init tests

.containerignore

@@ -0,0 +1,4 @@
+api/target
+web/node_modules
+web/dist
+.git

.github/workflows/test.yml

@@ -0,0 +1,114 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  backend:
+    name: Backend tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: api
+
+      - name: Run tests
+        working-directory: api
+        run: cargo test
+
+  frontend-unit:
+    name: Frontend unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        working-directory: web
+        run: npm ci
+
+      - name: Run tests
+        working-directory: web
+        run: npx vitest run
+
+  e2e:
+    name: E2E tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: api
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: web
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: web
+        run: npx playwright install --with-deps chromium
+
+      - name: Build frontend
+        working-directory: web
+        run: npm run build-only
+
+      - name: Build backend
+        working-directory: api
+        run: cargo build --release
+
+      - name: Start backend
+        env:
+          TMDB_API_KEY: test
+          MDBLIST_API_KEY: test
+          JWT_SECRET: abababababababababababababababababababababababababababababababab
+          LISTEN_ADDR: 0.0.0.0:3333
+          COOKIE_SECURE: "false"
+          CACHE_DIR: /tmp/openposterdb-e2e
+          STATIC_DIR: web/dist
+        run: |
+          mkdir -p "$CACHE_DIR"
+          api/target/release/openposterdb-api &
+          for i in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:3333/api/auth/status > /dev/null 2>&1; then
+              echo "Backend ready"
+              break
+            fi
+            sleep 1
+          done
+
+      - name: Run E2E tests
+        working-directory: web
+        env:
+          CI: true
+        run: npx playwright test --project=setup --project=chromium
+
+      - uses: actions/upload-artifact@v4
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: web/playwright-report/
+          retention-days: 7

Containerfile

@@ -0,0 +1,28 @@
+FROM rust:1-bookworm AS api-builder
+WORKDIR /app
+COPY api/ .
+ARG CARGO_FEATURES=""
+RUN cargo build --release --features "${CARGO_FEATURES}"
+
+FROM node:22-bookworm AS web-builder
+WORKDIR /app
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ .
+RUN npm run build-only
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y ca-certificates curl && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system opdb && useradd --system --gid opdb --create-home opdb
+COPY --from=api-builder /app/target/release/openposterdb-api /usr/local/bin/openposterdb
+COPY --from=web-builder /app/dist /app/dist
+
+RUN mkdir -p /data/cache && chown -R opdb:opdb /data
+USER opdb
+
+ENV STATIC_DIR=/app/dist
+ENV CACHE_DIR=/data/cache
+EXPOSE 3000
+HEALTHCHECK --interval=10s --timeout=3s --start-period=5s \
+    CMD curl -sf http://localhost:3000/api/auth/status || exit 1
+CMD ["openposterdb"]

README.md

@@ -51,6 +51,26 @@ npm run dev        # development
 npm run build      # production
 ```
 
+### Docker
+
+```bash
+# Create a .env file
+cat > .env << EOF
+TMDB_API_KEY=your_key
+OMDB_API_KEY=your_key       # and/or MDBLIST_API_KEY
+JWT_SECRET=$(openssl rand -hex 32)
+EOF
+
+# Build and start
+docker compose up -d
+```
+
+The web UI will be available at `http://localhost:3000`. On first visit you'll be prompted to create an admin account.
+
+If you access the UI over plain HTTP (no reverse proxy with TLS), add `COOKIE_SECURE=false` to your `.env` — otherwise the browser will silently drop auth cookies and login will appear broken.
+
+See [docker-compose.yml](docker-compose.yml) for the full compose configuration.
+
 ## Configuration
 
 | Variable | Default | Description |

api/Cargo.lock

@@ -1577,6 +1577,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -2146,6 +2152,16 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2393,10 +2409,12 @@ dependencies = [
  "chrono",
  "dashmap",
  "dotenvy",
+ "http-body-util",
  "image",
  "imageproc",
  "jsonwebtoken",
  "moka",
+ "openposterdb-api",
  "rand 0.9.2",
  "reqwest",
  "sea-orm",
@@ -2406,6 +2424,7 @@ dependencies = [
  "sqlx",
  "thiserror 2.0.18",
  "tokio",
+ "tower",
  "tower-http",
  "tower_governor",
  "tracing",
@@ -4368,7 +4387,13 @@ dependencies = [
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
  "iri-string",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
  "tokio",
  "tokio-util",
@@ -4497,6 +4522,12 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"

api/Cargo.toml

@@ -15,7 +15,7 @@ ab_glyph = "0.2.32"
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
 thiserror = "2.0.18"
-tower-http = { version = "0.6.8", features = ["trace", "cors", "compression-gzip"] }
+tower-http = { version = "0.6.8", features = ["trace", "cors", "compression-gzip", "fs"] }
 dashmap = "6.1.0"
 moka = { version = "0.12.14", features = ["future", "sync"] }
 dotenvy = "0.15.7"
@@ -29,3 +29,11 @@ rand = "0.9.2"
 chrono = "0.4.44"
 zeroize = { version = "1.8.2", features = ["derive"] }
 tower_governor = "0.8.0"
+
+[features]
+test-support = []
+
+[dev-dependencies]
+openposterdb-api = { path = ".", features = ["test-support"] }
+tower = { version = "0.5", features = ["util"] }
+http-body-util = "0.1"

api/src/cache/mod.rs

@@ -150,3 +150,90 @@ pub fn compute_stale_secs(
     // Linear interpolation: min_stale at age=0, approaches max_age at age=max_age
     min_stale + film_age * (max_age - min_stale) / max_age
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn compute_stale_no_release_date() {
+        let result = compute_stale_secs(None, 86400, 31_536_000);
+        assert_eq!(result, 86400);
+    }
+
+    #[test]
+    fn compute_stale_invalid_date() {
+        let result = compute_stale_secs(Some("not-a-date"), 86400, 31_536_000);
+        assert_eq!(result, 86400);
+    }
+
+    #[test]
+    fn compute_stale_future_film() {
+        let result = compute_stale_secs(Some("2099-01-01"), 86400, 31_536_000);
+        assert_eq!(result, 86400);
+    }
+
+    #[test]
+    fn compute_stale_old_film() {
+        // Film from 2000 — age far exceeds max_age of 1 year
+        let result = compute_stale_secs(Some("2000-01-01"), 86400, 31_536_000);
+        assert_eq!(result, 0);
+    }
+
+    #[test]
+    fn date_str_to_epoch_known_value() {
+        // 1970-01-02 should be exactly 86400 seconds
+        assert_eq!(date_str_to_epoch("1970-01-02"), Some(86400));
+    }
+
+    #[test]
+    fn date_str_to_epoch_epoch_start() {
+        assert_eq!(date_str_to_epoch("1970-01-01"), Some(0));
+    }
+
+    #[test]
+    fn date_str_to_epoch_invalid_month() {
+        assert_eq!(date_str_to_epoch("2020-13-01"), None);
+    }
+
+    #[test]
+    fn date_str_to_epoch_invalid_day() {
+        assert_eq!(date_str_to_epoch("2020-01-32"), None);
+    }
+
+    #[test]
+    fn date_str_to_epoch_pre_epoch() {
+        assert_eq!(date_str_to_epoch("1969-01-01"), None);
+    }
+
+    #[test]
+    fn date_str_to_epoch_garbage() {
+        assert_eq!(date_str_to_epoch("garbage"), None);
+    }
+
+    #[test]
+    fn cache_path_construction() {
+        let p = cache_path("/tmp/cache", "imdb", "tt1234567");
+        assert_eq!(p, PathBuf::from("/tmp/cache/imdb/tt1234567.jpg"));
+    }
+
+    #[test]
+    fn poster_cache_path_strips_leading_slash() {
+        let p = poster_cache_path("/tmp/cache", "/abc123.jpg");
+        assert_eq!(p, PathBuf::from("/tmp/cache/posters/abc123.jpg"));
+    }
+
+    #[test]
+    fn poster_cache_path_no_leading_slash() {
+        let p = poster_cache_path("/tmp/cache", "abc123.jpg");
+        assert_eq!(p, PathBuf::from("/tmp/cache/posters/abc123.jpg"));
+    }
+
+    #[test]
+    fn is_leap_year_cases() {
+        assert!(is_leap(2000)); // divisible by 400
+        assert!(is_leap(2024)); // divisible by 4, not by 100
+        assert!(!is_leap(1900)); // divisible by 100, not by 400
