From 1744f2a63b77c20eacdd996416cfbd8455a6dcb4 Mon Sep 17 00:00:00 2001
From: Liam Keegan <liam@keegan.ch>
Date: Wed, 25 Sep 2024 15:57:11 +0200
Subject: [PATCH] Add milestones to backend

- add/update Milestone, MilestoneText, MilestoneImage models
- add admin endpoints to create / update / delete milestones

Make endpoint naming more consistent

- use plurals for all collections of entities
- use PUT instead of PATCH since these endpoints take the entire entity, not just selected fields to update

Refactor

- use factory pattern for app and routers to make it easier to modify app settings in tests
- extract common router code into utils
- extend and refactor backend tests
---
 frontend/src/lib/admin.ts                     |  18 +-
 .../Admin/EditMilestoneGroupModal.svelte      |  17 +-
 .../src/lib/components/Admin/Languages.svelte |   4 +-
 .../components/Admin/MilestoneGroups.svelte   |   4 +-
 .../Admin/NewMilestoneGroupModal.svelte       | 108 -----
 frontend/src/lib/stores/adminStore.ts         |   4 +-
 mondey_backend/src/mondey_backend/main.py     |  39 +-
 .../src/mondey_backend/models/milestones.py   |  77 ++--
 .../src/mondey_backend/routers/admin.py       | 267 +++++------
 .../src/mondey_backend/routers/auth.py        |  13 +-
 .../src/mondey_backend/routers/milestones.py  |  94 ++--
 .../src/mondey_backend/routers/users.py       |   7 +-
 .../src/mondey_backend/routers/utils.py       |  68 +++
 mondey_backend/src/mondey_backend/settings.py |   4 +
 mondey_backend/tests/conftest.py              | 423 +++++++++++++++++-
 mondey_backend/tests/routers/test_admin.py    | 188 +++++---
 .../tests/routers/test_milestones.py          |  50 +--
 17 files changed, 891 insertions(+), 494 deletions(-)
 delete mode 100644 frontend/src/lib/components/Admin/NewMilestoneGroupModal.svelte
 create mode 100644 mondey_backend/src/mondey_backend/routers/utils.py

diff --git a/frontend/src/lib/admin.ts b/frontend/src/lib/admin.ts
index f6bdcb06..1877456b 100644
--- a/frontend/src/lib/admin.ts
+++ b/frontend/src/lib/admin.ts
@@ -28,7 +28,7 @@ export async function refreshMilestoneGroups() {
 export async function newMilestoneGroup() {
 	console.log('newMilestoneGroup...');
 	try {
-		const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-group/`, {
+		const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-groups/`, {
 			method: 'POST',
 			credentials: 'include',
 			headers: {
@@ -50,12 +50,12 @@ export async function newMilestoneGroup() {
 	return null;
 }
 
-export async function patchMilestoneGroup(milestoneGroup) {
-	console.log('patchMilestoneGroup...');
+export async function updateMilestoneGroup(milestoneGroup) {
+	console.log('updateMilestoneGroup...');
 	console.log(milestoneGroup);
 	try {
-		const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-group`, {
-			method: 'PATCH',
+		const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-groups`, {
+			method: 'PUT',
 			credentials: 'include',
 			headers: {
 				'Content-Type': 'application/json',
@@ -83,9 +83,9 @@ export async function uploadMilestoneGroupImage(milestoneGroupId: number, file)
 		const formData = new FormData();
 		formData.append('file', file);
 		const res = await fetch(
-			`${import.meta.env.VITE_MONDEY_API_URL}/admin/upload-milestone-group-image/${milestoneGroupId}`,
+			`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-group-images/${milestoneGroupId}`,
 			{
-				method: 'POST',
+				method: 'PUT',
 				credentials: 'include',
 				body: formData
 			}
@@ -121,3 +121,7 @@ export async function deleteMilestoneGroup(milestoneGroupId: number | null) {
 		console.error(e);
 	}
 }
+
+export function milestoneGroupImageUrl(id: number) {
+	return `${import.meta.env.VITE_MONDEY_API_URL}/static/mg${id}.jpg`;
+}
diff --git a/frontend/src/lib/components/Admin/EditMilestoneGroupModal.svelte b/frontend/src/lib/components/Admin/EditMilestoneGroupModal.svelte
index 8f9db1b7..b9cfa6f6 100644
--- a/frontend/src/lib/components/Admin/EditMilestoneGroupModal.svelte
+++ b/frontend/src/lib/components/Admin/EditMilestoneGroupModal.svelte
@@ -10,7 +10,11 @@
 		Modal
 	} from 'flowbite-svelte';
 	import { lang_id, languages } from '$lib/stores/adminStore';
-	import { patchMilestoneGroup, uploadMilestoneGroupImage } from '$lib/admin';
+	import {
+		updateMilestoneGroup,
+		uploadMilestoneGroupImage,
+		milestoneGroupImageUrl
+	} from '$lib/admin';
 
