feature: improve admin directory and crawl progress

tests/test_api_mcp.py

@@ -8,7 +8,8 @@ from sqlalchemy.pool import StaticPool
 from app.config import Settings, get_settings
 from app.db import Base, get_db
 from app.main import app
-from app.models import Employee
+from app.models import CrawlRun, Employee
+from app.security import SESSION_COOKIE, sign_session
 
 
 def test_health_returns_versions():
@@ -17,7 +18,7 @@ def test_health_returns_versions():
     response = client.get("/api/health")
 
     assert response.status_code == 200
-    assert response.json()["backend_version"] == "0.1.0"
+    assert response.json()["backend_version"] == "0.2.0"
 
 
 def test_mcp_requires_token_and_lists_tools():
@@ -105,3 +106,54 @@ def test_mcp_search_employees_returns_matching_employee():
     assert "Сергеев Алексей Викторович" in response.json()["result"]["content"][0]["text"]
 
     app.dependency_overrides.clear()
+
+
+def test_api_employees_and_stats_require_admin_session():
+    engine = create_engine(
+        "sqlite:///:memory:",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    Base.metadata.create_all(engine)
+    Session = sessionmaker(bind=engine)
+    db = Session()
+    db.add(
+        Employee(
+            profile_key="staff:alpha",
+            profile_type="staff",
+            profile_id="alpha",
+            canonical_url="https://www.hse.ru/staff/alpha",
+            full_name="Alpha Person",
+            status="active",
+            first_seen_at=datetime.now(timezone.utc),
+            last_seen_at=datetime.now(timezone.utc),
+            current_data={"contacts": {"emails": ["alpha@hse.ru"]}, "sections": []},
+        )
+    )
+    db.add(CrawlRun(source_url="https://miem.hse.ru/persons", status="completed", new_count=1))
+    db.commit()
+    db.close()
+
+    settings = Settings(admin_username="admin", admin_password="password", session_secret="session-secret")
+
+    def override_db():
+        session = Session()
+        try:
+            yield session
+        finally:
+            session.close()
+
+    app.dependency_overrides[get_db] = override_db
+    app.dependency_overrides[get_settings] = lambda: settings
+    client = TestClient(app)
+    client.cookies.set(SESSION_COOKIE, sign_session("admin", settings))
+
+    employees = client.get("/api/employees", params={"q": "Alpha", "has_email": True})
+    stats = client.get("/api/stats")
+
+    assert employees.status_code == 200
+    assert employees.json()["total"] == 1
+    assert stats.status_code == 200
+    assert stats.json()["new_in_last_run"] == 1
+
+    app.dependency_overrides.clear()