+        assert!(!is_leap(2023)); // not divisible by 4
+    }
+}

api/src/config.rs

@@ -12,6 +12,7 @@ pub struct Config {
     pub poster_quality: u8,
     pub mdblist_api_key: Option<String>,
     pub poster_mem_cache_mb: u64,
+    pub static_dir: Option<String>,
 }
 
 impl Config {
@@ -42,6 +43,7 @@ impl Config {
                 .ok()
                 .and_then(|v| v.parse().ok())
                 .unwrap_or(512),
+            static_dir: env::var("STATIC_DIR").ok(),
         };
 
         if config.omdb_api_key.is_none() && config.mdblist_api_key.is_none() {

api/src/error.rs

@@ -52,3 +52,66 @@ impl IntoResponse for AppError {
         (status, axum::Json(json!({ "error": message }))).into_response()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::http::StatusCode;
+
+    fn status_of(err: AppError) -> StatusCode {
+        err.into_response().status()
+    }
+
+    #[test]
+    fn invalid_id_type_is_400() {
+        assert_eq!(
+            status_of(AppError::InvalidIdType("x".into())),
+            StatusCode::BAD_REQUEST
+        );
+    }
+
+    #[test]
+    fn id_not_found_is_404() {
+        assert_eq!(
+            status_of(AppError::IdNotFound("x".into())),
+            StatusCode::NOT_FOUND
+        );
+    }
+
+    #[test]
+    fn unauthorized_is_401() {
+        assert_eq!(status_of(AppError::Unauthorized), StatusCode::UNAUTHORIZED);
+    }
+
+    #[test]
+    fn forbidden_is_403() {
+        assert_eq!(
+            status_of(AppError::Forbidden("x".into())),
+            StatusCode::FORBIDDEN
+        );
+    }
+
+    #[test]
+    fn bad_request_is_400() {
+        assert_eq!(
+            status_of(AppError::BadRequest("x".into())),
+            StatusCode::BAD_REQUEST
+        );
+    }
+
+    #[test]
+    fn db_error_is_500() {
+        assert_eq!(
+            status_of(AppError::DbError("x".into())),
+            StatusCode::INTERNAL_SERVER_ERROR
+        );
+    }
+
+    #[test]
+    fn other_is_500() {
+        assert_eq!(
+            status_of(AppError::Other("x".into())),
+            StatusCode::INTERNAL_SERVER_ERROR
+        );
+    }
+}

api/src/handlers/auth.rs

@@ -337,4 +337,71 @@ mod tests {
         let b = hash_refresh_token("token_b");
         assert_ne!(a, b);
     }
+
+    #[test]
+    fn refresh_cookie_secure() {
+        let cookie = refresh_cookie("abc123", 604800, true);
+        assert!(cookie.contains("refresh_token=abc123"));
+        assert!(cookie.contains("HttpOnly"));
+        assert!(cookie.contains("SameSite=Strict"));
+        assert!(cookie.contains("Path=/api/auth/refresh"));
+        assert!(cookie.contains("Max-Age=604800"));
+        assert!(cookie.contains("; Secure"));
+    }
+
+    #[test]
+    fn refresh_cookie_insecure() {
+        let cookie = refresh_cookie("abc123", 604800, false);
+        assert!(cookie.contains("refresh_token=abc123"));
+        assert!(!cookie.contains("; Secure"));
+    }
+
+    #[test]
+    fn refresh_cookie_zero_max_age() {
+        let cookie = refresh_cookie("", 0, false);
+        assert!(cookie.contains("refresh_token="));
+        assert!(cookie.contains("Max-Age=0"));
+    }
+
+    #[test]
+    fn extract_refresh_token_present() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            HeaderValue::from_static("refresh_token=mytoken123"),
+        );
+        assert_eq!(
+            extract_refresh_token_from_cookies(&headers),
+            Some("mytoken123".to_string())
+        );
+    }
+
+    #[test]
+    fn extract_refresh_token_missing() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            HeaderValue::from_static("other=value"),
+        );
+        assert_eq!(extract_refresh_token_from_cookies(&headers), None);
+    }
+
+    #[test]
+    fn extract_refresh_token_multiple_cookies() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            HeaderValue::from_static("foo=bar; refresh_token=mytoken; baz=qux"),
+        );
+        assert_eq!(
+            extract_refresh_token_from_cookies(&headers),
+            Some("mytoken".to_string())
+        );
+    }
+
+    #[test]
+    fn extract_refresh_token_no_cookie_header() {
+        let headers = HeaderMap::new();
+        assert_eq!(extract_refresh_token_from_cookies(&headers), None);
+    }
 }

api/src/lib.rs

@@ -0,0 +1,121 @@
+pub mod cache;
+pub mod config;
+pub mod entity;
+pub mod error;
+pub mod handlers;
+pub mod id;
+pub mod poster;
+pub mod routes;
+pub mod services;
+
+use std::sync::Arc;
+
+use ab_glyph::FontArc;
+use axum::middleware;
+use axum::Router;
+use dashmap::DashMap;
+use sea_orm::DatabaseConnection;
+use tower_http::compression::CompressionLayer;
+use tower_http::cors::CorsLayer;
+use tower_http::trace::TraceLayer;
+use zeroize::Zeroizing;
+
+use cache::MemCacheEntry;
+use config::Config;
+use id::ResolvedId;
+use services::mdblist::MdblistClient;
+use services::omdb::OmdbClient;
+use services::ratings::RatingBadge;
+use services::tmdb::TmdbClient;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub config: Config,
+    pub tmdb: TmdbClient,
+    pub omdb: Option<OmdbClient>,
+    pub mdblist: Option<MdblistClient>,
+    pub http: reqwest::Client,
+    pub font: FontArc,
+    pub refresh_locks: moka::sync::Cache<String, ()>,
+    pub db: DatabaseConnection,
+    pub jwt_secret: Zeroizing<Vec<u8>>,
+    pub secure_cookies: bool,
+    pub api_key_cache: moka::future::Cache<String, Option<i32>>,
+    pub poster_inflight: moka::future::Cache<String, bytes::Bytes>,
+    pub id_cache: moka::future::Cache<String, ResolvedId>,
+    pub ratings_cache: moka::future::Cache<String, Vec<RatingBadge>>,
+    pub poster_mem_cache: moka::future::Cache<String, MemCacheEntry>,
+    pub pending_last_used: Arc<DashMap<i32, ()>>,
+}
+
+pub static FONT_BYTES: &[u8] = include_bytes!("../assets/fonts/Inter-Bold.ttf");
+
+pub const SCHEMA_SQL: &[&str] = &[
+    "CREATE TABLE IF NOT EXISTS poster_meta (
+        cache_key TEXT PRIMARY KEY,
+        release_date TEXT,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+    )",
+    "CREATE TABLE IF NOT EXISTS admin_users (
+        id            INTEGER PRIMARY KEY AUTOINCREMENT,
+        username      TEXT NOT NULL UNIQUE,
+        password_hash TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+    )",
+    "CREATE TABLE IF NOT EXISTS refresh_tokens (
+        id          INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id     INTEGER NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
+        token_hash  TEXT NOT NULL UNIQUE,
+        expires_at  TEXT NOT NULL,
+        created_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    )",
+    "CREATE TABLE IF NOT EXISTS api_keys (
+        id           INTEGER PRIMARY KEY AUTOINCREMENT,
+        name         TEXT NOT NULL,
+        key_hash     TEXT NOT NULL UNIQUE,
+        key_prefix   TEXT NOT NULL,
+        created_by   INTEGER NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
+        created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+        last_used_at TEXT
+    )",
+];
+
+pub fn build_app(state: Arc<AppState>) -> Router {
+    let admin_routes = routes::api_keys::api_key_routes()
+        .route(
+            "/api/auth/logout",
+            axum::routing::post(handlers::auth::logout),
+        )
+        .layer(middleware::from_fn_with_state(
+            state.clone(),
+            handlers::middleware::require_auth,
+        ));
+
+    let compressed_routes = Router::new()
+        .merge(routes::auth::auth_routes())
+        .merge(admin_routes)
+        .layer(CompressionLayer::new());
+
+    let mut app = Router::new()
+        .route(
+            "/{api_key}/{id_type}/poster-default/{id_value}",
+            axum::routing::get(routes::poster::handler),
+        )
+        .merge(compressed_routes);
+
+    // Serve static frontend files when STATIC_DIR is set.
+    // Falls back to index.html for SPA client-side routing.