 	export let open: boolean = false;
 	export let milestoneGroup: object | null = null;
@@ -19,7 +23,7 @@
 	let image: string | ArrayBuffer | null | undefined = null;
 
 	$: if (milestoneGroup !== null) {
-		image = `${import.meta.env.VITE_MONDEY_API_URL}/static/milestone_group_${milestoneGroup.id}.jpg`;
+		image = milestoneGroupImageUrl(milestoneGroup.id);
 	}
 
 	$: if (files) {
@@ -30,20 +34,17 @@
 		};
 	}
 
-	async function reloadImg(url) {
-		console.log(`Reloading ${url}`);
+	async function reloadImg(url: string) {
 		await fetch(url, { cache: 'reload', mode: 'no-cors' });
 		document.body.querySelectorAll(`img[src='${url}']`).forEach((img) => (img.src = url));
 	}
 
 	export async function saveChanges() {
 		try {
-			await patchMilestoneGroup(milestoneGroup);
+			await updateMilestoneGroup(milestoneGroup);
 			if (files) {
 				await uploadMilestoneGroupImage(milestoneGroup.id, files[0]);
-				reloadImg(
-					`${import.meta.env.VITE_MONDEY_API_URL}/static/milestone_group_${milestoneGroup.id}.jpg`
-				);
+				await reloadImg(milestoneGroupImageUrl(milestoneGroup.id));
 			}
 		} catch (e) {
 			console.error(e);
diff --git a/frontend/src/lib/components/Admin/Languages.svelte b/frontend/src/lib/components/Admin/Languages.svelte
index 6ad1a4cd..56c4c37c 100644
--- a/frontend/src/lib/components/Admin/Languages.svelte
+++ b/frontend/src/lib/components/Admin/Languages.svelte
@@ -27,7 +27,7 @@
 
 	async function newLanguage() {
 		try {
-			const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/language`, {
+			const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/languages`, {
 				method: 'POST',
 				credentials: 'include',
 				headers: {
@@ -48,7 +48,7 @@
 
 	async function deleteLanguage(id: string) {
 		try {
-			const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/language/${id}`, {
+			const res = await fetch(`${import.meta.env.VITE_MONDEY_API_URL}/admin/languages/${id}`, {
 				method: 'DELETE',
 				credentials: 'include',
 				headers: {
diff --git a/frontend/src/lib/components/Admin/MilestoneGroups.svelte b/frontend/src/lib/components/Admin/MilestoneGroups.svelte
index a022e28e..69e83907 100644
--- a/frontend/src/lib/components/Admin/MilestoneGroups.svelte
+++ b/frontend/src/lib/components/Admin/MilestoneGroups.svelte
@@ -14,7 +14,7 @@
 	import EditMilestoneGroupModal from '$lib/components/Admin/EditMilestoneGroupModal.svelte';
 	import DeleteMilestoneGroupModal from '$lib/components/Admin/DeleteMilestoneGroupModal.svelte';
 	import { lang_id, milestoneGroups } from '$lib/stores/adminStore';
-	import { refreshMilestoneGroups, newMilestoneGroup } from '$lib/admin';
+	import { refreshMilestoneGroups, newMilestoneGroup, milestoneGroupImageUrl } from '$lib/admin';
 	import { onMount } from 'svelte';
 
