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
+    print(db_session, "HELLO2")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
-    response = test_client.post(
-        "/profile",
-        headers=headers,
-        json={
-            "bio": "ss bio",
-            "first_name": "ssd",
-            "last_name": "sds",
-            "image": "",
-            "email": valid_user.email,
-        },
-    )
 
+    changes = {
+        "bio": "newbio",
+        "first_name": "newfirstname",
+        "last_name": "newlastname",
+        "image": "newimage",
+        "email": valid_user.email,
+    }
+
+    response = test_client.post("/profile", headers=headers, json=changes)
+    db_session.refresh(valid_user)
+
+    assert valid_user.bio == changes["bio"]
+    assert valid_user.first_name == changes["first_name"]
+    assert valid_user.last_name == changes["last_name"]
+    # note/todo: currently not testing image. image update functionality
+    # not implemented yet in views.py::profile
+    assert valid_user.email == changes["email"]
+    assert response.json["msg"] == "User information changed"
     assert response.status_code == 200
 
 
-def test_api_key_get(test_client, init_database, valid_user):
+def test_api_key_get(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.get("/api-key", headers=headers)
 
+    assert response.json["apikey"] == valid_user.session_hash
     assert response.status_code == 200
 
 
-def test_api_key_post(test_client, init_database, valid_user):
+def test_api_key_post(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
+    old_session_hash = valid_user.session_hash
+
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.post("/api-key", headers=headers)
 
+    db_session.refresh(valid_user)
+
+    # confirm session hash has been updated
+    assert valid_user.session_hash != old_session_hash
+    assert response.json["msg"] == "API Key updated"
     assert response.status_code == 200
 
 
-def test_logout(test_client, init_database, valid_user):
+def test_logout(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
@@ -171,7 +199,7 @@ def test_logout(test_client, init_database, valid_user):
     assert response.status_code == 200
 
 
-def test_forgot_token(test_client, init_database, valid_user):
+def test_forgot_token(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     url = "?token=" + str(valid_user.forgotten_password_code)
@@ -179,15 +207,33 @@ def test_forgot_token(test_client, init_database, valid_user):
         "/forgot-token", json={"url": url}, follow_redirects=True
     )
 
+    assert response.json["msg"] == "Token confirmed"
     assert response.status_code == 200
 
 
-def test_reset_password(test_client, init_databas, valid_user):
+def test_forgot_token_invalid_token(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
+    url = "?token=faketoken"
+    response = test_client.post(
+        "/forgot-token", json={"url": url}, follow_redirects=True
+    )
+
+    assert response.json["msg"] == "Error"
+    assert response.status_code == 401
+
+
+def test_reset_password(test_client, init_database, db_session, valid_user):
+    login(test_client, valid_user.email, "abcabc")
+
+    new_password = "newpassword"
+
     url = "?token=" + str(valid_user.forgotten_password_code)
     response = test_client.post(
-        "/forgot-token", json={"url": url, "password": "abcabc"}, follow_redirects=True
+        "/resetpassword", json={"url": url, "password": new_password}, follow_redirects=True
     )
 
+    db_session.refresh(valid_user)
+
+    assert valid_user.check_password(new_password)
     assert response.status_code == 200

From 36e2da53ba02a642bcd965ef34dddd00c36d99d6 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 17 Sep 2025 22:15:27 +0200
Subject: [PATCH 06/16] refactor: standardizing session calls and filter_by
 calls

---
 server/user/views.py      | 209 +++++++++++++++++++-------------------
 tests/test_user_routes.py |   4 -
 2 files changed, 104 insertions(+), 109 deletions(-)

diff --git a/server/user/views.py b/server/user/views.py
index b7daf4da..e3301738 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -40,7 +40,7 @@ def check_if_token_in_blocklist(jwt_header, decrypted_token):
 
 
 @user_blueprint.route("/login", methods=["POST"])
-def login():
+def login(session=Session()):
     """
     Login
 
@@ -50,111 +50,108 @@ def login():
     """
 
     jobj = request.get_json()
-    with Session() as session:
-        # need to inspect jobj. Is `email` actually username or is there also a `username`?
-        user = session.query(User).filter_by(email=jobj["email"]).first()
-        print(jobj)
-        if user is None:
-            print("User does not exist")
-            return jsonify({"msg": "WrongUsernameOrPassword"}), 200
-
-        elif not user.check_password(jobj["password"]):
-            print("Wrong password")
-            return jsonify({"msg": "WrongPassword"}), 200
-
-        elif user.active == 0:
-            print("User not confirmed")
-            return jsonify({"msg": "UserNotConfirmed"}), 200
-
-        else:
-            user_g = session.query(UserGroups).filter_by(user_id=user.id).first()
-            if user_g is None:
-                user_ = UserGroups(user_id=user.id)
-                user_.set_group()
-                session.add(user_)
-                session.commit()
-            access_token = create_access_token(identity=user.username)
-            testing = strtobool(os.environ.get("TESTING", "True"))
-            print(testing)
-            if testing:
-                print("executed")
-                os.environ["TEST_ACCESS_TOKEN"] = access_token
-                # exporting access token to environment for testing
-            return jsonify(access_token=access_token), 200
+     # need to inspect jobj. Is `email` actually username or is there also a `username`?
+    user = session.query(User).filter_by(email=jobj["email"]).first()
+    print(jobj)
+    if user is None:
+        print("User does not exist")
+        return jsonify({"msg": "WrongUsernameOrPassword"}), 200
+
+    elif not user.check_password(jobj["password"]):
+        print("Wrong password")
+        return jsonify({"msg": "WrongPassword"}), 200
+
+    elif user.active == 0:
+        print("User not confirmed")
+        return jsonify({"msg": "UserNotConfirmed"}), 200
+
+    else:
+        user_g = session.query(UserGroups).filter_by(user_id=user.id).first()
+        if user_g is None:
+            user_ = UserGroups(user_id=user.id)
+            user_.set_group()
+            session.add(user_)
+            session.commit()
+        access_token = create_access_token(identity=user.username)
+        testing = strtobool(os.environ.get("TESTING", "True"))
+        print(testing)
+        if testing:
+            print("executed")
+            os.environ["TEST_ACCESS_TOKEN"] = access_token
+            # exporting access token to environment for testing
+        return jsonify(access_token=access_token), 200
 
 
 @user_blueprint.route("/profile", methods=["GET", "POST"])
 @jwt_required()
-def profile():
+def profile(session=Session()):
     """
     Function to edit and retrieve user profile information
     """
     current_user = get_jwt_identity()
-    with Session() as session:
-        user = session.query(User).filter_by(username=current_user).first()
-        if request.method == "GET":
-            return (
-                jsonify(
-                    {
-                        "username": user.username,
-                        "bio": user.bio,
-                        "first_name": user.first_name,
-                        "last_name": user.last_name,
-                        "email": user.email,
-                        "image": user.image,
-                        "id": user.id,
-                    }
-                ),
-                200,
-            )
-        elif request.method == "POST":
-            data = request.get_json()
-            # print(data['image'])
-            user.update_bio(data["bio"])
-            user.update_first_name(data["first_name"])
-            user.update_last_name(data["last_name"])
-            if data["email"] != user.email:
-                print("email changed")
-                token = secrets.token_hex()
-                user.update_activation_code(token)
-                confirmation_email(data["email"], token)
-                user.update_email(data["email"])
+    user = session.query(User).filter_by(username=current_user).first()
+    if request.method == "GET":
+        return (
+            jsonify(
+                {
+                    "username": user.username,
+                    "bio": user.bio,
+                    "first_name": user.first_name,
+                    "last_name": user.last_name,
+                    "email": user.email,
+                    "image": user.image,
+                    "id": user.id,
+                }
+            ),
+            200,
+        )
+    elif request.method == "POST":
+        data = request.get_json()
+        # print(data['image'])
+        user.update_bio(data["bio"])
+        user.update_first_name(data["first_name"])
+        user.update_last_name(data["last_name"])
+        if data["email"] != user.email:
+            print("email changed")
+            token = secrets.token_hex()
+            user.update_activation_code(token)
+            confirmation_email(data["email"], token)
+            user.update_email(data["email"])
 
-            session.merge(user)
-            session.commit()
-            return jsonify({"msg": "User information changed"}), 200
-        else:
-            return jsonify({"msg": "profile OK"}), 200
+        session.merge(user)
+        session.commit()
+        return jsonify({"msg": "User information changed"}), 200
+    else:
+        return jsonify({"msg": "profile OK"}), 200
 
 
 @jwt_required()
 @user_blueprint.route("/verifytoken", methods=["GET"])
-def verifytoken():
+def verifytoken(session=Session()):
     return "token-valid"
 
