test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68)

e2e/tests/api.fastapi-login.spec.ts

@@ -1,9 +1,27 @@
+import { z } from 'zod';
 import { test, expect } from '../fixtures';
 
 /**
  * FastAPI `/api/v1/auth/login` uses a *separate* user DB from NextAuth.
  * Set E2E_API_USERNAME + E2E_API_PASSWORD (or reuse admin FastAPI creds) to enable.
+ *
+ * Schemas mirror `backend/schemas/auth.py` (`TokenResponse` / `UserResponse`).
  */
+const TokenResponse = z.object({
+  access_token: z.string().min(1),
+  refresh_token: z.string().min(1),
+  password_change_required: z.boolean(),
+});
+
+const UserResponse = z.object({
+  username: z.string().min(1),
+  is_admin: z.boolean(),
+  role: z.string().min(1),
+  permissions: z.record(z.boolean()),
+});
+type TokenResponse = z.infer<typeof TokenResponse>;
+type UserResponse = z.infer<typeof UserResponse>;
+
 test.describe('fastapi login @smoke', () => {
   test('login returns bearer token when API creds set', async ({ api, timings }) => {
     const username = process.env.E2E_API_USERNAME || '';
@@ -11,17 +29,19 @@ test.describe('fastapi login @smoke', () => {
     test.skip(!username || !password, 'E2E_API_USERNAME/PASSWORD required for FastAPI auth');
 
     const res = await timings.measure('api_login', () =>
-      api.post<{ access_token: string }>('/api/v1/auth/login', {
+      api.post<TokenResponse>('/api/v1/auth/login', {
         body: { username, password },
         expectedStatus: 200,
+        schema: TokenResponse,
       }),
     );
     expect(res.data.access_token).toBeTruthy();
 
     const authed = api.withAuthBearer(res.data.access_token);
     const me = await timings.measure('api_me', () =>
-      authed.get('/api/v1/auth/me', { expectedStatus: 200 }),
+      authed.get<UserResponse>('/api/v1/auth/me', { expectedStatus: 200, schema: UserResponse }),
     );
     expect(me.status).toBe(200);
+    expect(me.data.username).toBe(username);
   });
 });