 	let currentGroup: object | null = null;
@@ -77,7 +77,7 @@
 						</TableBodyCell>
 						<TableBodyCell>
 							<img
-								src={`${import.meta.env.VITE_MONDEY_API_URL}/static/milestone_group_${milestoneGroup.id}.jpg`}
+								src={milestoneGroupImageUrl(milestoneGroup.id)}
 								width="64"
 								height="64"
 								alt={title}
diff --git a/frontend/src/lib/components/Admin/NewMilestoneGroupModal.svelte b/frontend/src/lib/components/Admin/NewMilestoneGroupModal.svelte
deleted file mode 100644
index f31c115f..00000000
--- a/frontend/src/lib/components/Admin/NewMilestoneGroupModal.svelte
+++ /dev/null
@@ -1,108 +0,0 @@
-<script lang="ts">
-	import {
-		Button,
-		InputAddon,
-		Textarea,
-		Input,
-		Label,
-		ButtonGroup,
-		Fileupload,
-		Modal
-	} from 'flowbite-svelte';
-	import { FileImageSolid } from 'flowbite-svelte-icons';
-
-	export let open: boolean = false;
-	export let milestoneGroupData = {
-		group: { order: 0 },
-		text: [
-			{ lang: 'en', title: '', desc: '' },
-			{ lang: 'de', title: '', desc: '' }
-		]
-	};
-	let files: FileList;
-	let image: string | ArrayBuffer | null | undefined = '';
-
-	$: if (files) {
-		const reader = new FileReader();
-		reader.readAsDataURL(files[0]);
-		reader.onload = (e) => {
-			image = e?.target?.result;
-		};
-	}
-
-	async function postMilestoneGroup() {
-		console.log(milestoneGroupData);
-		try {
-			const res_milestone_group = await fetch(
-				`${import.meta.env.VITE_MONDEY_API_URL}/admin/milestone-groups/`,
-				{
-					method: 'POST',
-					credentials: 'include',
-					headers: {
-						'Content-Type': 'application/json',
-						Accept: 'application/json'
-					},
-					body: JSON.stringify(milestoneGroupData)
-				}
-			);
-			const new_milestone_group = await res_milestone_group.json();
-			console.log(new_milestone_group);
-			if (files) {
-				let formData = new FormData();
-				formData.append('file', files[0]);
-				const res_milestone_group_image = await fetch(
-					`${import.meta.env.VITE_MONDEY_API_URL}/admin/upload-milestone-group-image/${new_milestone_group.id}`,
-					{
-						method: 'POST',
-						credentials: 'include',
-						body: formData
-					}
-				);
-				const new_milestone_group_image = await res_milestone_group_image.json();
-				console.log(new_milestone_group_image);
-			}
-		} catch (e) {
-			console.error(e);
-		}
-	}
-</script>
-
-<Modal title="Create milestone group" bind:open autoclose size="xl">
-	<div class="mb-5">
-		<Label class="mb-2">Title</Label>
-		{#each milestoneGroupData.text as text}
-			<div class="mb-1">
-				<ButtonGroup class="w-full">
-					<InputAddon>{text.lang}</InputAddon>
-					<Input bind:value={text.title} placeholder="Title" />
-				</ButtonGroup>
-			</div>
-		{/each}
-	</div>
-	<div class="mb-5">
-		<Label class="mb-2">Description</Label>
-		{#each milestoneGroupData.text as text}
-			<div class="mb-1">
-				<ButtonGroup class="w-full">
-					<InputAddon>{text.lang}</InputAddon>
-					<Textarea bind:value={text.desc} placeholder="Description" />
-				</ButtonGroup>
-			</div>
-		{/each}
-	</div>
-	<div class="mb-5">
-		<Label for="img_upload" class="pb-2">Image</Label>
-		<div class="flex flex-row">
-			{#if image}
-				<img src={`${image ?? ''}`} width="48" height="48" alt="MilestoneGroup" class="mx-2" />
-			{:else}
-				<FileImageSolid class="h-[48px] w-[48px]" />
-			{/if}
-			<Fileupload bind:files accept=".jpg, .jpeg" id="img_upload" class="mb-2 flex-grow-0" />
-		</div>
-	</div>
-	<svelte:fragment slot="footer">
-		<Button color="green" on:click={postMilestoneGroup}>Save changes</Button>
-		<Button color="alternative">Cancel</Button>
-	</svelte:fragment>
-</Modal>
diff --git a/frontend/src/lib/stores/adminStore.ts b/frontend/src/lib/stores/adminStore.ts
index 9a8fb5da..1e37628b 100644
--- a/frontend/src/lib/stores/adminStore.ts
+++ b/frontend/src/lib/stores/adminStore.ts
@@ -1,9 +1,9 @@
-import { writable } from 'svelte/store';
+import { writable, type Writable } from 'svelte/store';
 
