@auth
Feature: Authentication
  Users authenticate with email + password. Sessions are cookie-based.
  Roles (client / admin / owner) gate access to portals.

  Background:
    Given I visit "/login"

  Scenario: client logs in and lands on their portal
    When I log in as "demo@yoga-retreat.example" with password "demo1234"
    Then the URL contains "/"
    And I see "Seminarhof Drawehn"

  Scenario: admin logs in and reaches the admin bookings list
    When I log in as "christina@seminarhof.example" with password "admin1234"
    And I visit "/admin/bookings"
    Then I see "Buchungen"
    And I see "Summer Yoga Retreat"

  Scenario: owner logs in and reaches the admin bookings list
    When I log in as "sarah@seminarhof.example" with password "owner1234"
    And I visit "/admin/bookings"
    Then I see "Buchungen"

  Scenario: wrong password is rejected
    When I fill "input[type=email]" with "demo@yoga-retreat.example"
    And I fill "input[type=password]" with "wrong-password"
    And I click "Anmelden"
    Then I see "E-Mail oder Passwort ist falsch."

  Scenario: client is redirected away from the admin portal
    When I log in as "demo@yoga-retreat.example" with password "demo1234"
    And I visit "/admin/bookings"
    Then the URL does not contain "/admin/"

  Scenario: logout clears the session
    Given I am logged in as "demo@yoga-retreat.example" with password "demo1234"
    When I log out
    Then I see "Sie wurden abgemeldet. Bis bald."
    When I click "Zurück zur Anmeldung"
    Then the URL contains "/login"