@auth
Feature: Authentication
  Users authenticate with email + password. Sessions are cookie-based.
  Roles (client / admin / owner) gate access to portals.

  Scenario: client logs in and lands on their portal
    When "the client" logs in
    Then the URL contains "/"
    And they see "Seminarhof Drawehn"

  Scenario: admin logs in and reaches the admin bookings list
    When "the admin" logs in
    And they visit "/admin/bookings"
    Then they see "Buchungen"
    And they see "Summer Yoga Retreat"

  Scenario: owner logs in and reaches the admin bookings list
    When "the owner" logs in
    And they visit "/admin/bookings"
    Then they see "Buchungen"

  Scenario: wrong password is rejected
    Given "the client" visits "/login"
    When they fill "input[type=email]" with "demo@yoga-retreat.example"
    And they fill "input[type=password]" with "wrong-password"
    And they click "Anmelden"
    Then they see "E-Mail oder Passwort ist falsch."

  Scenario: client is redirected away from the admin portal
    When "the client" logs in
    And they visit "/admin/bookings"
    Then the URL does not contain "/admin/"

  Scenario: logout clears the session
    Given "the client" is logged in
    When they visit "/logout"
    Then they see "Sie wurden abgemeldet. Bis bald."
    When they click "Zurück zur Anmeldung"
    Then the URL contains "/login"