 
 # TODO Change Address before production
 @user_blueprint.route("/image", methods=["POST"])
 @jwt_required()
-def image():
+def image(session=Session()):
     """Function to receive and set user image"""
     current_user = get_jwt_identity()
-    with Session() as session:
-        user = session.query(User).filter_by(username=current_user).first()
-        f = request.files["file"]
-        Path("dev_data/" + str(user.username)).mkdir(parents=True, exist_ok=True)
-        f.save(
-            os.path.join("dev_data/" + str(user.username) + "/", secure_filename(f.filename))
-        )
-        path = "imgs/dev_data/" + str(user.username) + "/" + secure_filename(f.filename)
-        user.update_image_address(path)
-        session.merge(user)
-        session.commit()
+    user = session.query(User).filter_by(username=current_user).first()
+    f = request.files["file"]
+    Path("dev_data/" + str(user.username)).mkdir(parents=True, exist_ok=True)
+    f.save(
+        os.path.join("dev_data/" + str(user.username) + "/", secure_filename(f.filename))
+    )
+    path = "imgs/dev_data/" + str(user.username) + "/" + secure_filename(f.filename)
+    user.update_image_address(path)
+    session.merge(user)
+    session.commit()
     return jsonify({"msg": "User image changed"}), 200
 
 
 @user_blueprint.route("/imgs/<path:path>")
-def images(path):
+def images(path, session=Session()):
     try:
         im = Image.open(path)
         # im.thumbnail((w, h), Image.ANTIALIAS)
@@ -170,7 +167,7 @@ def images(path):
 
 @user_blueprint.route("/logout", methods=["POST"])
 @jwt_required()
-def logout():
+def logout(session=Session()):
     """Function to logout user"""
     jti = get_jwt()["jti"]
     blocklist.add(jti)
@@ -179,11 +176,11 @@ def logout():
 
 @user_blueprint.route("/api-key", methods=["POST", "GET"])
 @jwt_required()
-def apikey():
+def apikey(session=Session()):
     """Change and retrieve API-Key"""
     current_user = get_jwt_identity()
     with Session() as session:
-        user = session.query(User).filter(User.username == current_user).first()
+        user = session.query(User).filter_by(username=current_user).first()
         if request.method == "GET":
             api_key = user.session_hash
             return jsonify({"apikey": api_key}), 200
@@ -196,7 +193,7 @@ def apikey():
 
 @user_blueprint.route("/delete", methods=["GET", "POST"])
 @jwt_required()
-def delete_user():
+def delete_user(session=Session()):
     """Delete current user: Frontend and functionality not decided yet"""
     # current_user = get_jwt_identity()
     # user = session.query(User).filter(User.email == current_user).first()
@@ -206,42 +203,44 @@ def delete_user():
 
 
 @user_blueprint.route("/forgot-token", methods=["POST"])
-def forgot_token():
+def forgot_token(session=Session()):
     """Check for forgotten_password_code"""
     data = request.get_json()
-    with Session() as session:
-        user = user_from_token(session, data, "forgotten_password_code")
-    if user is not None:
-        return jsonify({"msg": "token confirmed"}), 200
-    else:
-        return jsonify({"msg": "Error"}), 401
+    try:
+        user = user_from_token(data, "forgotten_password_code", session)
+        if user:
+            # user verified by token
+            return jsonify({"msg": "Token confirmed"}), 200
+    except ValueError as e:
+        print(e)
+       
+    # user could not be verified by token
+    return jsonify({"msg": "Error"}), 401
 
 
 @user_blueprint.route("/resetpassword", methods=["POST"])
-def reset():
+def reset(session=Session()):
     """Changes user password"""
     data = request.get_json()
-    with Session() as session:
-        user = user_from_token(session, data, "forgotten_password_code")
-        user.set_password(data["password"])
-        session.merge(user)
-        session.commit()
+    user = user_from_token(data, "forgotten_password_code", session)
+    user.set_password(data["password"])
+    session.merge(user)
+    session.commit()
     return jsonify({"msg": "password changed"}), 200
 
 
 @user_blueprint.route("/confirmation", methods=["POST"])
-def confirm_user():
+def confirm_user(session=Session()):
     """Activates user"""
     data = request.get_json()
-    with Session() as session:
-        user = user_from_token(session, data, "activation_code")
-        user.update_activation()
-        session.merge(user)
-        session.commit()
+    user = user_from_token(data, "activation_code", session)
+    user.update_activation()
+    session.merge(user)
+    session.commit()
     return jsonify({"msg": "User confirmed"}), 200
 
 
-def user_from_token(session: Session, data, token_name):
+def user_from_token(data, token_name, session=Session()):
     url = data["url"]
     parsed = urlparse(url)
     (token, ) = parse_qs(parsed.query)["token"]
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index 49ffdc7a..836366bd 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -9,7 +9,6 @@
 @pytest.fixture
 def db_session(test_client, valid_user, unconfirmed_user):
     # setup
-    print("setup")
     session = Session()
     session.add(valid_user)
     session.add(unconfirmed_user)
@@ -17,11 +16,9 @@ def db_session(test_client, valid_user, unconfirmed_user):
     
     try:
         # test
-        print("test")
         yield session
     finally:
         # cleanup
-        print("cleanup")
         session.delete(valid_user)
         session.delete(unconfirmed_user)
         session.commit()
@@ -135,7 +132,6 @@ def test_get_profile(test_client, init_database, db_session, valid_user):
 
 def test_profile_changes(test_client, init_database, db_session, valid_user):
     login(test_client, valid_user.email, "abcabc")
-    print(db_session, "HELLO2")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}

From cd6e7d3d62e2431581f2cb6b27df916afa538d65 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Thu, 18 Sep 2025 00:04:07 +0200
Subject: [PATCH 07/16] fix: UI new API key display/refresh

---
 .../src/client/app/src/pages/auth/APIKey.js   |  8 +++----
 server/user/views.py                          | 22 ++++++++++---------
 tests/test_user_routes.py                     |  1 +
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/APIKey.js b/server/src/client/app/src/pages/auth/APIKey.js
index ac65cdde..2e3b81af 100644
--- a/server/src/client/app/src/pages/auth/APIKey.js
+++ b/server/src/client/app/src/pages/auth/APIKey.js
@@ -44,10 +44,10 @@ function CopyableAPIKey({ apikey }) {
 
 function APIKey() {
   const [apikey, setApikey] = useState('');
-  const yourConfig = {
+const yourConfig = {
     headers: {
-      Authorization: "Bearer " + localStorage.getItem("token"),
-    },
+      Authorization: "Bearer " + localStorage.getItem("token")
+    }
   };
 
   useEffect(() => {
@@ -66,7 +66,7 @@ function APIKey() {
     axios
       .post(
         process.env.REACT_APP_URL_SITE_BACKEND + "api-key",
-        { resetapikey: true },
+        {}, // no form data required
         yourConfig
       )
       .then((response) => {
diff --git a/server/user/views.py b/server/user/views.py
index e3301738..f5d998ca 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -179,16 +179,18 @@ def logout(session=Session()):
 def apikey(session=Session()):
     """Change and retrieve API-Key"""
     current_user = get_jwt_identity()
-    with Session() as session:
-        user = session.query(User).filter_by(username=current_user).first()
-        if request.method == "GET":
-            api_key = user.session_hash
-            return jsonify({"apikey": api_key}), 200
-        elif request.method == "POST":
-            user.set_session_hash()
-            session.merge(user)
-            session.commit()
-            return jsonify({"msg": "API Key updated"}), 200
+    user = session.query(User).filter_by(username=current_user).first()
+    if request.method == "GET":
+        api_key = user.session_hash
+        return jsonify({"apikey": api_key}), 200
+    elif request.method == "POST":
+        user.set_session_hash()
+        session.merge(user)
+        session.commit()
+        return jsonify({
+            "msg": "API Key updated",
+            "apikey": user.session_hash
+        }), 200
 
 
 @user_blueprint.route("/delete", methods=["GET", "POST"])
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index 836366bd..b0909d04 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -181,6 +181,7 @@ def test_api_key_post(test_client, init_database, db_session, valid_user):
 
     # confirm session hash has been updated
     assert valid_user.session_hash != old_session_hash
+    assert response.json["apikey"] == valid_user.session_hash
     assert response.json["msg"] == "API Key updated"
     assert response.status_code == 200
 

From f18a5378fce59022d96069a5f30603d1c7baef43 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Thu, 18 Sep 2025 00:16:50 +0200
Subject: [PATCH 08/16] fix/test: minor updates to reset() and distinguishing
 test user fixtures more for test_reset_password

---
 server/user/views.py      | 2 +-
 tests/test_user_routes.py | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/server/user/views.py b/server/user/views.py
index f5d998ca..d8e160a9 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -228,7 +228,7 @@ def reset(session=Session()):
     user.set_password(data["password"])
     session.merge(user)
     session.commit()
-    return jsonify({"msg": "password changed"}), 200
+    return jsonify({"msg": "Password changed"}), 200
 
 
 @user_blueprint.route("/confirmation", methods=["POST"])
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index b0909d04..a96522e4 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -6,7 +6,7 @@
 from server.user.models import User
 
