feat(auth): add MINDA_DEMO support with auto-seeded demo accounts and username login

internal/api/server_test.go

@@ -431,3 +431,90 @@ func TestNewFullFeatures(t *testing.T) {
 		t.Fatalf("expected updated kanbanStatus and notes, got %+v", updatedThought)
 	}
 }
+
+func TestLoginWithUsernameAndDemoMode(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "demo_api_test.db")
+	store, err := storage.NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("failed to create store: %v", err)
+	}
+	defer store.Close()
+
+	if err := store.EnsureDemoAccounts(); err != nil {
+		t.Fatalf("failed to seed demo accounts: %v", err)
+	}
+
+	cfg := &config.Config{
+		Port:         "8080",
+		DatabasePath: dbPath,
+		JWTSecret:    "demo-jwt-secret",
+		DemoMode:     true,
+	}
+	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	router := srv.Router()
+
+	// 1. Check auth status reports demoMode: true
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/status", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK from /api/v1/auth/status, got %d", rec.Code)
+	}
+	var statusResp struct {
+		NeedsSetup bool `json:"needsSetup"`
+		DemoMode   bool `json:"demoMode"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &statusResp)
+	if !statusResp.DemoMode {
+		t.Fatalf("expected demoMode=true, got %v", statusResp.DemoMode)
+	}
+	if statusResp.NeedsSetup {
+		t.Fatalf("expected needsSetup=false when demo accounts exist, got %v", statusResp.NeedsSetup)
+	}
+
+	// 2. Login with username "admin" / "admin"
+	loginBody := []byte(`{"email":"admin","password":"admin"}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", bytes.NewReader(loginBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK for admin login, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var loginRes struct {
+		Token string      `json:"token"`
+		User  domain.User `json:"user"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &loginRes)
+	if loginRes.Token == "" || loginRes.User.Role != "admin" {
+		t.Fatalf("invalid admin login response: %+v", loginRes)
+	}
+
+	// 3. Login with username "user" / "user"
+	userLoginBody := []byte(`{"username":"user","password":"user"}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", bytes.NewReader(userLoginBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK for user login, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var userLoginRes struct {
+		Token string      `json:"token"`
+		User  domain.User `json:"user"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &userLoginRes)
+	if userLoginRes.Token == "" || userLoginRes.User.Role != "member" {
+		t.Fatalf("invalid user login response: %+v", userLoginRes)
+	}
+
+	// 4. Invalid credentials must return 401
+	wrongLoginBody := []byte(`{"login":"admin","password":"wrongpassword"}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", bytes.NewReader(wrongLoginBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401 Unauthorized for wrong password, got %d", rec.Code)
+	}
+}