 export const isLoggedIn = writable(false);
 
 export const milestoneGroups = writable([]);
 
-export const languages = writable({});
+export const languages: Writable<Record<string, string>> = writable({});
 
 export const lang_id = writable('1');
diff --git a/mondey_backend/src/mondey_backend/main.py b/mondey_backend/src/mondey_backend/main.py
index d90b5b55..450c8db5 100644
--- a/mondey_backend/src/mondey_backend/main.py
+++ b/mondey_backend/src/mondey_backend/main.py
@@ -25,24 +25,26 @@ async def lifespan(app: FastAPI):
     yield
 
 
-# ensure static files directory exists
-pathlib.Path(app_settings.STATIC_FILES_PATH).mkdir(parents=True, exist_ok=True)
-app = FastAPI(lifespan=lifespan, title="MONDEY API", root_path="/api")
-app.include_router(milestones.router)
-app.include_router(admin.router)
-app.include_router(users.router)
-app.include_router(auth.router)
-app.mount(
-    "/static", StaticFiles(directory=app_settings.STATIC_FILES_PATH), name="static"
-)
-if app_settings.ENABLE_CORS:
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=["http://localhost:5173"],
-        allow_credentials=True,
-        allow_methods=["*"],
-        allow_headers=["*"],
+def create_app() -> FastAPI:
+    # ensure static files directory exists
+    pathlib.Path(app_settings.STATIC_FILES_PATH).mkdir(parents=True, exist_ok=True)
+    app = FastAPI(lifespan=lifespan, title="MONDEY API", root_path="/api")
+    app.include_router(milestones.create_router())
+    app.include_router(admin.create_router())
+    app.include_router(users.create_router())
+    app.include_router(auth.create_router())
+    app.mount(
+        "/static", StaticFiles(directory=app_settings.STATIC_FILES_PATH), name="static"
     )
+    if app_settings.ENABLE_CORS:
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=["http://localhost:5173"],
+            allow_credentials=True,
+            allow_methods=["*"],
+            allow_headers=["*"],
+        )
+    return app
 
 
 def main():
@@ -55,12 +57,13 @@ def main():
     for key, value in app_settings:
         logger.info(f"{key}: {value if key != 'SECRET' else '****************'}")
     uvicorn.run(
-        "mondey_backend.main:app",
+        "mondey_backend.main:create_app",
         host=app_settings.HOST,
         port=app_settings.PORT,
         reload=app_settings.RELOAD,
         log_level=app_settings.LOG_LEVEL,
         forwarded_allow_ips="*",
+        factory=True,
     )
 
 
diff --git a/mondey_backend/src/mondey_backend/models/milestones.py b/mondey_backend/src/mondey_backend/models/milestones.py
index 7adae87c..f9e597ae 100644
--- a/mondey_backend/src/mondey_backend/models/milestones.py
+++ b/mondey_backend/src/mondey_backend/models/milestones.py
@@ -54,7 +54,7 @@ class MilestoneGroupTextPublic(MilestoneGroupTextBase):
 
 class MilestoneGroup(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
-    order: int
+    order: int = 0
     text: Mapped[dict[int, MilestoneGroupText]] = Relationship(
         sa_relationship=relationship(
             collection_class=attribute_keyed_dict("lang_id"),
@@ -74,29 +74,26 @@ class MilestoneGroupAdmin(SQLModel):
     id: int
     order: int
     text: dict[int, MilestoneGroupText] = {}
-    milestones: list[Milestone] = []
+    milestones: list[MilestoneAdmin] = []
 