 
-@pytest.fixture
+@pytest.fixture(scope="function")
 def db_session(test_client, valid_user, unconfirmed_user):
     # setup
     session = Session()
@@ -35,7 +35,7 @@ def valid_user():
         country="0000",
         bio="No Bio",
         session_hash="0000",
-        forgotten_password_code="0000",
+        forgotten_password_code="1234",
         active=1
     )
     user.set_password("abcabc")
@@ -55,7 +55,7 @@ def unconfirmed_user():
         bio="No Bio",
         session_hash="0000",
         activation_code="0000",
-        forgotten_password_code="0000",
+        forgotten_password_code="5678",
         active=0
     )
     user.set_password("ff")
@@ -231,6 +231,8 @@ def test_reset_password(test_client, init_database, db_session, valid_user):
     )
 
     db_session.refresh(valid_user)
+    print(valid_user.id)
 
     assert valid_user.check_password(new_password)
+    assert response.json["msg"] == "Password changed"
     assert response.status_code == 200

From 67c57ee6e066a3c9514498d32398f7b3afe6ce7a Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Sat, 20 Sep 2025 09:54:35 +0200
Subject: [PATCH 09/16] feat: adding password visibility toggle feature for
 signup flow and refactor of Signup module

---
 .../src/client/app/src/pages/auth/SignUp.js   | 135 +++++++++++++-----
 1 file changed, 102 insertions(+), 33 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignUp.js b/server/src/client/app/src/pages/auth/SignUp.js
index 56d596ab..7ba1d4ff 100755
--- a/server/src/client/app/src/pages/auth/SignUp.js
+++ b/server/src/client/app/src/pages/auth/SignUp.js
@@ -7,12 +7,18 @@ import { useState } from "react";
 
 import {
   FormControl,
+  IconButton,
   Input,
   InputLabel,
+  InputAdornment,
   Button as MuiButton,
   Paper,
   Typography
 } from "@mui/material";
+import {
+  Visibility,
+  VisibilityOff
+} from '@mui/icons-material';
 import { spacing } from "@mui/system";
 import axios from "axios";
 
@@ -35,48 +41,78 @@ function SignUp() {
   const [duplicateUser, setDuplicateUser] = useState(false);
   const [error, setError] = useState(false);
   const [errormessage, setErrorMessage] = useState(false);
-  function sendflask(event) {
+
+  const [firstName, setFirstName] = useState("");
+  const [lastName, setLastName] = useState("");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+
+  const [showPassword, setShowPassword] = useState(false);
+
+  function handleSubmit(event) {
     event.preventDefault();
-    console.log(event.target.email.value);
-    console.log(event.target.password.value);
-    if (event.target.password.value.length < 8) {
+    var registrationData = {
+      email: email,
+      firstName: firstName,
+      lastName: lastName,
+      password: password
+    };
+
+    console.log("Registration data: ", registrationData);
+
+    if (password.length < 8) {
+     // Password must be 8+ characters
       setError(true);
       setErrorMessage("Password too weak. Use at least 8 characters, with numbers, digits, and special characters.");
-    } else if (
-      /[a-zA-Z0-9]+@(?:[a-zA-Z0-9-]+\.)+[A-Za-z]+$/.test(
-        event.target.email.value
-      ) !== true
-    ) {
+    } else if ( (/[a-zA-Z0-9]+@(?:[a-zA-Z0-9-]+\.)+[A-Za-z]+$/.test(email)) === false) {
+      // Email must be in valid format
       setError(true);
       setErrorMessage("Please enter valid email");
     } else {
-      axios
-        .post(process.env.REACT_APP_URL_SITE_BACKEND + "signup", {
-          first_name: event.target.fname.value,
-          last_name: event.target.lname.value,
-          email: event.target.email.value,
-          password: event.target.password.value
-        })
-        .then(function(response) {
-          if (response.data.msg === "User created") {
-            console.log(response.data);
-            setRegister(true);
-          } else if (response.data.msg === "User already exists") {
-            setDuplicateUser(true);
-          }
-        })
-        .catch(function(error) {
-          console.log(error.data);
-        });
+      sendflask(registrationData);
     }
+
     return false;
   }
+
+  function handleMouseDownPassword(event) {
+    event.preventDefault(); // Prevents focus loss
+  }
+
+  function handleClickShowPassword() {
+    setShowPassword(function(prev) {
+      return !prev;
+    });
+  }
+
+  function sendflask(registrationData) {
+    axios
+      .post(process.env.REACT_APP_URL_SITE_BACKEND + "signup", {
+        first_name: registrationData.firstName,
+        last_name: registrationData.lastName,
+        email: registrationData.email,
+        password: registrationData.password
+      })
+      .then(function(response) {
+        if (response.data.msg === "User created") {
+          console.log(response.data);
+          setRegister(true);
+        } else if (response.data.msg === "User alredy exists") {
+          setDuplicateUser(true);
+        }
+      })
+      .catch(function(error) {
+        console.log(error.data);
+      })
+  }
+
   return (
     <Wrapper>
       <Typography component="h1" variant="h4" align="center" gutterBottom>
         Almost there
       </Typography>
-      <form onSubmit={sendflask}>
+      <form onSubmit={handleSubmit}>
+        {/* Error Banner */}
         {duplicateUser && (
           <Typography component="h3" variant="body1" align="center" color="red">
             User already exists
@@ -87,31 +123,64 @@ function SignUp() {
             {errormessage}
           </Typography>
         )}
+
+        {/* Input fields */}
         <FormControl margin="normal" required fullWidth>
           <InputLabel htmlFor="fname">First name</InputLabel>
-          <Input id="fname" name="fname" autoFocus />
+          <Input
+            id="fname"
+            name="fname"
+            value={firstName}
+            onChange={function(e) { setFirstName(e.target.value); }}
+            autoFocus
+          />
         </FormControl>
         <FormControl margin="normal" required fullWidth>
           <InputLabel htmlFor="lname">Last name</InputLabel>
-          <Input id="lname" name="lname" autoFocus />
+          <Input
+            id="lname"
+            name="lname"
+            value={lastName}
+            onChange={function(e) { setLastName(e.target.value); }}
+            autoFocus
+          />
         </FormControl>
         <FormControl margin="normal" required fullWidth>
           <InputLabel htmlFor="email">
             Email Address (we never share your email)
           </InputLabel>
-          <Input id="email" name="email" autoComplete="email" />
+          <Input
+            id="email"
+            name="email"
+            value={email}
+            onChange={function(e) { setEmail(e.target.value); }}
+            autoComplete="email"
+          />
         </FormControl>
         <FormControl margin="normal" required fullWidth>
           <InputLabel htmlFor="password">
             Password (min 8 characters)
           </InputLabel>
           <Input
-            name="password"
-            type="password"
             id="password"
+            name="password"
+            type={showPassword ? 'text' : 'password'}
             autoComplete="current-password"
+            onChange={function(e) {setPassword(e.target.value)}}
+            endAdornment={
+              <InputAdornment position="end">
+                <IconButton
+                  onClick={handleClickShowPassword}
+                  onMouseDown={handleMouseDownPassword}
+                  edge="end"
+                >
+                  {showPassword ? <VisibilityOff /> : <Visibility />}
+                </IconButton>
+              </InputAdornment>
+            }
           />
         </FormControl>
+
         <Button
           type="submit"
           fullWidth

From 76f9932f6b007c325609b63f0dc23cb68ab4aff6 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Sat, 20 Sep 2025 11:06:14 +0200
Subject: [PATCH 10/16] tests: adding signup route test

---
 server/extensions.py                          |  6 ++---
 .../client/app/src/pages/auth/ProfilePage.js  | 12 +++++----
 tests/test_user_routes.py                     | 27 ++++++++++++++++++-
 3 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/server/extensions.py b/server/extensions.py
index 1ef41774..cbf82369 100644
--- a/server/extensions.py
+++ b/server/extensions.py
@@ -35,12 +35,12 @@
     Base = declarative_base()
     Base.metadata.reflect(engine)
 else:
-    logging.warning("Testing mode, using local sqlite db.")
+    logging.warning("Testing mode, using local sqlite test db.")
     engine = create_engine(
-        "sqlite:///" + os.path.join(basedir, "openml.db"),
+        "sqlite:///" + os.path.join(basedir, "openml.test.db"),
         echo=False,
     )
-    Config.SQLALCHEMY_DATABASE_URI = "sqlite:///" + os.path.join(basedir, "openml.db")
+    Config.SQLALCHEMY_DATABASE_URI = "sqlite:///" + os.path.join(basedir, "openml.test.db")
     Base = declarative_base()
     Base.metadata.reflect(engine)
 
diff --git a/server/src/client/app/src/pages/auth/ProfilePage.js b/server/src/client/app/src/pages/auth/ProfilePage.js
index 713e7ab0..a050d3f3 100755
--- a/server/src/client/app/src/pages/auth/ProfilePage.js
+++ b/server/src/client/app/src/pages/auth/ProfilePage.js
@@ -92,14 +92,16 @@ function Public() {
         setFname(response.data.first_name);
         setLname(response.data.last_name);
         setId(response.data.id);
-        if (id !== false) {
+        if (id) {
           fetch(`${ELASTICSEARCH_SERVER}user/user/` + id.toString())
             .then(response => response.json())
             .then(data => {
-              setDataset(data._source.datasets_uploaded);
-              setRun(data._source.runs_uploaded);
-              setTask(data._source.tasks_uploaded);
-              setFlow(data._source.flows_uploaded);
+              if (data._source) {
+                setDataset(data._source.datasets_uploaded);
+                setRun(data._source.runs_uploaded);
+                setTask(data._source.tasks_uploaded);
+                setFlow(data._source.flows_uploaded);
+              }
             });
         }
       })
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index a96522e4..d1692c91 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -70,6 +70,32 @@ def login(test_client, email, password):
     return response
 