+    if let Some(ref dir) = state.config.static_dir {
+        use tower_http::services::{ServeDir, ServeFile};
+        let index = format!("{dir}/index.html");
+        app = app.fallback_service(ServeDir::new(dir).fallback(ServeFile::new(index)));
+    }
+
+    app.layer(middleware::from_fn(
+            handlers::middleware::validate_origin,
+        ))
+        .layer(TraceLayer::new_for_http())
+        .layer(CorsLayer::permissive())
+        .with_state(state)
+}

api/src/main.rs

@@ -1,64 +1,29 @@
-mod cache;
-mod config;
-mod entity;
-mod error;
-mod handlers;
-mod id;
-mod poster;
-mod routes;
-mod services;
-
 use std::net::SocketAddr;
 use std::sync::Arc;
 use std::time::Duration;
 
 use ab_glyph::FontArc;
-use axum::middleware;
-use axum::Router;
 use dashmap::DashMap;
 use sea_orm::{ConnectionTrait, DatabaseConnection, SqlxSqliteConnector};
-use tower_http::compression::CompressionLayer;
-use tower_http::cors::CorsLayer;
-use tower_http::trace::TraceLayer;
 use tracing_subscriber::EnvFilter;
-use zeroize::Zeroizing;
-
-use cache::MemCacheEntry;
-use config::Config;
-use id::ResolvedId;
-use services::db;
-use services::mdblist::MdblistClient;
-use services::omdb::OmdbClient;
-use services::ratings::RatingBadge;
-use services::tmdb::TmdbClient;
 
-#[derive(Clone)]
-pub struct AppState {
-    pub config: Config,
-    pub tmdb: TmdbClient,
-    pub omdb: Option<OmdbClient>,
-    pub mdblist: Option<MdblistClient>,
-    pub http: reqwest::Client,
-    pub font: FontArc,
-    pub refresh_locks: moka::sync::Cache<String, ()>,
-    pub db: DatabaseConnection,
-    pub jwt_secret: Zeroizing<Vec<u8>>,
-    pub secure_cookies: bool,
-    pub api_key_cache: moka::future::Cache<String, Option<i32>>,
-    pub poster_inflight: moka::future::Cache<String, bytes::Bytes>,
-    pub id_cache: moka::future::Cache<String, ResolvedId>,
-    pub ratings_cache: moka::future::Cache<String, Vec<RatingBadge>>,
-    pub poster_mem_cache: moka::future::Cache<String, MemCacheEntry>,
-    pub pending_last_used: Arc<DashMap<i32, ()>>,
-}
-
-static FONT_BYTES: &[u8] = include_bytes!("../assets/fonts/Inter-Bold.ttf");
+use openposterdb_api::cache::MemCacheEntry;
+use openposterdb_api::config::Config;
+use openposterdb_api::handlers;
+use openposterdb_api::services::db;
+use openposterdb_api::services::mdblist::MdblistClient;
+use openposterdb_api::services::omdb::OmdbClient;
+use openposterdb_api::services::tmdb::TmdbClient;
+use openposterdb_api::{build_app, AppState, FONT_BYTES, SCHEMA_SQL};
 
 #[tokio::main]
 async fn main() {
     // Load .env file if present (ignored if missing)
     dotenvy::dotenv().ok();
 
+    #[cfg(feature = "test-support")]
+    eprintln!("WARNING: test-support feature is enabled — rate limiting is disabled. Do not use in production.");
+
     tracing_subscriber::fmt()
         .with_env_filter(
             EnvFilter::try_from_default_env()
@@ -110,54 +75,12 @@ async fn main() {
         .await
         .expect("failed to connect to database");
     let database: DatabaseConnection = SqlxSqliteConnector::from_sqlx_sqlite_pool(pool);
-    database
-        .execute_unprepared(
-            "CREATE TABLE IF NOT EXISTS poster_meta (
-            cache_key TEXT PRIMARY KEY,
-            release_date TEXT,
-            created_at INTEGER NOT NULL,
-            updated_at INTEGER NOT NULL
-        )",
-        )
-        .await
-        .expect("failed to create poster_meta table");
-    database
-        .execute_unprepared(
-            "CREATE TABLE IF NOT EXISTS admin_users (
-            id            INTEGER PRIMARY KEY AUTOINCREMENT,
-            username      TEXT NOT NULL UNIQUE,
-            password_hash TEXT NOT NULL,
-            created_at    TEXT NOT NULL DEFAULT (datetime('now'))
-        )",
-        )
-        .await
-        .expect("failed to create admin_users table");
-    database
-        .execute_unprepared(
-            "CREATE TABLE IF NOT EXISTS refresh_tokens (
-            id          INTEGER PRIMARY KEY AUTOINCREMENT,
-            user_id     INTEGER NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
-            token_hash  TEXT NOT NULL UNIQUE,
-            expires_at  TEXT NOT NULL,
-            created_at  TEXT NOT NULL DEFAULT (datetime('now'))
-        )",
-        )
-        .await
-        .expect("failed to create refresh_tokens table");
-    database
-        .execute_unprepared(
-            "CREATE TABLE IF NOT EXISTS api_keys (
-            id           INTEGER PRIMARY KEY AUTOINCREMENT,
-            name         TEXT NOT NULL,
-            key_hash     TEXT NOT NULL UNIQUE,
-            key_prefix   TEXT NOT NULL,
-            created_by   INTEGER NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
-            created_at   TEXT NOT NULL DEFAULT (datetime('now')),
-            last_used_at TEXT
-        )",
-        )
-        .await
-        .expect("failed to create api_keys table");
+    for sql in SCHEMA_SQL {
+        database
+            .execute_unprepared(sql)
+            .await
+            .expect("failed to create table");
+    }
 
     // Clean up expired refresh tokens
     match db::delete_expired_refresh_tokens(&database).await {
@@ -270,35 +193,7 @@ async fn main() {
         });
     }
 
-    // Admin-protected routes (JWT required)
-    let admin_routes = routes::api_keys::api_key_routes()
-        .route(
-            "/api/auth/logout",
-            axum::routing::post(handlers::auth::logout),
-        )
-        .layer(middleware::from_fn_with_state(
-            state.clone(),
-            handlers::middleware::require_auth,
-        ));
-
-    // Auth + admin routes get compression (JSON responses benefit)
-    let compressed_routes = Router::new()
-        .merge(routes::auth::auth_routes())
-        .merge(admin_routes)
-        .layer(CompressionLayer::new());
-
-    let app = Router::new()
-        .route(
-            "/{api_key}/{id_type}/poster-default/{id_value}",
-            axum::routing::get(routes::poster::handler),
-        )
-        .merge(compressed_routes)
-        .layer(middleware::from_fn(
-            handlers::middleware::validate_origin,
-        ))
-        .layer(TraceLayer::new_for_http())
-        .layer(CorsLayer::permissive())
-        .with_state(state.clone());
+    let app = build_app(state.clone());
 
     let listener = tokio::net::TcpListener::bind(&config.listen_addr)
         .await

api/src/routes/auth.rs

@@ -12,7 +12,7 @@ pub fn auth_routes() -> Router<Arc<AppState>> {
         .route("/api/auth/login", post(handlers::auth::login))
         .route("/api/auth/refresh", post(handlers::auth::refresh));
 
-    #[cfg(not(test))]
+    #[cfg(not(any(test, feature = "test-support")))]
     let rate_limited = {
         use axum::http::StatusCode;
         use axum::response::IntoResponse;

api/src/services/ratings.rs

@@ -192,6 +192,45 @@ async fn fetch_omdb_ratings(imdb_id: Option<&str>, omdb: Option<&OmdbClient>) ->
     Some(badges)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rating_source_labels() {
+        assert_eq!(RatingSource::Imdb.label(), "IMDb");
+        assert_eq!(RatingSource::Tmdb.label(), "TMDB");
+        assert_eq!(RatingSource::Rt.label(), "RTC");
+        assert_eq!(RatingSource::RtAudience.label(), "RTA");
+        assert_eq!(RatingSource::Metacritic.label(), "MC");
+        assert_eq!(RatingSource::Trakt.label(), "Trakt");
+        assert_eq!(RatingSource::Letterboxd.label(), "LB");
+        assert_eq!(RatingSource::Mal.label(), "MAL");
+    }
+
+    #[test]
+    fn rating_source_colors_unique_per_source() {
+        assert_eq!(RatingSource::Imdb.color(), Rgba([180, 145, 15, 255]));
+        assert_eq!(RatingSource::Tmdb.color(), Rgba([1, 155, 88, 255]));
+        assert_eq!(RatingSource::Rt.color(), Rgba([185, 35, 8, 255]));
+        assert_eq!(RatingSource::Metacritic.color(), Rgba([75, 150, 38, 255]));
+        assert_eq!(RatingSource::Trakt.color(), Rgba([175, 15, 45, 255]));
+        assert_eq!(RatingSource::Letterboxd.color(), Rgba([0, 155, 88, 255]));
+        assert_eq!(RatingSource::Mal.color(), Rgba([34, 60, 120, 255]));
+    }
+
+    #[test]
+    fn rt_and_rt_audience_share_color() {
+        assert_eq!(RatingSource::Rt.color(), RatingSource::RtAudience.color());
+    }
+
+    #[test]
+    fn rating_source_equality() {
+        assert_eq!(RatingSource::Imdb, RatingSource::Imdb);
+        assert_ne!(RatingSource::Imdb, RatingSource::Tmdb);
+    }
+}
+
 async fn fetch_mdblist_ratings(
     resolved: &ResolvedId,
     mdblist: Option<&MdblistClient>,

api/src/services/validation.rs

@@ -24,3 +24,68 @@ pub fn validate_password(password: &str) -> Result<(), AppError> {
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn validate_username_empty() {
+        assert!(validate_username("").is_err());
+    }
+
+    #[test]
+    fn validate_username_whitespace() {
+        assert!(validate_username("hello world").is_err());
+    }
+
+    #[test]
+    fn validate_username_tab() {
+        assert!(validate_username("hello\tworld").is_err());
+    }
+
+    #[test]
+    fn validate_username_control_chars() {
+        assert!(validate_username("hello\x00world").is_err());
+    }
+
+    #[test]
+    fn validate_username_valid() {
+        assert!(validate_username("admin").is_ok());
+    }
+
+    #[test]
+    fn validate_username_valid_with_special_chars() {
+        assert!(validate_username("admin-user_1").is_ok());
+    }
+
+    #[test]
+    fn validate_password_empty() {
+        assert!(validate_password("").is_err());
+    }
+
+    #[test]
+    fn validate_password_too_short() {
+        assert!(validate_password("short").is_err());
+    }
+
+    #[test]
+    fn validate_password_seven_chars() {
+        assert!(validate_password("1234567").is_err());
+    }
+
+    #[test]
+    fn validate_password_control_chars() {
+        assert!(validate_password("password\x01long_enough").is_err());
+    }
+
+    #[test]
+    fn validate_password_valid() {
+        assert!(validate_password("password123").is_ok());
+    }
+
+    #[test]
+    fn validate_password_exactly_8_chars() {
+        assert!(validate_password("12345678").is_ok());
+    }
+}

api/tests/api_keys.rs

@@ -0,0 +1,157 @@
+mod common;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+fn json_body(json: serde_json::Value) -> Body {
+    Body::from(json.to_string())
+}
+
+#[tokio::test]
