Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

tests/unit/test_auth.py

@@ -0,0 +1,68 @@
+"""Authentication, CSRF, token, and redaction matrices."""
+
+import pytest
+from starlette.responses import Response
+
+from app.security.auth import (
+    AuthenticationError,
+    csrf_token,
+    hash_secret,
+    issue_ticket,
+    parse_api_token,
+    redact_secrets,
+    set_ticket_cookie,
+    verify_csrf,
+    verify_secret,
+    verify_ticket,
+)
+
+KEY = b"test-signing-key-with-at-least-32-bytes"
+
+
+def test_password_and_token_hashes_do_not_store_plaintext() -> None:
+    encoded = hash_secret("correct horse", salt=b"0123456789abcdef")
+
+    assert "correct horse" not in encoded
+    assert verify_secret("correct horse", encoded)
+    assert not verify_secret("wrong", encoded)
+    assert not verify_secret("correct horse", "unknown$format")
+
+
+def test_signed_ticket_expiry_and_csrf() -> None:
+    ticket = issue_ticket("root@pam", KEY, now=100, ttl=60)
+
+    assert verify_ticket(ticket, KEY, now=120).principal == "root@pam"
+    token = csrf_token(ticket, KEY)
+    assert verify_csrf(ticket, token, KEY)
+    assert not verify_csrf(ticket, token + "x", KEY)
+    with pytest.raises(AuthenticationError, match="expired"):
+        verify_ticket(ticket, KEY, now=161)
+    with pytest.raises(AuthenticationError, match="invalid"):
+        verify_ticket(ticket + "x", KEY, now=120)
+
+
+def test_ticket_cookie_is_http_only_and_secure() -> None:
+    response = Response()
+    set_ticket_cookie(response, "ticket")
+
+    header = response.headers["set-cookie"]
+    assert "PVEAuthCookie=ticket" in header
+    assert "HttpOnly" in header
+    assert "Secure" in header
+    assert "SameSite=strict" in header
+
+
+def test_api_token_parsing_and_log_redaction() -> None:
+    token = parse_api_token("PVEAPIToken=user@pve!automation=supersecret")
+
+    assert token.principal == "user@pve"
+    assert token.token_id == "automation"
+    assert token.secret == "supersecret"
+    redacted = redact_secrets(
+        "PVEAPIToken=user@pve!automation=supersecret password=hunter2 token=abc"
+    )
+    assert "supersecret" not in redacted
+    assert "hunter2" not in redacted
+    assert "token=abc" not in redacted
+    with pytest.raises(AuthenticationError):
+        parse_api_token("Bearer secret")