 
+def signup(test_client, init_database, db_session):
+    registration_data = {
+        "email": "new@user.com",
+        "password": "newpassword",
+        "first_name": "Ana",
+        "last_name": "Brown"
+    }
+
+    response = test_client.post(
+        "/signup",
+        json={
+            "email": registration_data.email,
+            "password": registration_data.password,
+            "first_name": registration_data.first_name,
+            "last_name": registration_data.last_name
+        }
+    )
+
+    registered_user = db_session.query(User).filter_by(registration_data.email).first()
+
+    assert registered_user.check_password(registration_data)
+    assert registered_user.first_name == registration_data.first_name
+    assert registered_user.last_name == registration_data.last_name
+    assert response.status_code == 200
+
+
 def test_confirm_user(test_client, init_database, db_session, unconfirmed_user):
     url = "?token=" + str(unconfirmed_user.activation_code)
     response = test_client.post(
@@ -231,7 +257,6 @@ def test_reset_password(test_client, init_database, db_session, valid_user):
     )
 
     db_session.refresh(valid_user)
-    print(valid_user.id)
 
     assert valid_user.check_password(new_password)
     assert response.json["msg"] == "Password changed"

From 06499ee6c756f3ca3ad3b534d1de9da2b423aa83 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Sat, 20 Sep 2025 12:51:45 +0200
Subject: [PATCH 11/16] refactor: starting tests with clean db, using separate
 test db during test runs

---
 server/openml.test.db                         | Bin 0 -> 28672 bytes
 .../src/client/app/src/pages/auth/APIKey.js   |   2 +-
 tests/conftest.py                             |  20 +++--
 tests/test_collection_routes.py               |   4 +-
 tests/test_data_routes.py                     |   2 +-
 tests/test_public_routes.py                   |   6 +-
 tests/test_task_routes.py                     |   2 +-
 tests/test_user_routes.py                     |  74 ++++++++----------
 8 files changed, 56 insertions(+), 54 deletions(-)
 create mode 100644 server/openml.test.db

diff --git a/server/openml.test.db b/server/openml.test.db
new file mode 100644
index 0000000000000000000000000000000000000000..4f35f199e1d0be1e6d781c34f647b75294474ffb
GIT binary patch
literal 28672
zcmeI4-EZ1f6u@mDq)>IVsv=ZPT`YyFiIP&=*nCvV6q1sJg+NM3)8++T>}$A*jWg_g
zv~NV}Ltm%;6?@#Dw8u$(*feRHw1-_AFow`2-NV$6bBVb&_xRj%e#budUOuw>tVC?g
zX=cYjHkV><Gc3!ja2&$~M22Ce=@#s5>`$}~(QQ!J!Or_@sv~*&_7)WgMp-6Sjs6^E
zZ_eMGkN)xgbD#wXe1rrpT2s^U2M^dccWu<r@ri{yR=wFVPmV4Bet4}~$kz&7Ex%eS
zaQ+r<KFVFY5S25qN=^*Ywz-{ZaXVjq$!!&0a%-D~wXJ#D{4K|G3rioM(y^sJqPJYB
zapk>I=|i-*9#2+trE}Lbb|DiE$G0A^3~8(Q-1=Up3961xY|}li`<d1S|IzdX4o=7C
z=GZrPycqdH)ZYzVicr4+0(9K~$)Rw(IQMS>>LcyNr++ZTFp(cW!aEyG0s>zyfo_uK
zOggSz%z8O<(zrHtDQga-Xxfa>VWn8E6*dahB`z8nj5Ph1IB%SxZQl4XsnI{s(J^kp
zQRWVKoHyb{7vA0vOvmGK_J?~zgWXZ!a$>heZ5uI!9M_SmcCck}&-2x_&3tuUk{3oq
z9Ib6+U{65c`B8~uWLalsNA)B`c}xd35Yc_j(x?KY*yI%1#BA3stYgJCJ3e8m>uF&<
zzgOyy(-epA1jST`rnw!D3)5MB)3j~et`7{oW-k*?{7=2vgwh*Cdfd7WHn7p4lalLs
z?ulP*iPFKy#%kScd!75QK^<9kT{oL#*gS5Vi~0SgYotR}j9eQsy)?$PxE)<7rI^Ms
zYQOU0e)%eEnQdRBCv>EkCvCekRN)xo_m~){In*GC*~_*zh{@FoFX)vvm=)5iO))#Z
z(|jF2)R1oBha<xH+;;94y>6K&9c6glBr={X%^ZW<Z<3rv?@#CEXd$cR2}(Xg-1#fD
z)Gt_9Y4o{Tal5cv%Wv;^VOiU&Rtx1?-D`33OA{GHBTDZcJS7%s5IW%;qD+ZHRu8R~
zc{b|wc*=?{bQf875_)mp%TN6Ykee5KONPLubUK`b{;%28S)0>EKNKJU1b_e#00KY&
z2mk>f00e*l5C8%|;PWRCpe{O}^@r(3Kc{g&=XYL%0tA2n5C8%|00;m9AOHk_01yBI
zKmZ7Q1_a#i=HKF&SmrB(R#1Qd5C8%|00;m9AOHk_01yBIUo3%(?}D?;>|(dF$aHTp
zGdJkpjYupuL(4t7ZKq}gF_Yx!LqIDntm~$Mb&{mt=}#c~<BPUP)WqqskV_cLLOPX|
zmh5F|>3CU8l(+V+-JKl$iHX?S&+d1W#q5^UOjK*d^BvJ3#*0;@R?4-M-NUj_Ds88T
zzPh?8sgD<P_G7FSt(G#@Un4DuSV2fpbD6Zl=M-6L<OEsEC@MmdDrb?D<rOi5u%L*%
zoRQU3T0l8IqiCwC;T+#D`TSsSP?t?^m6(Ggr%q|ACN^^Elq#oGO-5=%P=u5qYO2z}
zv{B?m`4OLcB=VfVKar#-V#fLEe0L-84fFM#Ze^C4p$~?+K_Bk!y*RBY%cPi0B_&O}
z0^afKGg9T-4Yb!1_7nrv7SDxBGl5?n<TqZ{%2nyGQfY1;ofi)_4$?aoCNjTWZQG|u
zdgWQ3KU~jeHEl)HoG>}=$mvYhsh!eu*8O>db2#RS_(YamPu5xL$=z;cj(XAaBr?ep
z)KIQ)MJYWeIy%c739UmtwQd*5hM7G}lxw8)w6wnSS}C5^1bvN|TR5Y&@ZpgxBjbF3
z=UJ<`wtgUOkR#g13f&xM1TiH!Ry*Z-jyUW8K<qar_7{DE0tA2n5C8%|00;m9AOHk_
z01yBIKmZ7Q9t6UH5d9Z_!N3$7Vj^t7S^tM(zc}mv-($bh9VkEm2mk>f00e*l5C8%|
z00;m9AOHk_z$Zu`9C8-?fj~IetEcE20CeHsU;js`N1@m|CiZviPx=nPyHC(TFc}B{
o0U!VbfB+Bx0zd!=00AHX1b_e#@Dm6H88+lR1)ZlrFvvvy0piJBOaK4?

literal 0
HcmV?d00001

diff --git a/server/src/client/app/src/pages/auth/APIKey.js b/server/src/client/app/src/pages/auth/APIKey.js
index 2e3b81af..e799c7db 100644
--- a/server/src/client/app/src/pages/auth/APIKey.js
+++ b/server/src/client/app/src/pages/auth/APIKey.js
@@ -44,7 +44,7 @@ function CopyableAPIKey({ apikey }) {
 
 function APIKey() {
   const [apikey, setApikey] = useState('');
-const yourConfig = {
+  const yourConfig = {
     headers: {
       Authorization: "Bearer " + localStorage.getItem("token")
     }
diff --git a/tests/conftest.py b/tests/conftest.py
index d884e084..85d4eec5 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -4,7 +4,7 @@
 import pytest
 
 from autoapp import app
-from server.extensions import db
+from server.extensions import Session, engine, Base
 
 myPath = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, myPath + "/../")
@@ -28,10 +28,18 @@ def test_client():
     ctx.pop()
 