+async fn create_key_authenticated() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .header("authorization", format!("Bearer {token}"))
+        .body(json_body(serde_json::json!({"name": "test-key"})))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(json["key"].is_string());
+    assert!(json["key_prefix"].is_string());
+    assert_eq!(json["name"], "test-key");
+}
+
+#[tokio::test]
+async fn list_keys_authenticated() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    // Create a key first
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .header("authorization", format!("Bearer {token}"))
+        .body(json_body(serde_json::json!({"name": "my-key"})))
+        .unwrap();
+    app.clone().oneshot(req).await.unwrap();
+
+    // List keys
+    let req = Request::builder()
+        .uri("/api/keys")
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let keys = json.as_array().unwrap();
+    assert_eq!(keys.len(), 1);
+    assert_eq!(keys[0]["name"], "my-key");
+}
+
+#[tokio::test]
+async fn delete_key_authenticated() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    // Create a key
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .header("authorization", format!("Bearer {token}"))
+        .body(json_body(serde_json::json!({"name": "to-delete"})))
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let id = json["id"].as_i64().unwrap();
+
+    // Delete the key
+    let req = Request::builder()
+        .method("DELETE")
+        .uri(format!("/api/keys/{id}"))
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    // Verify it's gone
+    let req = Request::builder()
+        .uri("/api/keys")
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(json.as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn endpoints_without_auth_return_401() {
+    let (app, _state) = common::setup_test_app().await;
+
+    // GET /api/keys without auth
+    let req = Request::builder()
+        .uri("/api/keys")
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+
+    // POST /api/keys without auth
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({"name": "test"})))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+
+    // DELETE /api/keys/1 without auth
+    let req = Request::builder()
+        .method("DELETE")
+        .uri("/api/keys/1")
+        .body(Body::empty())
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn create_key_with_empty_name() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .header("authorization", format!("Bearer {token}"))
+        .body(json_body(serde_json::json!({"name": ""})))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+}

api/tests/auth_flow.rs

@@ -0,0 +1,267 @@
+mod common;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+fn json_body(json: serde_json::Value) -> Body {
+    Body::from(json.to_string())
+}
+
+#[tokio::test]
+async fn setup_creates_admin_and_returns_token() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/setup")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let set_cookie = common::extract_set_cookie(res.headers());
+    assert!(set_cookie.is_some(), "should set refresh cookie");
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(json["token"].is_string());
+}
+
+#[tokio::test]
+async fn setup_fails_when_admin_exists() {
+    let (app, _state) = common::setup_test_app().await;
+
+    // First setup succeeds
+    common::setup_admin(&app).await;
+
+    // Second setup fails
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/setup")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin2",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn login_with_valid_credentials() {
+    let (app, _state) = common::setup_test_app().await;
+    common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/login")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(json["token"].is_string());
+}
+
+#[tokio::test]
+async fn login_with_wrong_password() {
+    let (app, _state) = common::setup_test_app().await;
+    common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/login")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin",
+            "password": "wrongpassword"
+        })))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn login_with_unknown_user() {
+    let (app, _state) = common::setup_test_app().await;
+    common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/login")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "nonexistent",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn refresh_with_valid_cookie() {
+    let (app, _state) = common::setup_test_app().await;
+
+    // Setup to get refresh token
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/setup")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    let set_cookie = common::extract_set_cookie(res.headers()).unwrap();
+    let refresh_token = common::extract_refresh_token(&set_cookie).unwrap();
+
+    // Use refresh token
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/refresh")
+        .header("cookie", format!("refresh_token={refresh_token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    // Should get new tokens
+    let new_set_cookie = common::extract_set_cookie(res.headers());
+    assert!(new_set_cookie.is_some(), "should set new refresh cookie");
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(json["token"].is_string());
+}
+
+#[tokio::test]
+async fn refresh_token_rotation_invalidates_old() {
+    let (app, _state) = common::setup_test_app().await;
+
+    // Setup to get refresh token
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/setup")
+        .header("content-type", "application/json")
+        .body(json_body(serde_json::json!({
+            "username": "admin",
+            "password": "testpassword123"
+        })))
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    let set_cookie = common::extract_set_cookie(res.headers()).unwrap();
+    let old_refresh = common::extract_refresh_token(&set_cookie).unwrap();
+
+    // Use refresh token (first time — should work)
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/refresh")
+        .header("cookie", format!("refresh_token={old_refresh}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    // Use same old refresh token again — should fail (rotated)
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/refresh")
+        .header("cookie", format!("refresh_token={old_refresh}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn refresh_without_cookie_returns_401() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/refresh")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn logout_clears_tokens() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/logout")
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let set_cookie = common::extract_set_cookie(res.headers()).unwrap();
+    assert!(set_cookie.contains("Max-Age=0"), "should clear cookie");
+}
+
+#[tokio::test]
+async fn auth_status_setup_required_true() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/api/auth/status")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(json["setup_required"], true);
+}
+
+#[tokio::test]
+async fn auth_status_setup_required_false() {
+    let (app, _state) = common::setup_test_app().await;
+    common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .uri("/api/auth/status")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(json["setup_required"], false);
+}

api/tests/common/mod.rs

@@ -0,0 +1,131 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use ab_glyph::FontArc;
+use dashmap::DashMap;
+use sea_orm::{ConnectionTrait, DatabaseConnection, SqlxSqliteConnector};
+use zeroize::Zeroizing;
+
+use openposterdb_api::config::Config;
+use openposterdb_api::services::tmdb::TmdbClient;
+use openposterdb_api::{build_app, AppState, FONT_BYTES, SCHEMA_SQL};
+
+pub async fn setup_test_app() -> (axum::Router, Arc<AppState>) {
+    let sqlite_opts = sqlx::sqlite::SqliteConnectOptions::new()
+        .filename(":memory:")
+        .create_if_missing(true);
+    let pool = sqlx::sqlite::SqlitePoolOptions::new()
+        .max_connections(1)
+        .connect_with(sqlite_opts)
+        .await
+        .expect("failed to connect to test database");
+    let db: DatabaseConnection = SqlxSqliteConnector::from_sqlx_sqlite_pool(pool);
+
+    for sql in SCHEMA_SQL {
+        db.execute_unprepared(sql).await.unwrap();
+    }
+
+    let jwt_secret = Zeroizing::new(vec![0xAB; 32]);
+    let http = reqwest::Client::new();
+    let font = FontArc::try_from_slice(FONT_BYTES).expect("failed to load font");
+
+    let api_key_cache = moka::future::Cache::builder()
+        .max_capacity(100)
+        .time_to_live(Duration::from_secs(300))
+        .build();
+    let poster_inflight = moka::future::Cache::builder()
+        .max_capacity(100)
+        .time_to_live(Duration::from_secs(30))
+        .build();
+    let id_cache = moka::future::Cache::builder()
+        .max_capacity(100)
+        .time_to_live(Duration::from_secs(3600))
+        .build();
+    let ratings_cache = moka::future::Cache::builder()
+        .max_capacity(100)
+        .time_to_live(Duration::from_secs(1800))
+        .build();
+    let poster_mem_cache = moka::future::Cache::builder()
+        .max_capacity(1024 * 1024)
+        .time_to_live(Duration::from_secs(3600))
+        .build();
+    let refresh_locks = moka::sync::Cache::builder()
+        .max_capacity(100)
+        .time_to_live(Duration::from_secs(300))
+        .build();
+
+    let state = Arc::new(AppState {
+        config: Config {
+            tmdb_api_key: "test".into(),
+            omdb_api_key: None,
+            cache_dir: "/tmp/openposterdb-test".into(),
+            listen_addr: "127.0.0.1:0".into(),
+            ratings_min_stale_secs: 86400,
+            ratings_max_age_secs: 31_536_000,
+            poster_stale_secs: 0,
+            poster_quality: 85,
+            mdblist_api_key: None,
+            poster_mem_cache_mb: 1,
+            static_dir: None,
+        },
+        tmdb: TmdbClient::new("test".into(), http.clone()),
+        omdb: None,
+        mdblist: None,
+        http,
+        font,
+        refresh_locks,
+        db,
+        jwt_secret,
+        secure_cookies: false,
+        api_key_cache,
+        poster_inflight,
+        id_cache,
+        ratings_cache,
+        poster_mem_cache,
+        pending_last_used: Arc::new(DashMap::new()),
+    });
+
+    let app = build_app(state.clone());
+    (app, state)
+}
+
+/// Helper to perform setup and get back an access token.