 
 ## MilestoneText
 
 
 class MilestoneTextBase(SQLModel):
-    name: str
-    desc: str
-    observation: str
-    help: str
+    title: str = ""
+    desc: str = ""
+    obs: str = ""
+    help: str = ""
 
 
 class MilestoneText(MilestoneTextBase, table=True):
-    id: int | None = Field(default=None, primary_key=True)
     milestone_id: int | None = Field(
-        default=None, foreign_key="milestone.id", index=True
+        default=None, foreign_key="milestone.id", primary_key=True
+    )
+    lang_id: int | None = Field(
+        default=None, foreign_key="language.id", primary_key=True
     )
-    lang: str = fixed_length_string_field(2, index=True)
-
-
-class MilestoneTextCreate(MilestoneTextBase):
-    lang: str = fixed_length_string_field(2, index=True)
 
 
 class MilestoneTextPublic(MilestoneTextBase):
@@ -106,55 +103,51 @@ class MilestoneTextPublic(MilestoneTextBase):
 ## Milestone
 
 
-class MilestoneBase(SQLModel):
-    order: int
-    group_id: int | None = Field(default=None, foreign_key="milestonegroup.id")
-
-
-class Milestone(MilestoneBase, table=True):
+class Milestone(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
+    group_id: int | None = Field(default=None, foreign_key="milestonegroup.id")
+    order: int = 0
     group: MilestoneGroup | None = back_populates("milestones")
+    text: Mapped[dict[int, MilestoneText]] = Relationship(
+        sa_relationship=relationship(
+            collection_class=attribute_keyed_dict("lang_id"),
+            cascade="all, delete-orphan",
+        )
+    )
     images: Mapped[list[MilestoneImage]] = back_populates("milestone")
 
 
-class MilestonePublic(MilestoneBase):
+class MilestonePublic(SQLModel):
     id: int
+    text: dict[int, MilestoneGroupTextPublic] = {}
+    images: list[MilestoneImagePublic] = []
 
 
-class MilestoneCreate(MilestoneBase):
-    pass
-
-
-class MilestoneUpdate(SQLModel):
-    name: str | None = None
-    desc: str | None = None
-    howto: str | None = None
-    help: str | None = None
-    order: int | None = None
-    group_id: int | None = None
+class MilestoneAdmin(SQLModel):
+    id: int
+    group_id: int
+    order: int
+    text: dict[int, MilestoneText] = {}
+    images: list[MilestoneImage] = []
 
 
 ## MilestoneImage
 
 
-class MilestoneImageBase(SQLModel):
-    image: str
+class MilestoneImage(SQLModel, table=True):
+    id: int | None = Field(default=None, primary_key=True)
     milestone_id: int | None = Field(default=None, foreign_key="milestone.id")
+    filename: str = ""
     approved: bool = False
-
-
-class MilestoneImage(MilestoneImageBase, table=True):
-    id: int | None = Field(default=None, primary_key=True)
     milestone: Milestone | None = back_populates("images")
 
 
-class MilestoneImagePublic(MilestoneImageBase):
-    id: int
-
+class MilestoneImagePublic(SQLModel):
+    filename: str
+    approved: bool
 
-class MilestoneImageCreate(MilestoneImageBase):
-    pass
 
+Text = MilestoneText | MilestoneGroupText
 
 ## MilestoneAnswer
 
diff --git a/mondey_backend/src/mondey_backend/routers/admin.py b/mondey_backend/src/mondey_backend/routers/admin.py
index 7f7fc374..77b091db 100644
--- a/mondey_backend/src/mondey_backend/routers/admin.py
+++ b/mondey_backend/src/mondey_backend/routers/admin.py
@@ -1,9 +1,6 @@
 from __future__ import annotations
 