 
-@pytest.fixture(scope="module")
-def init_database():
-    # Create the database and the database table
+@pytest.fixture(scope="session")
+def session():
+    session = Session()
+    yield session
+
 
-    # Insert user data
+# DB reset between tests currently needed with existing
+# implementation
+@pytest.fixture(scope="function", autouse=True)
+def reset_db():
+    # Start w/ clean db. Drop and recreate the tables.
+    Base.metadata.drop_all(bind=engine)
+    Base.metadata.create_all(bind=engine)
 
-    yield db  # this is where the testing happens!
+    yield # run tests
diff --git a/tests/test_collection_routes.py b/tests/test_collection_routes.py
index 900632fe..afbb0848 100644
--- a/tests/test_collection_routes.py
+++ b/tests/test_collection_routes.py
@@ -1,7 +1,7 @@
 import os
 
 
-def test_upload_collection_runs(test_client, init_database):
+def test_upload_collection_runs(test_client):
     test_client.post(
         "/login", json={"email": "ff@ff.com", "password": "ff"}, follow_redirects=True
     )
@@ -20,7 +20,7 @@ def test_upload_collection_runs(test_client, init_database):
     assert response.status_code == 200
 
 
-def test_upload_collection_tasks(test_client, init_database):
+def test_upload_collection_tasks(test_client):
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
     headers = {"Authorization": "Bearer {}".format(access_token)}
     json_obj = {
diff --git a/tests/test_data_routes.py b/tests/test_data_routes.py
index 52770546..765a456d 100644
--- a/tests/test_data_routes.py
+++ b/tests/test_data_routes.py
@@ -1,4 +1,4 @@
-def test_data_upload(test_client, init_database):
+def test_data_upload(test_client):
     # access_token = str(os.environ.get('TEST_ACCESS_TOKEN'))
     # headers = {
     #     'Authorization': 'Bearer {}'.format(access_token)
diff --git a/tests/test_public_routes.py b/tests/test_public_routes.py
index 4267f746..43a65600 100644
--- a/tests/test_public_routes.py
+++ b/tests/test_public_routes.py
@@ -3,7 +3,7 @@
 uname = "test_user" + names.get_first_name()
 
 
-def test_signup(test_client, init_database):
+def test_signup(test_client):
     response = test_client.post(
         "/signup",
         json={
@@ -17,14 +17,14 @@ def test_signup(test_client, init_database):
     assert response.status_code == 200
 
 
-def test_forgot_password(test_client, init_database):
+def test_forgot_password(test_client):
     response = test_client.post(
         "/forgotpassword", json={"email": "ff@ff.com"}, follow_redirects=True
     )
     assert response.status_code == 200
 
 
-def test_confirmation_token(test_client, init_database):
+def test_confirmation_token(test_client):
     response = test_client.post(
         "/send-confirmation-token", json={"email": "ff@ff.com"}, follow_redirects=True
     )
diff --git a/tests/test_task_routes.py b/tests/test_task_routes.py
index fa27b9e0..f38778f6 100644
--- a/tests/test_task_routes.py
+++ b/tests/test_task_routes.py
@@ -1,7 +1,7 @@
 import os
 
 
-def test_upload_task(test_client, init_database):
+def test_upload_task(test_client):
     response = test_client.post(
         "/login", json={"email": "ff@ff.com", "password": "ff"}, follow_redirects=True
     )
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index d1692c91..866340b0 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -1,28 +1,16 @@
 import os
 
 import pytest
-from server.extensions import Session
 
 from server.user.models import User
 
 
-@pytest.fixture(scope="function")
-def db_session(test_client, valid_user, unconfirmed_user):
-    # setup
-    session = Session()
+@pytest.fixture(scope="function", autouse=True)
+def setup(session, valid_user, unconfirmed_user):
     session.add(valid_user)
     session.add(unconfirmed_user)
     session.commit()
-    
-    try:
-        # test
-        yield session
-    finally:
-        # cleanup
-        session.delete(valid_user)
-        session.delete(unconfirmed_user)
-        session.commit()
-
+    yield
 
 @pytest.fixture(scope="function")
 def valid_user():
@@ -70,7 +58,7 @@ def login(test_client, email, password):
     return response
 
 
-def signup(test_client, init_database, db_session):
+def test_signup(test_client, session):
     registration_data = {
         "email": "new@user.com",
         "password": "newpassword",
@@ -78,25 +66,31 @@ def signup(test_client, init_database, db_session):
         "last_name": "Brown"
     }
 
+    user_before_signup = session.query(User).filter_by(email=registration_data["email"]).first()
+
     response = test_client.post(
         "/signup",
         json={
-            "email": registration_data.email,
-            "password": registration_data.password,
-            "first_name": registration_data.first_name,
-            "last_name": registration_data.last_name
+            "email": registration_data["email"],
+            "password": registration_data["password"],
+            "first_name": registration_data["first_name"],
+            "last_name": registration_data["last_name"]
         }
     )
 
-    registered_user = db_session.query(User).filter_by(registration_data.email).first()
+    registered_user = session.query(User).filter_by(email=registration_data["email"]).first()
 
-    assert registered_user.check_password(registration_data)
-    assert registered_user.first_name == registration_data.first_name
-    assert registered_user.last_name == registration_data.last_name
+    assert user_before_signup == None
+    assert registered_user.check_password(registration_data["password"])
+    assert registered_user.first_name == registration_data["first_name"]
+    assert registered_user.last_name == registration_data["last_name"]
     assert response.status_code == 200
 
+    session.delete(registered_user)
+    session.commit()
+
 
-def test_confirm_user(test_client, init_database, db_session, unconfirmed_user):
+def test_confirm_user(test_client, unconfirmed_user):
     url = "?token=" + str(unconfirmed_user.activation_code)
     response = test_client.post(
         "/confirmation", json={"url": url, "password": "ff"}, follow_redirects=True
@@ -105,35 +99,35 @@ def test_confirm_user(test_client, init_database, db_session, unconfirmed_user):
     assert response.status_code == 200
 
 
-def test_login(test_client, init_database, db_session, valid_user):
+def test_login(test_client, valid_user):
     response = login(test_client, valid_user.email, "abcabc")
 
     assert response.json["access_token"]
     assert response.status_code == 200
 
 
-def test_login_wrong_password(test_client, init_database, db_session, valid_user):
+def test_login_wrong_password(test_client, valid_user):
     response = login(test_client, valid_user.email, "wrongpassword")
 
     assert response.json["msg"] == "WrongPassword"
     assert response.status_code == 200
 
 
-def test_login_user_not_existent(test_client, init_database, db_session):
+def test_login_user_not_existent(test_client):
     response = login(test_client, "fake@user.com", "wrongpassword")
 
     assert response.json["msg"] == "WrongUsernameOrPassword"
     assert response.status_code == 200
 
 
-def test_login_user_not_confirmed(test_client, init_database, db_session, unconfirmed_user):
+def test_login_user_not_confirmed(test_client, unconfirmed_user):
     response = login(test_client, unconfirmed_user.email, "ff")
 
     assert response.json["msg"] == "UserNotConfirmed"
     assert response.status_code == 200
 
 
-def test_get_profile(test_client, init_database, db_session, valid_user):
+def test_get_profile(test_client, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
@@ -156,7 +150,7 @@ def test_get_profile(test_client, init_database, db_session, valid_user):
     assert retrieved_profile == profile
 
 
-def test_profile_changes(test_client, init_database, db_session, valid_user):
+def test_profile_changes(test_client, session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
@@ -171,7 +165,7 @@ def test_profile_changes(test_client, init_database, db_session, valid_user):
     }
 
     response = test_client.post("/profile", headers=headers, json=changes)
-    db_session.refresh(valid_user)
+    session.refresh(valid_user)
 
     assert valid_user.bio == changes["bio"]
     assert valid_user.first_name == changes["first_name"]
@@ -183,7 +177,7 @@ def test_profile_changes(test_client, init_database, db_session, valid_user):
     assert response.status_code == 200
 
 
-def test_api_key_get(test_client, init_database, db_session, valid_user):
+def test_api_key_get(test_client, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
@@ -194,7 +188,7 @@ def test_api_key_get(test_client, init_database, db_session, valid_user):
     assert response.status_code == 200
 
 
-def test_api_key_post(test_client, init_database, db_session, valid_user):
+def test_api_key_post(test_client, session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     old_session_hash = valid_user.session_hash
@@ -203,7 +197,7 @@ def test_api_key_post(test_client, init_database, db_session, valid_user):
     headers = {"Authorization": "Bearer {}".format(access_token)}
     response = test_client.post("/api-key", headers=headers)
 
-    db_session.refresh(valid_user)
+    session.refresh(valid_user)
 