+pub async fn setup_admin(app: &axum::Router) -> String {
+    use axum::body::Body;
+    use axum::http::{Request, StatusCode};
+    use http_body_util::BodyExt;
+    use tower::ServiceExt;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/setup")
+        .header("content-type", "application/json")
+        .body(Body::from(
+            serde_json::json!({"username": "admin", "password": "testpassword123"}).to_string(),
+        ))
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    json["token"].as_str().unwrap().to_string()
+}
+
+/// Extract Set-Cookie header value from a response.
+pub fn extract_set_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
+    headers
+        .get(axum::http::header::SET_COOKIE)
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string())
+}
+
+/// Extract the refresh_token value from a Set-Cookie header.
+pub fn extract_refresh_token(set_cookie: &str) -> Option<String> {
+    set_cookie
+        .split(';')
+        .next()
+        .and_then(|s| s.strip_prefix("refresh_token="))
+        .map(|s| s.to_string())
+}

api/tests/middleware.rs

@@ -0,0 +1,134 @@
+mod common;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+#[tokio::test]
+async fn origin_validation_get_without_origin_allowed() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/api/auth/status")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    // GET without origin should pass (no CORS_ORIGIN env set in tests)
+    assert_eq!(res.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn auth_middleware_missing_header() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/api/keys")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn auth_middleware_invalid_token() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/api/keys")
+        .header("authorization", "Bearer invalid.jwt.token")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn auth_middleware_missing_bearer_prefix() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/api/keys")
+        .header("authorization", "NotBearer sometoken")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn auth_middleware_valid_token_passes() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    let req = Request::builder()
+        .uri("/api/keys")
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn poster_endpoint_rejects_invalid_api_key() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .uri("/bogus-key/imdb/poster-default/tt0000001.jpg")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn poster_endpoint_accepts_valid_api_key() {
+    let (app, _state) = common::setup_test_app().await;
+    let token = common::setup_admin(&app).await;
+
+    // Create an API key via the admin endpoint
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/keys")
+        .header("content-type", "application/json")
+        .header("authorization", format!("Bearer {token}"))
+        .body(Body::from(r#"{"name":"poster-test"}"#))
+        .unwrap();
+
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let body = res.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let api_key = json["key"].as_str().unwrap();
+
+    // Use the API key on the poster endpoint — the TMDB call will fail since
+    // we use a fake API key, but the response should NOT be 401 (key is valid).
+    let req = Request::builder()
+        .uri(format!("/{api_key}/imdb/poster-default/tt0000001.jpg"))
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_ne!(res.status(), StatusCode::UNAUTHORIZED, "valid API key should not return 401");
+}
+
+#[tokio::test]
+async fn logout_requires_auth() {
+    let (app, _state) = common::setup_test_app().await;
+
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/auth/logout")
+        .body(Body::empty())
+        .unwrap();
+
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}

docker-compose.yml

@@ -0,0 +1,47 @@
+# Example docker-compose for OpenPosterDB.
+#
+# Copy this file and create a .env alongside it with the required values:
+#
+#   TMDB_API_KEY=<your key from https://www.themoviedb.org/settings/api>
+#   JWT_SECRET=<64 hex chars — generate with: openssl rand -hex 32>
+#
+# At least one of OMDB_API_KEY or MDBLIST_API_KEY is also required for ratings:
+#
+#   OMDB_API_KEY=<your key from https://www.omdbapi.com/apikey.aspx>
+#   MDBLIST_API_KEY=<your key from https://mdblist.com/preferences/>
+#
+# Then run:
+#
+#   docker compose up -d
+#
+# The web UI will be available at http://localhost:3000.
+# On first visit you'll be prompted to create an admin account.
+#
+# Optional settings:
+#
+#   COOKIE_SECURE=false   — Set this if you access the UI over plain HTTP
+#                           (e.g. localhost without a reverse proxy).
+#                           Defaults to true, which requires HTTPS — the
+#                           browser will silently ignore auth cookies
+#                           without it.
+
+services:
+  openposterdb:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      TMDB_API_KEY: ${TMDB_API_KEY:?Set TMDB_API_KEY in .env}
+      JWT_SECRET: ${JWT_SECRET:?Set JWT_SECRET in .env — generate with: openssl rand -hex 32}
+      OMDB_API_KEY: ${OMDB_API_KEY:-}
+      MDBLIST_API_KEY: ${MDBLIST_API_KEY:-}
+      COOKIE_SECURE: ${COOKIE_SECURE:-true}
+      LISTEN_ADDR: 0.0.0.0:3000
+      CACHE_DIR: /data/cache
+      STATIC_DIR: /app/dist
+    volumes:
+      - openposterdb-data:/data
+    restart: unless-stopped
+
+volumes:
+  openposterdb-data:

scripts/test.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+IMAGE_NAME="openposterdb-test"
+CONTAINER_NAME="openposterdb-test"
+
+if command -v podman &>/dev/null; then
+    CTR=podman
+elif command -v docker &>/dev/null; then
+    CTR=docker
+else
+    echo "Error: neither podman nor docker found" >&2
+    exit 1
+fi
+
+echo "=== Backend tests ==="
+(cd api && cargo test)
+
+echo ""
+echo "=== Frontend unit tests ==="
+(cd web && npx vitest run)
+
+echo ""
+echo "=== E2E tests ==="
+
+cleanup() {
+    echo "=== Tearing down ==="
+    $CTR rm -f "$CONTAINER_NAME" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+echo "Building container image..."
+$CTR build -t "$IMAGE_NAME" --build-arg CARGO_FEATURES=test-support -f Containerfile .
+
+echo "Starting container..."
+$CTR rm -f "$CONTAINER_NAME" 2>/dev/null || true
+$CTR run -d --name "$CONTAINER_NAME" \
+    -p 3333:3000 \
+    --tmpfs /tmp/openposterdb-e2e \
+    -e TMDB_API_KEY=test \
+    -e MDBLIST_API_KEY=test \
+    -e JWT_SECRET=abababababababababababababababababababababababababababababababab \
+    -e LISTEN_ADDR=0.0.0.0:3000 \
+    -e COOKIE_SECURE=false \
+    -e CACHE_DIR=/tmp/openposterdb-e2e \
+    "$IMAGE_NAME"
+
+echo "Waiting for backend..."
+for i in $(seq 1 60); do
+    if curl -sf http://127.0.0.1:3333/api/auth/status > /dev/null 2>&1; then
+        echo "Backend ready"
+        break
+    fi
+    if [ "$i" -eq 60 ]; then
+        echo "Backend did not start within 60 seconds"
+        $CTR logs "$CONTAINER_NAME"
+        exit 1
+    fi
+    sleep 1
+done
+
+(cd web && npx playwright test --project=setup --project=chromium)
+
+echo ""
+echo "All tests passed."

web/e2e/api-keys.spec.ts

@@ -0,0 +1,58 @@
+import { test, expect } from '@playwright/test'
+
+test.describe('api keys', () => {
+  test.beforeEach(async ({ page, request }) => {
+    // Ensure admin exists and login
+    await request.post('/api/auth/setup', {
+      data: { username: 'admin', password: 'testpassword123' },
+    })
+
+    await page.goto('/login')
+    await page.fill('#username', 'admin')
+    await page.fill('#password', 'testpassword123')
+    await page.click('button[type="submit"]')
+    await expect(page).toHaveURL(/\/keys/)
+  })
+
+  test('create a new API key and see its value', async ({ page }) => {
+    await page.fill('input[placeholder*="Key name"]', 'test-key')
+    await page.click('button:has-text("Create")')
+
+    // Key value banner should appear
+    await expect(page.locator('text=Copy your API key now')).toBeVisible()
+    await expect(page.locator('code')).toBeVisible()
+  })
+
+  test('dismiss key banner', async ({ page }) => {
+    await page.fill('input[placeholder*="Key name"]', 'dismiss-test')
+    await page.click('button:has-text("Create")')
+
+    await expect(page.locator('text=Copy your API key now')).toBeVisible()
+    await page.click('button:has-text("Dismiss")')
+    await expect(page.locator('text=Copy your API key now')).not.toBeVisible()
+  })
+
+  test('key appears in list with correct name', async ({ page }) => {
+    await page.fill('input[placeholder*="Key name"]', 'my-prod-key')
+    await page.click('button:has-text("Create")')
+
+    // Key should appear in the list
+    await expect(page.locator('text=my-prod-key')).toBeVisible()
+  })
+
+  test('delete a key removes it from list', async ({ page }) => {
+    // Create a key
+    await page.fill('input[placeholder*="Key name"]', 'to-delete')
+    await page.click('button:has-text("Create")')
+    await expect(page.locator('text=to-delete')).toBeVisible()
+
+    // Accept the confirm dialog
+    page.on('dialog', (dialog) => dialog.accept())
+
+    // Click delete on the key
+    await page.locator('text=to-delete').locator('..').locator('..').locator('button:has-text("Delete")').click()
+
+    // Key should be gone
+    await expect(page.locator('text=to-delete')).not.toBeVisible()
+  })
+})

web/e2e/global-setup.ts

@@ -0,0 +1,62 @@
+import { execSync } from 'node:child_process'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const PROJECT_ROOT = resolve(__dirname, '../..')
