fix: close library upload flow and harden image storage

tests/test_accounts.py

@@ -242,3 +242,58 @@ def test_only_one_browser_account(app):
             "INSERT INTO users VALUES(?,?,1)",
             ("other", password_hash("another-password")),
         )
+
+
+def test_password_hash_does_not_hold_database_lock(client, app, monkeypatch):
+    import threading
+    from concurrent.futures import ThreadPoolExecutor
+
+    from pigway_frame_flow.core import accounts
+
+    account(app)
+    started, release = threading.Event(), threading.Event()
+    verify = accounts.verify_password
+
+    def delayed(*args):
+        started.set()
+        assert release.wait(5)
+        return verify(*args)
+
+    monkeypatch.setattr(accounts, "verify_password", delayed)
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        request = executor.submit(
+            client.post,
+            "/api/v1/auth/login",
+            json={"username": "test-user", "password": "fixture-password"},
+        )
+        try:
+            assert started.wait(5)
+            query = executor.submit(app.state.service.db.one, "SELECT 1 AS ok")
+            assert query.result(timeout=2)["ok"] == 1
+        finally:
+            release.set()
+        assert request.result(timeout=5).status_code == 200
+
+
+def test_password_changed_during_login_does_not_create_session(
+    client, app, monkeypatch
+):
+    from pigway_frame_flow.core import accounts
+
+    account(app)
+    verify = accounts.verify_password
+
+    def changed(*args):
+        result = verify(*args)
+        app.state.service.db.execute(
+            "UPDATE users SET password_hash=?", (password_hash("replacement-password"),)
+        )
+        return result
+
+    monkeypatch.setattr(accounts, "verify_password", changed)
+    response = client.post(
+        "/api/v1/auth/login",
+        json={"username": "test-user", "password": "fixture-password"},
+    )
+    assert response.status_code == 401
+    assert app.state.service.db.all("SELECT * FROM sessions") == []