auth: subscribe-to-digests checkbox on verify (default on)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_verify_subscribe.py

@@ -0,0 +1,85 @@
+"""Verify-POST persists the subscribe_to_digests form field."""
+from __future__ import annotations
+
+import asyncio
+
+
+def _build(tmp_path):
+    from fastapi import FastAPI
+    from fastapi.testclient import TestClient
+    from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+    from app import db as db_mod
+    from app.db import Base
+    from app.models import User
+    from app.routers import auth as auth_router
+    from app.auth import _pending_serializer
+
+    engine = create_async_engine(f"sqlite+aiosqlite:///{tmp_path}/v.db")
+    factory = async_sessionmaker(engine, expire_on_commit=False)
+    db_mod._engine = engine
+    db_mod._session_factory = factory
+
+    async def _seed():
+        async with engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)
+        async with factory() as s:
+            s.add(User(id=10, email="newbie@x", tier="free",
+                       email_digest_opt_in=True))
+            await s.commit()
+
+    asyncio.run(_seed())
+    app = FastAPI()
+    app.include_router(auth_router.router)
+    pending = _pending_serializer().dumps({"email": "newbie@x", "uid": 10, "ref": None})
+    return TestClient(app), pending
+
+
+def test_verify_with_unchecked_subscribe_disables_opt_in(tmp_path, monkeypatch):
+    from app.services import otp_service
+
+    async def _ok(*args, **kwargs):
+        return None
+    monkeypatch.setattr(otp_service, "verify", _ok)
+
+    client, pending = _build(tmp_path)
+    r = client.post(
+        "/verify",
+        data={"code": "000000"},  # subscribe_to_digests omitted = unchecked
+        cookies={"cassandra_pending": pending},
+        follow_redirects=False,
+    )
+    assert r.status_code == 303, r.text
+
+    async def _check():
+        from app import db as db_mod
+        from app.models import User
+        async with db_mod._session_factory() as s:
+            u = await s.get(User, 10)
+            assert u.email_digest_opt_in is False
+    asyncio.run(_check())
+
+
+def test_verify_with_checked_subscribe_keeps_opt_in(tmp_path, monkeypatch):
+    from app.services import otp_service
+
+    async def _ok(*args, **kwargs):
+        return None
+    monkeypatch.setattr(otp_service, "verify", _ok)
+
+    client, pending = _build(tmp_path)
+    r = client.post(
+        "/verify",
+        data={"code": "000000", "subscribe_to_digests": "on"},
+        cookies={"cassandra_pending": pending},
+        follow_redirects=False,
+    )
+    assert r.status_code == 303
+
+    async def _check():
+        from app import db as db_mod
+        from app.models import User
+        async with db_mod._session_factory() as s:
+            u = await s.get(User, 10)
+            assert u.email_digest_opt_in is True
+    asyncio.run(_check())