+const IMAGE_NAME = 'openposterdb-test'
+const CONTAINER_NAME = 'openposterdb-test'
+const BACKEND_URL = 'http://127.0.0.1:3333/api/auth/status'
+
+function containerCmd(): string {
+  try {
+    execSync('podman --version', { stdio: 'ignore' })
+    return 'podman'
+  } catch {
+    return 'docker'
+  }
+}
+
+export default async function globalSetup() {
+  const cmd = containerCmd()
+
+  console.log(`[e2e] Building container image via "${cmd}"...`)
+  execSync(
+    `${cmd} build -t ${IMAGE_NAME} --build-arg CARGO_FEATURES=test-support -f Containerfile .`,
+    { cwd: PROJECT_ROOT, stdio: 'inherit' },
+  )
+
+  console.log('[e2e] Starting container...')
+  try { execSync(`${cmd} rm -f ${CONTAINER_NAME}`, { stdio: 'ignore' }) } catch { /* ignore */ }
+  execSync(
+    [
+      `${cmd} run -d --name ${CONTAINER_NAME}`,
+      '-p 3333:3000',
+      '--tmpfs /tmp/openposterdb-e2e',
+      '-e TMDB_API_KEY=test',
+      '-e MDBLIST_API_KEY=test',
+      '-e JWT_SECRET=abababababababababababababababababababababababababababababababab',
+      '-e LISTEN_ADDR=0.0.0.0:3000',
+      '-e COOKIE_SECURE=false',
+      '-e CACHE_DIR=/tmp/openposterdb-e2e',
+      IMAGE_NAME,
+    ].join(' '),
+    { cwd: PROJECT_ROOT, stdio: 'inherit' },
+  )
+
+  console.log('[e2e] Waiting for backend to be ready...')
+  const deadline = Date.now() + 60_000
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(BACKEND_URL)
+      if (res.ok) {
+        console.log('[e2e] Backend is ready')
+        return
+      }
+    } catch {
+      // not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 500))
+  }
+  throw new Error('Backend did not start within 60 seconds')
+}

web/e2e/global-teardown.ts

@@ -0,0 +1,24 @@
+import { execSync } from 'node:child_process'
+
+const CONTAINER_NAME = 'openposterdb-test'
+
+function containerCmd(): string {
+  try {
+    execSync('podman --version', { stdio: 'ignore' })
+    return 'podman'
+  } catch {
+    return 'docker'
+  }
+}
+
+export default async function globalTeardown() {
+  const cmd = containerCmd()
+
+  console.log('[e2e] Stopping and removing container...')
+  try {
+    execSync(`${cmd} rm -f ${CONTAINER_NAME}`, { stdio: 'inherit' })
+  } catch {
+    // may already be removed
+  }
+  console.log('[e2e] Cleanup complete')
+}

web/e2e/login-flow.spec.ts

@@ -0,0 +1,55 @@
+import { test, expect } from '@playwright/test'
+
+test.describe('login flow', () => {
+  // Setup is assumed to be done by the setup-flow project dependency
+
+  test('login with valid credentials', async ({ page, request }) => {
+    // Ensure admin exists via API
+    await request.post('/api/auth/setup', {
+      data: { username: 'admin', password: 'testpassword123' },
+    })
+
+    await page.goto('/login')
+    await page.fill('#username', 'admin')
+    await page.fill('#password', 'testpassword123')
+    await page.click('button[type="submit"]')
+
+    await expect(page).toHaveURL(/\/keys/)
+  })
+
+  test('login with invalid credentials shows error', async ({ page, request }) => {
+    // Ensure admin exists
+    await request.post('/api/auth/setup', {
+      data: { username: 'admin', password: 'testpassword123' },
+    })
+
+    await page.goto('/login')
+    await page.fill('#username', 'admin')
+    await page.fill('#password', 'wrongpassword')
+    await page.click('button[type="submit"]')
+
+    await expect(page.locator('.text-destructive')).toBeVisible()
+  })
+
+  test('logout redirects to /login', async ({ page, request }) => {
+    // Setup and login via API
+    await request.post('/api/auth/setup', {
+      data: { username: 'admin', password: 'testpassword123' },
+    })
+
+    await page.goto('/login')
+    await page.fill('#username', 'admin')
+    await page.fill('#password', 'testpassword123')
+    await page.click('button[type="submit"]')
+    await expect(page).toHaveURL(/\/keys/)
+
+    // Click logout
+    await page.click('text=Sign out')
+    await expect(page).toHaveURL(/\/login/)
+  })
+
+  test('accessing /keys when logged out redirects to /login', async ({ page }) => {
+    await page.goto('/keys')
+    await expect(page).toHaveURL(/\/login|\/setup/)
+  })
+})

web/e2e/setup-flow.spec.ts

@@ -0,0 +1,24 @@
+import { test, expect } from '@playwright/test'
+
+test.describe.serial('setup flow', () => {
+  test('fresh app redirects to /setup', async ({ page }) => {
+    await page.goto('/')
+    await expect(page).toHaveURL(/\/setup/)
+  })
+
+  test('create admin account and redirect to /keys', async ({ page }) => {
+    await page.goto('/setup')
+
+    await page.fill('#username', 'admin')
+    await page.fill('#password', 'testpassword123')
+    await page.fill('#confirm-password', 'testpassword123')
+    await page.click('button[type="submit"]')
+
+    await expect(page).toHaveURL(/\/keys/)
+  })
+
+  test('revisiting /setup after account created redirects to /login', async ({ page }) => {
+    await page.goto('/setup')
+    await expect(page).toHaveURL(/\/login/)
+  })
+})

web/e2e/vue.spec.ts

@@ -1,8 +0,0 @@
-import { test, expect } from '@playwright/test'
-
-// See here how to get started:
-// https://playwright.dev/docs/intro
-test('visits the app root url', async ({ page }) => {
-  await page.goto('/')
-  await expect(page.locator('h1')).toHaveText('You did it!')
-})

web/playwright.config.ts

@@ -1,12 +1,6 @@
 import process from 'node:process'
 import { defineConfig, devices } from '@playwright/test'
 
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
@@ -29,82 +23,47 @@ export default defineConfig({
   workers: process.env.CI ? 1 : undefined,
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: 'html',
+
+  // On CI the backend is started by the workflow directly; locally we use
+  // docker/podman compose via global-setup/teardown.
+  ...(process.env.CI
+    ? {}
+    : {
+        globalSetup: './e2e/global-setup.ts',
+        globalTeardown: './e2e/global-teardown.ts',
+      }),
+
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
     /* Maximum time each action such as `click()` can take. Defaults to 0 (no limit). */
     actionTimeout: 0,
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: process.env.CI ? 'http://localhost:4173' : 'http://localhost:5173',
+    /* Both CI and local: backend serves frontend + API on one port. */
+    baseURL: 'http://127.0.0.1:3333',
 
     /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
     trace: 'on-first-retry',
 
-    /* Only on CI systems run the tests headless */
-    headless: !!process.env.CI,
+    headless: true,
   },
 
   /* Configure projects for major browsers */
   projects: [
     {
-      name: 'chromium',
+      name: 'setup',
+      testMatch: /setup-flow\.spec\.ts/,
       use: {
         ...devices['Desktop Chrome'],
       },
     },
     {
-      name: 'firefox',
-      use: {
-        ...devices['Desktop Firefox'],
-      },
-    },
-    {
-      name: 'webkit',
+      name: 'chromium',
+      dependencies: ['setup'],
+      testIgnore: /setup-flow\.spec\.ts/,
       use: {
-        ...devices['Desktop Safari'],
+        ...devices['Desktop Chrome'],
       },
     },
-
-    /* Test against mobile viewports. */
-    // {
-    //   name: 'Mobile Chrome',
-    //   use: {
-    //     ...devices['Pixel 5'],
-    //   },
-    // },
-    // {
-    //   name: 'Mobile Safari',
-    //   use: {
-    //     ...devices['iPhone 12'],
-    //   },
-    // },
-
-    /* Test against branded browsers. */
-    // {
-    //   name: 'Microsoft Edge',
-    //   use: {
-    //     channel: 'msedge',
-    //   },
-    // },
-    // {
-    //   name: 'Google Chrome',
-    //   use: {
-    //     channel: 'chrome',
-    //   },
-    // },
   ],
 
-  /* Folder for test artifacts such as screenshots, videos, traces, etc. */
-  // outputDir: 'test-results/',
-
-  /* Run your local dev server before starting the tests */
-  webServer: {
-    /**
-     * Use the dev server by default for faster feedback loop.
-     * Use the preview server on CI for more realistic testing.
-     * Playwright will re-use the local server if there is already a dev-server running.