     # confirm session hash has been updated
     assert valid_user.session_hash != old_session_hash
@@ -212,7 +206,7 @@ def test_api_key_post(test_client, init_database, db_session, valid_user):
     assert response.status_code == 200
 
 
-def test_logout(test_client, init_database, db_session, valid_user):
+def test_logout(test_client, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     access_token = str(os.environ.get("TEST_ACCESS_TOKEN"))
@@ -222,7 +216,7 @@ def test_logout(test_client, init_database, db_session, valid_user):
     assert response.status_code == 200
 
 
-def test_forgot_token(test_client, init_database, db_session, valid_user):
+def test_forgot_token(test_client, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     url = "?token=" + str(valid_user.forgotten_password_code)
@@ -234,7 +228,7 @@ def test_forgot_token(test_client, init_database, db_session, valid_user):
     assert response.status_code == 200
 
 
-def test_forgot_token_invalid_token(test_client, init_database, db_session, valid_user):
+def test_forgot_token_invalid_token(test_client, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     url = "?token=faketoken"
@@ -246,7 +240,7 @@ def test_forgot_token_invalid_token(test_client, init_database, db_session, vali
     assert response.status_code == 401
 
 
-def test_reset_password(test_client, init_database, db_session, valid_user):
+def test_reset_password(test_client, session, valid_user):
     login(test_client, valid_user.email, "abcabc")
 
     new_password = "newpassword"
@@ -256,7 +250,7 @@ def test_reset_password(test_client, init_database, db_session, valid_user):
         "/resetpassword", json={"url": url, "password": new_password}, follow_redirects=True
     )
 
-    db_session.refresh(valid_user)
+    session.refresh(valid_user)
 
     assert valid_user.check_password(new_password)
     assert response.json["msg"] == "Password changed"

From b377d6061e38ee6de30d17cbdb640633a9b637bb Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 26 Nov 2025 11:15:41 +0100
Subject: [PATCH 12/16] refactor: adding initial seed user across tests

---
 server/openml.test.db     | Bin 28672 -> 28672 bytes
 server/user/views.py      |   2 +-
 tests/conftest.py         |  34 ++++++++++++++++++++++++----------
 tests/test_user_routes.py |   2 +-
 4 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/server/openml.test.db b/server/openml.test.db
index 4f35f199e1d0be1e6d781c34f647b75294474ffb..aa20b071cb3fbd0025c4ef84e532bf0b615cada0 100644
GIT binary patch
delta 225
zcmZp8z}WDBae|Z(=UN5^26iB3hG2G%i8@A1oNG5GEYW9U<X2_jSKTZqAk8n*7{MsV
zAT8VIuMSkG4a6J_oRb^vL^w)Pi%Uw2Q;Q}?*~-TSxtr=6d6pVQrug_I`6RoBl}3hm
zm#YM4I-6*hyJUo0mV2eR8kv=P7+0008)ulfW#~sFrDvIhBs)1ed*-<Y6oZU&01<l0
z`MDrE9%OiYNq%-}-egXD85u)ET_ZCELjx-iGA+)?FXsiihLQg#1OHE;Q{VG%{^`%I
F006`GK5+m5

delta 747
zcma))L2uJA6vy2Zu?|tfhAK3WXeD+l>ue`(l3r*#)UK>+x~`?r6OLmqX_Eyl)mnDh
z$|nHv6*zH2`$D_$0e0LCXJeO%1Mm5-|9i6Z^z)O?E>dR~sjtsg6$}7al1kqw_4C^+
ztSI=`#~+&y(%Aw~jYna&aK7?*HCy@eHk}9g;=(S1MHb{T@?@4(H78?DYFEo4Y?Po(
zM5`VTf+*yHUt&@CeegPe+SwV#`&}#MN7x&h!y{HScl3kxUcWW(;?NJ@*IB=9d2D~&
zLGAXg<_Goqw(f2gt?4Egt=MCCraEPWIir-hmQiNVVnlZ=M1;XyN_Cf*R5u~R2IYuh
zcuEZ7YGp(%XfWZrf?M!!)M~fYt#_hA-H&d&#5Lgx>{w;ZC7LS;bsfZzhOls%!{sH0
zm~2361H%G>6<x1jBle=%qN%(9&sP?9z5sGE0m#U_F4vw)mpd!rl2+1%xL(qylbPRx
zhYlThXuv|+FV2yDu+Be^YRwP*PEQ}(_QCdK-WoMW<!;P<0(X0d)8k2C@73VAQ8R_8
z3Xv>5p(bU+OgxF3HwhZVJZbL$;|kGZZ$lC{Qj++|!hR`XZ-AHo1xy`wP0ZTw{D97k
z3G&8))|j^ZW@OIRJAJ?XrrqeCu-0)O1zUc!!wuo_@q`c>&WGJSueH?}=}mtkCsm~q
qW`s38flK0lc%#|Fti)8*OQ2q<m-3(fRx|gNdmxocE9Y1CQsEB=4Z$t|

diff --git a/server/user/views.py b/server/user/views.py
index d8e160a9..a7b76a7a 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -52,7 +52,7 @@ def login(session=Session()):
     jobj = request.get_json()
      # need to inspect jobj. Is `email` actually username or is there also a `username`?
     user = session.query(User).filter_by(email=jobj["email"]).first()
-    print(jobj)
+
     if user is None:
         print("User does not exist")
         return jsonify({"msg": "WrongUsernameOrPassword"}), 200
diff --git a/tests/conftest.py b/tests/conftest.py
index 85d4eec5..3927ff13 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -5,11 +5,11 @@
 
 from autoapp import app
 from server.extensions import Session, engine, Base
+from server.user.models import User
 
 myPath = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, myPath + "/../")
 
-
 @pytest.fixture(scope="module")
 def test_client():
     flask_app = app
@@ -28,18 +28,32 @@ def test_client():
     ctx.pop()
 
 
-@pytest.fixture(scope="session")
-def session():
-    session = Session()
-    yield session
-
-
+# Note:
 # DB reset between tests currently needed with existing
-# implementation
+# implementation (standard transactions weren't possible)
 @pytest.fixture(scope="function", autouse=True)
-def reset_db():
+def session(test_user):
     # Start w/ clean db. Drop and recreate the tables.
     Base.metadata.drop_all(bind=engine)
     Base.metadata.create_all(bind=engine)
 
-    yield # run tests
+    session = Session()
+
+    # Add initial data
+    session.add(test_user)
+    session.commit()
+
+    yield session # run tests
+
+
+@pytest.fixture(scope="function")
+def test_user():
+    user = User(email="test@test.com", username="testuser",
+                ip_address="1.2.3.4", created_on="0000",
+                company="0000", country="0000",
+                bio="No Bio", session_hash="0000",
+                forgotten_password_code="test_user_token",
+                active=1)
+    user.set_password("testpassword")
+
+    return user
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index 866340b0..8b39df54 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -23,7 +23,7 @@ def valid_user():
         country="0000",
         bio="No Bio",
         session_hash="0000",
-        forgotten_password_code="1234",
+        forgotten_password_code="valid_user_token",
         active=1
     )
     user.set_password("abcabc")

From 7c282b723647e04def690e9b4fc25e7a03cc50ee Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 26 Nov 2025 11:20:26 +0100
Subject: [PATCH 13/16] feat: enforcing higher minimum password length

---
 server/src/client/app/src/pages/auth/SignUp.js | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignUp.js b/server/src/client/app/src/pages/auth/SignUp.js
index 7ba1d4ff..ae25bd9a 100755
--- a/server/src/client/app/src/pages/auth/SignUp.js
+++ b/server/src/client/app/src/pages/auth/SignUp.js
@@ -36,6 +36,8 @@ const RedIcon = styled(FontAwesomeIcon)({
   color: red[500]
 });
 
+const MIN_PASSWORD_LENGTH = 15;
+
 function SignUp() {
   const [register, setRegister] = useState(false);
   const [duplicateUser, setDuplicateUser] = useState(false);
@@ -60,10 +62,11 @@ function SignUp() {
 
     console.log("Registration data: ", registrationData);
 
-    if (password.length < 8) {
-     // Password must be 8+ characters
+    if (password.length < MIN_PASSWORD_LENGTH) {
+     // Password must meet minimum length
+     // Using NIST recommendation
       setError(true);
-      setErrorMessage("Password too weak. Use at least 8 characters, with numbers, digits, and special characters.");
+      setErrorMessage(`Password too weak. Use at least ${MIN_PASSWORD_LENGTH} characters.`);
     } else if ( (/[a-zA-Z0-9]+@(?:[a-zA-Z0-9-]+\.)+[A-Za-z]+$/.test(email)) === false) {
       // Email must be in valid format
       setError(true);
@@ -159,7 +162,7 @@ function SignUp() {
         </FormControl>
         <FormControl margin="normal" required fullWidth>
           <InputLabel htmlFor="password">
-            Password (min 8 characters)
+            Password (min {MIN_PASSWORD_LENGTH} characters)
           </InputLabel>
           <Input
             id="password"