-import logging
-
 from fastapi import APIRouter
-from fastapi import HTTPException
 from fastapi import UploadFile
 from sqlmodel import col
 from sqlmodel import select
@@ -13,150 +10,128 @@
 from ..models.milestones import Language
 from ..models.milestones import LanguageCreate
 from ..models.milestones import Milestone
-from ..models.milestones import MilestoneCreate
+from ..models.milestones import MilestoneAdmin
 from ..models.milestones import MilestoneGroup
 from ..models.milestones import MilestoneGroupAdmin
 from ..models.milestones import MilestoneGroupText
-from ..models.milestones import MilestonePublic
-from ..models.milestones import MilestoneUpdate
-
-router = APIRouter(prefix="/admin", tags=["admin"], dependencies=[AdminDep])
-
-
-@router.post("/language/", response_model=Language)
-def create_language(session: SessionDep, language: LanguageCreate):
-    db_language = Language.model_validate(language)
-    session.add(db_language)
-    session.commit()
-    session.refresh(db_language)
-    return db_language
-
-
-@router.delete("/language/{language_id}", response_model=Language)
-def delete_language(session: SessionDep, language_id: str):
-    language = session.get(Language, language_id)
-    if not language:
-        raise HTTPException(status_code=404, detail="language not found")
-    session.delete(language)
-    session.commit()
-    return {"ok": True}
-
-
-@router.get("/milestone-groups/", response_model=list[MilestoneGroupAdmin])
-def get_milestone_groups(session: SessionDep):
-    milestone_groups = session.exec(
-        select(MilestoneGroup).order_by(col(MilestoneGroup.order))
-    ).all()
-    return milestone_groups
-
-
-@router.post("/milestone-group/", response_model=MilestoneGroupAdmin)
-def create_milestone_group(session: SessionDep):
-    db_milestone_group = MilestoneGroup(order=0, image=None)
-    session.add(db_milestone_group)
-    session.commit()
-    session.refresh(db_milestone_group)
-    for language in session.exec(select(Language)).all():
-        session.add(
-            MilestoneGroupText(
-                group_id=db_milestone_group.id, lang_id=language.id, title="", desc=""
+from ..models.milestones import MilestoneImage
+from ..models.milestones import MilestoneText
+from ..settings import app_settings
+from .utils import add
+from .utils import get
+from .utils import update_milestone_group_text
+from .utils import update_milestone_text
+from .utils import write_file
+
+
+def create_router() -> APIRouter:
+    router = APIRouter(prefix="/admin", tags=["admin"], dependencies=[AdminDep])
+
+    @router.post("/languages/", response_model=Language)
+    def create_language(session: SessionDep, language: LanguageCreate):
+        db_language = Language.model_validate(language)
+        add(session, db_language)
+        return db_language
+
+    @router.delete("/languages/{language_id}", response_model=Language)
+    def delete_language(session: SessionDep, language_id: int):
+        language = get(session, Language, language_id)
+        session.delete(language)
+        session.commit()
+        return {"ok": True}
+
+    @router.get("/milestone-groups/", response_model=list[MilestoneGroupAdmin])
+    def get_milestone_groups(session: SessionDep):
+        milestone_groups = session.exec(
+            select(MilestoneGroup).order_by(col(MilestoneGroup.order))
+        ).all()
+        return milestone_groups
+
+    @router.post("/milestone-groups/", response_model=MilestoneGroupAdmin)
+    def create_milestone_group(session: SessionDep):
+        db_milestone_group = MilestoneGroup()
+        add(session, db_milestone_group)
+        for language in session.exec(select(Language)).all():
+            session.add(
+                MilestoneGroupText(group_id=db_milestone_group.id, lang_id=language.id)
+            )
+        session.commit()
+        session.refresh(db_milestone_group)
+        return db_milestone_group
+
+    @router.put("/milestone-groups", response_model=MilestoneGroupAdmin)
+    def update_milestone_group(
+        session: SessionDep,
+        milestone_group: MilestoneGroupAdmin,
+    ):
+        db_milestone_group = get(session, MilestoneGroup, milestone_group.id)
+        for key, value in milestone_group.model_dump(