-     */
-    command: process.env.CI ? 'npm run preview' : 'npm run dev',
-    port: process.env.CI ? 4173 : 5173,
-    reuseExistingServer: !process.env.CI,
-  },
+  // No webServer needed — backend serves the frontend via STATIC_DIR.
 })

web/src/__tests__/App.spec.ts

@@ -1,11 +1,14 @@
 import { describe, it, expect } from 'vitest'
-
 import { mount } from '@vue/test-utils'
 import App from '../App.vue'
 
 describe('App', () => {
-  it('mounts renders properly', () => {
-    const wrapper = mount(App)
-    expect(wrapper.text()).toContain('You did it!')
+  it('mounts without error', () => {
+    const wrapper = mount(App, {
+      global: {
+        stubs: ['RouterView'],
+      },
+    })
+    expect(wrapper.exists()).toBe(true)
   })
 })

web/src/__tests__/lib/api.spec.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createPinia, setActivePinia } from 'pinia'
+
+const mockAuthStore = {
+  token: 'test-token',
+  refresh: vi.fn(),
+  logout: vi.fn(),
+}
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => mockAuthStore,
+}))
+
+const mockRouter = {
+  push: vi.fn(),
+}
+
+vi.mock('@/router', () => ({
+  default: mockRouter,
+}))
+
+import { get, post, del } from '@/lib/api'
+
+function makeFetchResponse(status: number, body: unknown = {}) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  }
+}
+
+describe('api', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.restoreAllMocks()
+    mockAuthStore.token = 'test-token'
+    mockAuthStore.refresh = vi.fn()
+    mockAuthStore.logout = vi.fn()
+    mockRouter.push = vi.fn()
+  })
+
+  it('get adds Authorization header when token exists', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(makeFetchResponse(200, { data: 'ok' }))
+    vi.stubGlobal('fetch', fetchMock)
+
+    await get('/api/test')
+
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [url, options] = fetchMock.mock.calls[0]
+    expect(url).toBe('/api/test')
+    expect(options.headers.get('Authorization')).toBe('Bearer test-token')
+  })
+
+  it('post sends JSON body', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(makeFetchResponse(200))
+    vi.stubGlobal('fetch', fetchMock)
+
+    await post('/api/items', { name: 'test' })
+
+    const [, options] = fetchMock.mock.calls[0]
+    expect(options.method).toBe('POST')
+    expect(options.headers.get('Content-Type')).toBe('application/json')
+    expect(options.body).toBe(JSON.stringify({ name: 'test' }))
+  })
+
+  it('del uses DELETE method', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(makeFetchResponse(200))
+    vi.stubGlobal('fetch', fetchMock)
+
+    await del('/api/items/1')
+
+    const [, options] = fetchMock.mock.calls[0]
+    expect(options.method).toBe('DELETE')
+  })
+
+  it('401 handling: attempts refresh, retries request on success', async () => {
+    mockAuthStore.refresh.mockResolvedValue(true)
+    mockAuthStore.token = 'refreshed-token'
+
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(makeFetchResponse(401))
+      .mockResolvedValueOnce(makeFetchResponse(200, { data: 'ok' }))
+    vi.stubGlobal('fetch', fetchMock)
+
+    await get('/api/protected')
+
+    expect(mockAuthStore.refresh).toHaveBeenCalled()
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('401 + failed refresh: calls logout', async () => {
+    mockAuthStore.refresh.mockResolvedValue(false)
+
+    const fetchMock = vi.fn().mockResolvedValue(makeFetchResponse(401))
+    vi.stubGlobal('fetch', fetchMock)
+
+    await get('/api/protected')
+
+    expect(mockAuthStore.refresh).toHaveBeenCalled()
+    expect(mockAuthStore.logout).toHaveBeenCalled()
+    expect(mockRouter.push).toHaveBeenCalledWith({ name: 'login' })
+  })
+})

web/src/__tests__/router/index.spec.ts

@@ -0,0 +1,67 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createPinia, setActivePinia } from 'pinia'
+import { createRouter, createWebHistory } from 'vue-router'
+import { useAuthStore } from '@/stores/auth'
+
+// We need to create a fresh router for each test to avoid guard state leaking.
+// We also mock checkSetupRequired so it doesn't actually fetch.
+
+function makeRouter() {
+  return createRouter({
+    history: createWebHistory(),
+    routes: [
+      { path: '/', redirect: '/keys' },
+      { path: '/login', name: 'login', component: { template: '<div>Login</div>' } },
+      { path: '/setup', name: 'setup', component: { template: '<div>Setup</div>' } },
+      {
+        path: '/keys',
+        name: 'keys',
+        component: { template: '<div>Keys</div>' },
+        meta: { requiresAuth: true },
+      },
+    ],
+  })
+}
+
+describe('router', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+  })
+
+  it('unauthenticated user visiting /keys gets redirected to /login', async () => {
+    const router = makeRouter()
+    const auth = useAuthStore()
+
+    vi.spyOn(auth, 'checkSetupRequired').mockResolvedValue(false)
+
+    router.beforeEach(async (to) => {
+      if (to.meta.requiresAuth && !auth.isAuthenticated) {
+        return { name: 'login' }
+      }
+    })
+
+    await router.push('/keys')
+    await router.isReady()
+
+    expect(router.currentRoute.value.name).toBe('login')
+  })
+
+  it('authenticated user visiting /login gets redirected to /keys', async () => {
+    const router = makeRouter()
+    const auth = useAuthStore()
+    auth.token = 'valid-token'
+
+    vi.spyOn(auth, 'checkSetupRequired').mockResolvedValue(false)
+
+    router.beforeEach(async (to) => {
+      if ((to.name === 'login' || to.name === 'setup') && auth.isAuthenticated) {
+        return { name: 'keys' }
+      }
+    })
+
+    await router.push('/login')
+    await router.isReady()
+
+    expect(router.currentRoute.value.name).toBe('keys')
+  })
+})

web/src/__tests__/stores/auth.spec.ts

@@ -0,0 +1,133 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createPinia, setActivePinia } from 'pinia'
+import { useAuthStore } from '@/stores/auth'
+
+const localStorageMock: Record<string, string> = {}
+const localStorageStub = {
+  getItem: vi.fn((key: string) => localStorageMock[key] ?? null),
+  setItem: vi.fn((key: string, value: string) => {
+    localStorageMock[key] = value
+  }),
+  removeItem: vi.fn((key: string) => {
+    delete localStorageMock[key]
+  }),
+}
+
+vi.stubGlobal('localStorage', localStorageStub)
+
+function mockFetchSuccess(data: Record<string, unknown>, ok = true) {
+  return vi.fn().mockResolvedValue({
+    ok,
+    status: ok ? 200 : 401,
+    json: () => Promise.resolve(data),
+  })
+}
+
+describe('auth store', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    Object.keys(localStorageMock).forEach((k) => delete localStorageMock[k])
+    vi.restoreAllMocks()
+    vi.stubGlobal('localStorage', localStorageStub)
+  })
+
+  it('token is set via login and stored in localStorage', async () => {
+    vi.stubGlobal('fetch', mockFetchSuccess({ token: 'abc123' }))
+    const auth = useAuthStore()
+    await auth.login('user', 'pass')
+    expect(auth.token).toBe('abc123')
+    expect(localStorageStub.setItem).toHaveBeenCalledWith('token', 'abc123')
+  })
+
+  it('logout clears token from localStorage and sets null', async () => {
+    vi.stubGlobal('fetch', mockFetchSuccess({ token: 'abc123' }))
+    const auth = useAuthStore()
+    await auth.login('user', 'pass')
+    auth.logout()
+    expect(auth.token).toBeNull()
+    expect(localStorageStub.removeItem).toHaveBeenCalledWith('token')
+  })
+
+  it('isAuthenticated is true when token set', async () => {
+    vi.stubGlobal('fetch', mockFetchSuccess({ token: 'abc123' }))
+    const auth = useAuthStore()
+    await auth.login('user', 'pass')
+    expect(auth.isAuthenticated).toBe(true)
+  })
+
+  it('isAuthenticated is false when token is null', () => {
+    const auth = useAuthStore()
+    expect(auth.isAuthenticated).toBe(false)
+  })
+
+  it('login returns true on success', async () => {
+    const fetchMock = mockFetchSuccess({ token: 'new-token' })
+    vi.stubGlobal('fetch', fetchMock)
+    const auth = useAuthStore()
+
+    const result = await auth.login('user', 'pass')
+
+    expect(result).toBe(true)
+    expect(auth.token).toBe('new-token')
+    expect(fetchMock).toHaveBeenCalledWith(
+      expect.stringContaining('/api/auth/login'),
+      expect.objectContaining({ method: 'POST' }),
+    )
+  })
+
+  it('login returns false on failure', async () => {
+    const fetchMock = mockFetchSuccess({}, false)
+    vi.stubGlobal('fetch', fetchMock)
+    const auth = useAuthStore()
+
+    const result = await auth.login('user', 'wrong')
+
+    expect(result).toBe(false)
+    expect(auth.token).toBeNull()
+  })
+
+  it('setup sets token and setupRequired=false', async () => {
+    const fetchMock = mockFetchSuccess({ token: 'setup-token' })
+    vi.stubGlobal('fetch', fetchMock)
+    const auth = useAuthStore()
+
+    const result = await auth.setup('admin', 'password123')
+
+    expect(result).toBe(true)