From 8efa26e970f8a1ecfcc8836272658194a83e67e2 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 26 Nov 2025 11:32:53 +0100
Subject: [PATCH 14/16] refactor: consolidating incorrect credentials case
 (wrong username or password) across backend and frontend

---
 server/src/client/app/src/pages/auth/SignIn.js | 9 +++------
 server/user/views.py                           | 2 +-
 tests/test_user_routes.py                      | 2 +-
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignIn.js b/server/src/client/app/src/pages/auth/SignIn.js
index 68724925..fa5a8221 100755
--- a/server/src/client/app/src/pages/auth/SignIn.js
+++ b/server/src/client/app/src/pages/auth/SignIn.js
@@ -33,8 +33,7 @@ function SignIn() {
   const [errorlog, setError] = useState(false);
   const [confirmflag, setConfirm] = useState(false);
   const [errormsg, setErrorMsg] = useState(false);
-  const [notexist, setNotExist] = useState(false);
-  const [wrongpass, setWrongPass] = useState(false);
+  const [incorrectCredentials, setIncorrectCredentials] = useState(false);
   const context = useContext(MainContext);
 
   function sendtoflask(event) {
@@ -49,9 +48,7 @@ function SignIn() {
         if (response.data.msg === "UserNotConfirmed") {
           setConfirm(true);
         } else if (response.data.msg === "WrongUsernameOrPassword") {
-          setNotExist(true);
-        } else if (response.data.msg === "WrongPassword") {
-          setWrongPass(true);
+          setIncorrectCredentials(true);
         } else {
           localStorage.setItem("token", response.data.access_token);
           context.checkLogIn();
@@ -94,7 +91,7 @@ function SignIn() {
             </Typography>
           )}
           {/* User with this email & password could not be found */}
-          {(wrongpass || notexist) && (
+          {(incorrectCredentials) && (
             <Typography component="h3" align="center" style={{ color: "red" }}>
               <FontAwesomeIcon
                 icon="exclamation-triangle"
diff --git a/server/user/views.py b/server/user/views.py
index a7b76a7a..33112f2b 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -59,7 +59,7 @@ def login(session=Session()):
 
     elif not user.check_password(jobj["password"]):
         print("Wrong password")
-        return jsonify({"msg": "WrongPassword"}), 200
+        return jsonify({"msg": "WrongUsernameOrPassword"}), 200
 
     elif user.active == 0:
         print("User not confirmed")
diff --git a/tests/test_user_routes.py b/tests/test_user_routes.py
index 8b39df54..e61b6d2a 100644
--- a/tests/test_user_routes.py
+++ b/tests/test_user_routes.py
@@ -109,7 +109,7 @@ def test_login(test_client, valid_user):
 def test_login_wrong_password(test_client, valid_user):
     response = login(test_client, valid_user.email, "wrongpassword")
 
-    assert response.json["msg"] == "WrongPassword"
+    assert response.json["msg"] == "WrongUsernameOrPassword"
     assert response.status_code == 200
 
 

From e1769afcf6ed9920877436fa20bc0976c73855b2 Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 26 Nov 2025 11:51:17 +0100
Subject: [PATCH 15/16] refactor: returning sessions to context manager
 implementation

---
 .../src/client/app/src/pages/auth/SignUp.js   |   2 -
 server/user/views.py                          | 267 +++++++++---------
 2 files changed, 141 insertions(+), 128 deletions(-)

diff --git a/server/src/client/app/src/pages/auth/SignUp.js b/server/src/client/app/src/pages/auth/SignUp.js
index ae25bd9a..4454c1db 100755
--- a/server/src/client/app/src/pages/auth/SignUp.js
+++ b/server/src/client/app/src/pages/auth/SignUp.js
@@ -60,8 +60,6 @@ function SignUp() {
       password: password
     };
 
-    console.log("Registration data: ", registrationData);
-
     if (password.length < MIN_PASSWORD_LENGTH) {
      // Password must meet minimum length
      // Using NIST recommendation
diff --git a/server/user/views.py b/server/user/views.py
index 33112f2b..c458824e 100644
--- a/server/user/views.py
+++ b/server/user/views.py
@@ -40,7 +40,7 @@ def check_if_token_in_blocklist(jwt_header, decrypted_token):
 
 
 @user_blueprint.route("/login", methods=["POST"])
-def login(session=Session()):
+def login():
     """
     Login
 
@@ -48,110 +48,117 @@ def login(session=Session()):
     2. Checks password and if user is confirmed
     3. Logs in user next with access token
     """
-
-    jobj = request.get_json()
-     # need to inspect jobj. Is `email` actually username or is there also a `username`?
-    user = session.query(User).filter_by(email=jobj["email"]).first()
-
-    if user is None:
-        print("User does not exist")
-        return jsonify({"msg": "WrongUsernameOrPassword"}), 200
-
-    elif not user.check_password(jobj["password"]):
-        print("Wrong password")
-        return jsonify({"msg": "WrongUsernameOrPassword"}), 200
-
-    elif user.active == 0:
-        print("User not confirmed")
-        return jsonify({"msg": "UserNotConfirmed"}), 200
-
-    else:
-        user_g = session.query(UserGroups).filter_by(user_id=user.id).first()
-        if user_g is None:
-            user_ = UserGroups(user_id=user.id)
-            user_.set_group()
-            session.add(user_)
-            session.commit()
-        access_token = create_access_token(identity=user.username)
-        testing = strtobool(os.environ.get("TESTING", "True"))
-        print(testing)
-        if testing:
-            print("executed")
-            os.environ["TEST_ACCESS_TOKEN"] = access_token
-            # exporting access token to environment for testing
-        return jsonify(access_token=access_token), 200
+     
+    with Session() as session: 
+        jobj = request.get_json()
+
+        # need to inspect jobj. Is `email` actually username or is there also a `username`?
+        user = session.query(User).filter_by(email=jobj["email"]).first()
+
+        if user is None:
+            print("User does not exist")
+            return jsonify({"msg": "WrongUsernameOrPassword"}), 200
+
+        elif not user.check_password(jobj["password"]):
+            print("Wrong password")
+            return jsonify({"msg": "WrongUsernameOrPassword"}), 200
+
+        elif user.active == 0:
+            print("User not confirmed")
+            return jsonify({"msg": "UserNotConfirmed"}), 200
+
+        else:
+            user_g = session.query(UserGroups).filter_by(user_id=user.id).first()
+            if user_g is None:
+                user_ = UserGroups(user_id=user.id)
+                user_.set_group()
+                session.add(user_)
+                session.commit()
+            access_token = create_access_token(identity=user.username)
+            testing = strtobool(os.environ.get("TESTING", "True"))
+            print(testing)
+            if testing:
+                print("executed")
+                os.environ["TEST_ACCESS_TOKEN"] = access_token
+                # exporting access token to environment for testing
+            return jsonify(access_token=access_token), 200
 
 
 @user_blueprint.route("/profile", methods=["GET", "POST"])
 @jwt_required()
-def profile(session=Session()):
+def profile():
     """
     Function to edit and retrieve user profile information
     """
-    current_user = get_jwt_identity()
-    user = session.query(User).filter_by(username=current_user).first()
-    if request.method == "GET":
-        return (
-            jsonify(
-                {
-                    "username": user.username,
-                    "bio": user.bio,
-                    "first_name": user.first_name,
-                    "last_name": user.last_name,
-                    "email": user.email,
-                    "image": user.image,
-                    "id": user.id,
-                }
-            ),
-            200,
-        )
-    elif request.method == "POST":
-        data = request.get_json()
-        # print(data['image'])
-        user.update_bio(data["bio"])
-        user.update_first_name(data["first_name"])
-        user.update_last_name(data["last_name"])
-        if data["email"] != user.email:
-            print("email changed")
-            token = secrets.token_hex()
-            user.update_activation_code(token)
-            confirmation_email(data["email"], token)
-            user.update_email(data["email"])
 
-        session.merge(user)
-        session.commit()
-        return jsonify({"msg": "User information changed"}), 200
-    else:
-        return jsonify({"msg": "profile OK"}), 200
+    with Session() as session:
+        current_user = get_jwt_identity()
+
+        user = session.query(User).filter_by(username=current_user).first()
+        if request.method == "GET":
+            return (
+                jsonify(
+                    {
+                        "username": user.username,
+                        "bio": user.bio,
+                        "first_name": user.first_name,
+                        "last_name": user.last_name,
+                        "email": user.email,
+                        "image": user.image,
+                        "id": user.id,
+                    }
+                ),
+                200,
+            )
+        elif request.method == "POST":
+            data = request.get_json()
+            # print(data['image'])
+            user.update_bio(data["bio"])
+            user.update_first_name(data["first_name"])
+            user.update_last_name(data["last_name"])
+            if data["email"] != user.email:
+                print("email changed")
+                token = secrets.token_hex()
+                user.update_activation_code(token)
+                confirmation_email(data["email"], token)
+                user.update_email(data["email"])
+
+            session.merge(user)
+            session.commit()
+            return jsonify({"msg": "User information changed"}), 200
+        else:
+            return jsonify({"msg": "profile OK"}), 200
 
