fix(auth): case-insensitive login + mobile auth debug logging

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_local_auth.py

@@ -751,6 +751,85 @@ async def test_single_user_mode_skips_local_user_table(la_session, active_user):
     assert mock_request.session["user"]["id"] == "admin"
 
 
+# ---------------------------------------------------------------------------
+# Case-insensitive login
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+@patch.object(settings, "multi_user_enabled", True)
+async def test_local_login_username_case_insensitive(la_session, active_user):
+    """auth() accepts username with different casing (e.g. 'ActiveUser' for 'activeuser')."""
+    from unittest.mock import AsyncMock, MagicMock
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "ActiveUser", "password": "password123"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    result = await auth(mock_request, db=la_session)
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["email"] == "active@example.com"
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+@patch.object(settings, "multi_user_enabled", True)
+async def test_local_login_email_case_insensitive(la_session, active_user):
+    """auth() accepts email with different casing (e.g. 'Active@Example.com' for 'active@example.com')."""
+    from unittest.mock import AsyncMock, MagicMock
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "Active@Example.com", "password": "password123"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    result = await auth(mock_request, db=la_session)
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["email"] == "active@example.com"
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+async def test_admin_login_username_case_insensitive():
+    """auth() admin credential check is case-insensitive for username."""
+    from unittest.mock import AsyncMock, MagicMock, patch
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "ADMIN", "password": "adminpass"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    with patch("app.auth.settings") as mock_settings:
+        mock_settings.admin_username = "admin"
+        mock_settings.admin_password = "adminpass"
+        mock_settings.multi_user_enabled = False
+
+        result = await auth(mock_request, db=MagicMock())
+
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["is_admin"] is True
+
+
 # ---------------------------------------------------------------------------
 # Integration tests: admin local user management
 # ---------------------------------------------------------------------------