[verified] fix(auth): support Unicode credentials

tests/test_dashboard_auth_server.py

@@ -87,6 +87,50 @@ def test_remember_me_sets_30_day_cookie(client: TestClient) -> None:
     )
 
 
+def test_unicode_credentials_can_login_through_adapter(client: TestClient, monkeypatch) -> None:
+    unicode_id = "管理员"
+    unicode_password = "päss🔐"
+    monkeypatch.setenv(authentication.ADMIN_ID_ENV, unicode_id)
+    monkeypatch.setenv(authentication.ADMIN_PASSWORD_ENV, unicode_password)
+
+    response = client.post(
+        "/api/auth/login",
+        data={"admin_id": unicode_id, "admin_password": unicode_password},
+        headers={"origin": "https://testserver"},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers["location"] == "/"
+    assert f"{authentication.AUTH_COOKIE_NAME}=" in response.headers["set-cookie"]
+
+
+def test_unicode_credential_mismatch_is_generic_and_delayed(
+    client: TestClient, monkeypatch
+) -> None:
+    import time as real_time
+
+    unicode_id = "管理员"
+    unicode_password = "päss🔐"
+    monkeypatch.setenv(authentication.ADMIN_ID_ENV, unicode_id)
+    monkeypatch.setenv(authentication.ADMIN_PASSWORD_ENV, unicode_password)
+    monkeypatch.setattr(authentication.time, "sleep", real_time.sleep)
+
+    started = real_time.monotonic()
+    response = client.post(
+        "/api/auth/login",
+        data={"admin_id": unicode_id, "admin_password": "неверный🔒"},
+        headers={"origin": "https://testserver"},
+        follow_redirects=False,
+    )
+    elapsed = real_time.monotonic() - started
+
+    assert response.status_code == 303
+    assert response.headers["location"] == "/?auth_error=invalid"
+    assert "set-cookie" not in response.headers
+    assert elapsed >= authentication.MINIMUM_FAILURE_DELAY_SECONDS * 0.9
+
+
 def test_invalid_credentials_do_not_set_cookie_and_use_general_error(
     client: TestClient,
 ) -> None:
@@ -104,6 +148,23 @@ def test_invalid_credentials_do_not_set_cookie_and_use_general_error(
     assert ADMIN_ID not in response.headers["location"]
 
 
+def test_login_rejects_malformed_percent_encoded_utf8_without_cookie(
+    client: TestClient,
+) -> None:
+    response = client.post(
+        "/api/auth/login",
+        content=b"admin_id=%FF&admin_password=wrong",
+        headers={
+            "origin": "https://testserver",
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 400
+    assert "set-cookie" not in response.headers
+
+
 def test_missing_configuration_fails_closed(client: TestClient, monkeypatch) -> None:
     monkeypatch.delenv(authentication.SIGNING_SECRET_ENV)