 
 @jwt_required()
 @user_blueprint.route("/verifytoken", methods=["GET"])
-def verifytoken(session=Session()):
+def verifytoken():
     return "token-valid"
 
 
 # TODO Change Address before production
 @user_blueprint.route("/image", methods=["POST"])
 @jwt_required()
-def image(session=Session()):
+def image():
     """Function to receive and set user image"""
-    current_user = get_jwt_identity()
-    user = session.query(User).filter_by(username=current_user).first()
-    f = request.files["file"]
-    Path("dev_data/" + str(user.username)).mkdir(parents=True, exist_ok=True)
-    f.save(
-        os.path.join("dev_data/" + str(user.username) + "/", secure_filename(f.filename))
-    )
-    path = "imgs/dev_data/" + str(user.username) + "/" + secure_filename(f.filename)
-    user.update_image_address(path)
-    session.merge(user)
-    session.commit()
-    return jsonify({"msg": "User image changed"}), 200
+    
+    with Session() as session:
+        current_user = get_jwt_identity()
+        user = session.query(User).filter_by(username=current_user).first()
+        f = request.files["file"]
+        Path("dev_data/" + str(user.username)).mkdir(parents=True, exist_ok=True)
+        f.save(
+            os.path.join("dev_data/" + str(user.username) + "/", secure_filename(f.filename))
+        )
+        path = "imgs/dev_data/" + str(user.username) + "/" + secure_filename(f.filename)
+        user.update_image_address(path)
+        session.merge(user)
+        session.commit()
+        return jsonify({"msg": "User image changed"}), 200
 
 
 @user_blueprint.route("/imgs/<path:path>")
-def images(path, session=Session()):
+def images(path):
     try:
         im = Image.open(path)
         # im.thumbnail((w, h), Image.ANTIALIAS)
@@ -167,7 +174,7 @@ def images(path, session=Session()):
 
 @user_blueprint.route("/logout", methods=["POST"])
 @jwt_required()
-def logout(session=Session()):
+def logout():
     """Function to logout user"""
     jti = get_jwt()["jti"]
     blocklist.add(jti)
@@ -176,26 +183,28 @@ def logout(session=Session()):
 
 @user_blueprint.route("/api-key", methods=["POST", "GET"])
 @jwt_required()
-def apikey(session=Session()):
+def apikey():
     """Change and retrieve API-Key"""
-    current_user = get_jwt_identity()
-    user = session.query(User).filter_by(username=current_user).first()
-    if request.method == "GET":
-        api_key = user.session_hash
-        return jsonify({"apikey": api_key}), 200
-    elif request.method == "POST":
-        user.set_session_hash()
-        session.merge(user)
-        session.commit()
-        return jsonify({
-            "msg": "API Key updated",
-            "apikey": user.session_hash
-        }), 200
+
+    with Session() as session:
+        current_user = get_jwt_identity()
+        user = session.query(User).filter_by(username=current_user).first()
+        if request.method == "GET":
+            api_key = user.session_hash
+            return jsonify({"apikey": api_key}), 200
+        elif request.method == "POST":
+            user.set_session_hash()
+            session.merge(user)
+            session.commit()
+            return jsonify({
+                "msg": "API Key updated",
+                "apikey": user.session_hash
+            }), 200
 
 
 @user_blueprint.route("/delete", methods=["GET", "POST"])
 @jwt_required()
-def delete_user(session=Session()):
+def delete_user():
     """Delete current user: Frontend and functionality not decided yet"""
     # current_user = get_jwt_identity()
     # user = session.query(User).filter(User.email == current_user).first()
@@ -205,44 +214,50 @@ def delete_user(session=Session()):
 
 
 @user_blueprint.route("/forgot-token", methods=["POST"])
-def forgot_token(session=Session()):
+def forgot_token():
     """Check for forgotten_password_code"""
-    data = request.get_json()
-    try:
-        user = user_from_token(data, "forgotten_password_code", session)
-        if user:
-            # user verified by token
-            return jsonify({"msg": "Token confirmed"}), 200
-    except ValueError as e:
-        print(e)
-       
-    # user could not be verified by token
-    return jsonify({"msg": "Error"}), 401
+
+    with Session() as session:
+        data = request.get_json()
+        try:
+            user = user_from_token(session, data, "forgotten_password_code")
+            if user:
+                # user verified by token
+                return jsonify({"msg": "Token confirmed"}), 200
+        except ValueError as e:
+            print(e)
+
+        # user could not be verified by token
+        return jsonify({"msg": "Error"}), 401
 
 
 @user_blueprint.route("/resetpassword", methods=["POST"])
-def reset(session=Session()):
+def reset():
     """Changes user password"""
-    data = request.get_json()
-    user = user_from_token(data, "forgotten_password_code", session)
-    user.set_password(data["password"])
-    session.merge(user)
-    session.commit()
-    return jsonify({"msg": "Password changed"}), 200
+
+    with Session() as session:
+        data = request.get_json()
+        user = user_from_token(session, data, "forgotten_password_code")
+        user.set_password(data["password"])
+        session.merge(user)
+        session.commit()
+        return jsonify({"msg": "Password changed"}), 200
 
 
 @user_blueprint.route("/confirmation", methods=["POST"])
-def confirm_user(session=Session()):
+def confirm_user():
     """Activates user"""
-    data = request.get_json()
-    user = user_from_token(data, "activation_code", session)
-    user.update_activation()
-    session.merge(user)
-    session.commit()
-    return jsonify({"msg": "User confirmed"}), 200
+
+    with Session() as session:
+        data = request.get_json()
+        user = user_from_token(session, data, "activation_code")
+        user.update_activation()
+        session.merge(user)
+        session.commit()
+        return jsonify({"msg": "User confirmed"}), 200
 
 
-def user_from_token(data, token_name, session=Session()):
+def user_from_token(session: Session, data, token_name):
     url = data["url"]
     parsed = urlparse(url)
     (token, ) = parse_qs(parsed.query)["token"]

From 903b94d5773338822195b296fb71bd7447f7149d Mon Sep 17 00:00:00 2001
From: Omosola Odetunde <omosola.odetunde@gmail.com>
Date: Wed, 26 Nov 2025 13:20:18 +0100
Subject: [PATCH 16/16] tests: explicitly disabling email sending in test

---
 server/public/views.py | 12 ++++++------
 tests/conftest.py      |  8 ++++++++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/server/public/views.py b/server/public/views.py
index e9e6dd48..50088464 100644
--- a/server/public/views.py
+++ b/server/public/views.py
@@ -22,8 +22,8 @@
 CORS(blueprint)
 
 
-DO_SEND_EMAIL = strtobool(os.environ.get("SEND_EMAIL", "True"))
-
+def email_enabled():
+    return strtobool(os.getenv("SEND_EMAIL", "True"))
 
 @blueprint.route("/signup", methods=["POST"])
 def signupfunc():
@@ -45,7 +45,7 @@ def signupfunc():
             user.remember_code = "0000"
             user.created_on = "0000"
             user.last_login = "0000"
-            user.active = "0" if DO_SEND_EMAIL else "1"
+            user.active = "0" if email_enabled() else "1"
             user.first_name = register_obj["first_name"]
             user.last_name = register_obj["last_name"]
             user.company = "0000"
@@ -59,7 +59,7 @@ def signupfunc():
             user.password_hash = "0000"
             token = secrets.token_hex()
             user.update_activation_code(token)
-            if DO_SEND_EMAIL:
+            if email_enabled():
                 confirmation_email(user.email, token)
             session.add(user)
             session.commit()
@@ -81,7 +81,7 @@ def password():
         token = secrets.token_hex()
         user.update_forgotten_code(token)
         # user.update_forgotten_time(timestamp)
-        if DO_SEND_EMAIL:
+        if email_enabled():
             forgot_password_email(user.email, token)
         session.merge(user)
         session.commit()
@@ -100,7 +100,7 @@ def confirmation_token():
             return jsonify({"msg": "User confirmation token sent"}), 200
         token = secrets.token_hex()
         user.update_activation_code(token)
-        if DO_SEND_EMAIL:
+        if email_enabled():
             confirmation_email(user.email, token)
         # updating user groups here
         user_group = UserGroups(user_id=user.id, group_id=2)
diff --git a/tests/conftest.py b/tests/conftest.py
index 3927ff13..de453932 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -10,6 +10,14 @@
 myPath = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, myPath + "/../")
 
+
+# Currently disable email in testing
+@pytest.fixture(scope="module", autouse=True)
+def disable_email_send():
+    os.environ['SEND_EMAIL'] = "False"
+    yield
+
+
 @pytest.fixture(scope="module")
 def test_client():
     flask_app = app