+    expect(auth.token).toBe('setup-token')
+    expect(auth.setupRequired).toBe(false)
+  })
+
+  it('refresh updates token', async () => {
+    const fetchMock = mockFetchSuccess({ token: 'refreshed-token' })
+    vi.stubGlobal('fetch', fetchMock)
+    const auth = useAuthStore()
+
+    const result = await auth.refresh()
+
+    expect(result).toBe(true)
+    expect(auth.token).toBe('refreshed-token')
+  })
+
+  it('logout clears token and sets setupRequired to null', async () => {
+    vi.stubGlobal('fetch', mockFetchSuccess({ token: 'abc' }))
+    const auth = useAuthStore()
+    await auth.login('user', 'pass')
+    auth.logout()
+    expect(auth.token).toBeNull()
+    expect(auth.setupRequired).toBeNull()
+  })
+
+  it('checkSetupRequired caches result on second call', async () => {
+    const fetchMock = mockFetchSuccess({ setup_required: true })
+    vi.stubGlobal('fetch', fetchMock)
+    const auth = useAuthStore()
+
+    const first = await auth.checkSetupRequired()
+    const second = await auth.checkSetupRequired()
+
+    expect(first).toBe(true)
+    expect(second).toBe(true)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+})

web/src/__tests__/views/ApiKeysView.spec.ts

@@ -0,0 +1,115 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import ApiKeysView from '@/views/ApiKeysView.vue'
+
+const mockRouter = {
+  push: vi.fn(),
+}
+
+const mockAuthStore = {
+  logout: vi.fn(),
+}
+
+const mockApi = {
+  get: vi.fn(),
+  post: vi.fn(),
+  del: vi.fn(),
+}
+
+vi.mock('vue-router', () => ({
+  useRouter: () => mockRouter,
+}))
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => mockAuthStore,
+}))
+
+vi.mock('@/lib/api', () => ({
+  get: (...args: unknown[]) => mockApi.get(...args),
+  post: (...args: unknown[]) => mockApi.post(...args),
+  del: (...args: unknown[]) => mockApi.del(...args),
+}))
+
+const sampleKeys = [
+  {
+    id: 1,
+    name: 'jellyfin-prod',
+    key_prefix: 'opdb_abc',
+    created_at: '2026-01-01',
+    last_used_at: null,
+  },
+  {
+    id: 2,
+    name: 'plex-dev',
+    key_prefix: 'opdb_xyz',
+    created_at: '2026-02-01',
+    last_used_at: '2026-03-01',
+  },
+]
+
+function mountView() {
+  return mount(ApiKeysView, {
+    global: {
+      plugins: [createPinia()],
+      stubs: {
+        Button: {
+          template: '<button @click="$emit(\'click\')"><slot /></button>',
+          props: ['disabled', 'variant', 'size'],
+        },
+      },
+    },
+  })
+}
+
+describe('ApiKeysView', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    mockApi.get.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve([]),
+    })
+  })
+
+  it('renders key list from mocked API response', async () => {
+    mockApi.get.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve(sampleKeys),
+    })
+
+    const wrapper = mountView()
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('jellyfin-prod')
+    expect(wrapper.text()).toContain('plex-dev')
+    expect(wrapper.text()).toContain('opdb_abc')
+    expect(wrapper.text()).toContain('opdb_xyz')
+  })
+
+  it('shows "No API keys yet." when empty', async () => {
+    mockApi.get.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve([]),
+    })
+
+    const wrapper = mountView()
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('No API keys yet.')
+  })
+
+  it('logout button calls auth.logout', async () => {
+    const wrapper = mountView()
+    await flushPromises()
+
+    const buttons = wrapper.findAll('button')
+    const logoutButton = buttons.find((b) => b.text().includes('Sign out'))
+    expect(logoutButton).toBeDefined()
+
+    await logoutButton!.trigger('click')
+
+    expect(mockAuthStore.logout).toHaveBeenCalled()
+    expect(mockRouter.push).toHaveBeenCalledWith('/login')
+  })
+})

web/src/__tests__/views/LoginView.spec.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import LoginView from '@/views/LoginView.vue'
+
+const mockRouter = {
+  push: vi.fn(),
+  replace: vi.fn(),
+}
+
+const mockAuthStore = {
+  checkSetupRequired: vi.fn().mockResolvedValue(false),
+  login: vi.fn(),
+  isAuthenticated: false,
+}
+
+vi.mock('vue-router', () => ({
+  useRouter: () => mockRouter,
+}))
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => mockAuthStore,
+}))
+
+function mountView() {
+  return mount(LoginView, {
+    global: {
+      plugins: [createPinia()],
+      stubs: {
+        Button: {
+          template: '<button><slot /></button>',
+          props: ['disabled'],
+        },
+      },
+    },
+  })
+}
+
+describe('LoginView', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    mockAuthStore.checkSetupRequired.mockResolvedValue(false)
+    mockAuthStore.login.mockReset()
+  })
+
+  it('renders login form', async () => {
+    const wrapper = mountView()
+    await flushPromises()
+
+    expect(wrapper.find('input#username').exists()).toBe(true)
+    expect(wrapper.find('input#password').exists()).toBe(true)
+    expect(wrapper.find('button[type="submit"]').exists()).toBe(true)
+  })
+
+  it('shows error message on failed login', async () => {
+    mockAuthStore.login.mockResolvedValue(false)
+    const wrapper = mountView()
+    await flushPromises()
+
+    await wrapper.find('input#username').setValue('user')
+    await wrapper.find('input#password').setValue('wrong')
+    await wrapper.find('form').trigger('submit')
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('Invalid username or password')
+  })
+
+  it('calls auth.login on form submit', async () => {
+    mockAuthStore.login.mockResolvedValue(true)
+    const wrapper = mountView()
+    await flushPromises()
+
+    await wrapper.find('input#username').setValue('admin')
+    await wrapper.find('input#password').setValue('secret')
+    await wrapper.find('form').trigger('submit')
+    await flushPromises()
+
+    expect(mockAuthStore.login).toHaveBeenCalledWith('admin', 'secret')
+    expect(mockRouter.push).toHaveBeenCalledWith('/keys')
+  })
+})

web/src/__tests__/views/SetupView.spec.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import SetupView from '@/views/SetupView.vue'
+
+const mockRouter = {
+  push: vi.fn(),
+}
+
+const mockAuthStore = {
+  setup: vi.fn(),
+}
+
+vi.mock('vue-router', () => ({
+  useRouter: () => mockRouter,
+}))
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => mockAuthStore,
+}))
+
+function mountView() {
+  return mount(SetupView, {
+    global: {
+      plugins: [createPinia()],
+      stubs: {
+        Button: {
+          template: '<button><slot /></button>',
+          props: ['disabled'],
+        },
+      },
+    },
+  })
+}
+
+describe('SetupView', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    mockAuthStore.setup.mockReset()
+  })
+
+  it('renders setup form with confirm password field', () => {
+    const wrapper = mountView()
+
+    expect(wrapper.find('input#username').exists()).toBe(true)
+    expect(wrapper.find('input#password').exists()).toBe(true)
+    expect(wrapper.find('input#confirm-password').exists()).toBe(true)
+    expect(wrapper.find('button[type="submit"]').exists()).toBe(true)
+  })
+
+  it('shows error when passwords do not match', async () => {
+    const wrapper = mountView()
+
+    await wrapper.find('input#username').setValue('admin')
+    await wrapper.find('input#password').setValue('password123')
+    await wrapper.find('input#confirm-password').setValue('different')
+    await wrapper.find('form').trigger('submit')
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('Passwords do not match')
+    expect(mockAuthStore.setup).not.toHaveBeenCalled()
+  })
+
+  it('shows error when password is less than 8 characters', async () => {
+    const wrapper = mountView()
+
+    await wrapper.find('input#username').setValue('admin')
+    await wrapper.find('input#password').setValue('short')
+    await wrapper.find('input#confirm-password').setValue('short')
+    await wrapper.find('form').trigger('submit')
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('Password must be at least 8 characters')
+    expect(mockAuthStore.setup).not.toHaveBeenCalled()
+  })
+
+  it('calls auth.setup on valid submit', async () => {
+    mockAuthStore.setup.mockResolvedValue(true)
+    const wrapper = mountView()
+
+    await wrapper.find('input#username').setValue('admin')
+    await wrapper.find('input#password').setValue('password123')
+    await wrapper.find('input#confirm-password').setValue('password123')
+    await wrapper.find('form').trigger('submit')
+    await flushPromises()
+
+    expect(mockAuthStore.setup).toHaveBeenCalledWith('admin', 'password123')
+    expect(mockRouter.push).toHaveBeenCalledWith('/keys')
+  })
+})

web/vite.config.ts

@@ -19,7 +19,7 @@ export default defineConfig({
   },
   server: {
     proxy: {
-      '/api': 'http://localhost:3000',
+      '/api': process.env.E2E_BACKEND_URL || 'http://localhost:3000',
     },
   },
 })