Switch integration tests to username/password auth

Cookie-based auth expires; username/password secrets do not.
Also remove server response echoing on login failure to avoid
leaking any response content in CI logs.

Author: Rolf Erik Normann

.github/workflows/ci.yml

@@ -45,5 +45,6 @@ jobs:
 
       - name: Run integration tests
         env:
-          KIDPLAN_COOKIE: ${{ secrets.KIDPLAN_COOKIE }}
+          KIDPLAN_USERNAME: ${{ secrets.KIDPLAN_USERNAME }}
+          KIDPLAN_PASSWORD: ${{ secrets.KIDPLAN_PASSWORD }}
         run: pytest tests/test_integration.py -v

kidplan_fetcher/cli.py

@@ -27,7 +27,7 @@ def login(session: requests.Session, username: str, password: str) -> bool:
     try:
         data = resp.json()
     except Exception:
-        print("ERROR: Unexpected response:", resp.text[:200])
+        print("ERROR: Unexpected response from server.")
         return False
     if not data:
         print("ERROR: No kindergartens found.")

tests/test_integration.py

@@ -1,13 +1,14 @@
 """
-Integration tests — require a valid KIDPLAN_COOKIE environment variable.
+Integration tests — require KIDPLAN_USERNAME and KIDPLAN_PASSWORD environment variables.
 
 These tests hit the real Kidplan API to verify that:
+  - Authentication still works
   - The album listing endpoint still returns data
   - Album pages still contain parseable image links
   - Image URLs are reachable and serve valid image content
 
 Run locally:
-    KIDPLAN_COOKIE=<value> pytest tests/test_integration.py -v
+    KIDPLAN_USERNAME=your@email.com KIDPLAN_PASSWORD=secret pytest tests/test_integration.py -v
 """
 
 import imghdr
@@ -17,20 +18,22 @@
 import pytest
 import requests
 
-from kidplan_fetcher.cli import get_all_albums, get_fullsize_urls
+from kidplan_fetcher.cli import get_all_albums, get_fullsize_urls, login
+
+USERNAME = os.getenv("KIDPLAN_USERNAME")
+PASSWORD = os.getenv("KIDPLAN_PASSWORD")
 
-COOKIE = os.getenv("KIDPLAN_COOKIE")
 pytestmark = pytest.mark.skipif(
-    not COOKIE,
-    reason="KIDPLAN_COOKIE environment variable not set",
+    not USERNAME or not PASSWORD,
+    reason="KIDPLAN_USERNAME and KIDPLAN_PASSWORD environment variables not set",
 )
 
 
 @pytest.fixture(scope="module")
 def session():
     s = requests.Session()
     s.headers["User-Agent"] = "Mozilla/5.0 (kidplan-fetcher-test)"
-    s.cookies.set(".ASPXAUTH", COOKIE, domain="app.kidplan.com")
+    assert login(s, USERNAME, PASSWORD), "Login failed — check credentials"
     return s
 
 
@@ -50,7 +53,6 @@ def test_album_list_has_required_fields(albums):
 
 
 def test_album_list_modified_timestamp(albums):
-    """Modified field must be parseable as /Date(ms)/."""
     import re
     for album in albums[:5]:
         assert re.search(r"\d+", album.get("Modified", "")), (
@@ -59,7 +61,6 @@ def test_album_list_modified_timestamp(albums):
 
 
 def test_first_album_with_pictures_has_image_urls(session, albums):
-    """Find the first non-empty album and verify image URLs are returned."""
     target = next((a for a in albums if a.get("PictureCount", 0) > 0), None)
     assert target is not None, "No album with pictures found"
 
@@ -75,10 +76,9 @@ def test_image_urls_have_no_size_param(session, albums):
 
 
 def test_first_image_is_downloadable_jpeg(session, albums):
-    """Download the first image from the first non-empty album and verify it's a valid image."""
     target = next((a for a in albums if a.get("PictureCount", 0) > 0), None)
     pictures = get_fullsize_urls(session, target["AlbumId"])
-    assert pictures, "No pictures to test"
+    assert pictures
 
     _guid, url = pictures[0]
     resp = session.get(url, stream=True, timeout=30)