+            exclude={"text", "milestones"}
+        ).items():
+            setattr(db_milestone_group, key, value)
+        update_milestone_group_text(session, milestone_group)
+        add(session, db_milestone_group)
+        return db_milestone_group
+
+    @router.delete("/milestone-groups/{milestone_group_id}")
+    def delete_milestone_group(session: SessionDep, milestone_group_id: int):
+        milestone_group = get(session, MilestoneGroup, milestone_group_id)
+        session.delete(milestone_group)
+        session.commit()
+        return {"ok": True}
+
+    @router.put("/milestone-group-images/{milestone_group_id}")
+    async def upload_milestone_group_image(
+        session: SessionDep, milestone_group_id: int, file: UploadFile
+    ):
+        milestone_group = get(session, MilestoneGroup, milestone_group_id)
+        filename = f"{app_settings.STATIC_FILES_PATH}/mg{milestone_group.id}.jpg"
+        write_file(file, filename)
+        return {"filename": filename}
+
+    @router.post("/milestones/{milestone_group_id}", response_model=MilestoneAdmin)
+    def create_milestone(session: SessionDep, milestone_group_id: int):
+        db_milestone = Milestone(group_id=milestone_group_id)
+        add(session, db_milestone)
+        for language in session.exec(select(Language)).all():
+            session.add(
+                MilestoneText(milestone_id=db_milestone.id, lang_id=language.id)
             )
-        )
-    session.commit()
-    session.refresh(db_milestone_group)
-    return db_milestone_group
-
-
-@router.patch("/milestone-group", response_model=MilestoneGroupAdmin)
-def update_milestone_group(
-    session: SessionDep,
-    milestone_group: MilestoneGroupAdmin,
-):
-    db_milestone_group = session.get(MilestoneGroup, milestone_group.id)
-    if not db_milestone_group:
-        raise HTTPException(status_code=404, detail="milestone_group not found")
-    for key, value in milestone_group.model_dump(
-        exclude={"text", "milestones"}
-    ).items():
-        setattr(db_milestone_group, key, value)
-    for text in milestone_group.text.values():
-        db_milestone_group_text = session.get(
-            MilestoneGroupText, (text.group_id, text.lang_id)
-        )
-        if not db_milestone_group_text:
-            db_milestone_group_text = text
-        else:
-            for key, value in text.model_dump().items():
-                setattr(db_milestone_group_text, key, value)
-        session.add(db_milestone_group_text)
-    session.add(db_milestone_group)
-    session.commit()
-    session.refresh(db_milestone_group)
-    return db_milestone_group
-
-
-@router.delete("/milestone-groups/{milestone_group_id}")
-def delete_milestone_group(session: SessionDep, milestone_group_id: int):
-    milestone_group = session.get(MilestoneGroup, milestone_group_id)
-    if not milestone_group:
-        raise HTTPException(status_code=404, detail="milestone_group not found")
-    session.delete(milestone_group)
-    session.commit()
-    return {"ok": True}
-
-
-@router.post("/upload-milestone-group-image/{milestone_group_id}")
-async def upload_milestone_group_image(
-    session: SessionDep, milestone_group_id: int, file: UploadFile
-):
-    milestone_group = session.get(MilestoneGroup, milestone_group_id)
-    filename = f"static/milestone_group_{milestone_group_id}.jpg"
-    if not milestone_group:
-        raise HTTPException(status_code=404, detail="milestone_group not found")
-    try:
-        contents = file.file.read()
-        with open(filename, "wb") as f:
-            f.write(contents)
-    except Exception as e:
-        logging.exception(e)
-        raise HTTPException(status_code=404, detail="Error uploading file") from e
-    finally:
-        file.file.close()
-    return {"filename": filename}
-
-
-@router.post("/milestones/", response_model=MilestonePublic)
-def create_milestone(session: SessionDep, milestone: MilestoneCreate):
-    db_milestone = Milestone.model_validate(milestone)
-    session.add(db_milestone)
-    session.commit()
-    session.refresh(db_milestone)
-    return db_milestone
-
-
-@router.patch("/milestones/{milestone_id}", response_model=MilestonePublic)
-def update_milestone(
-    session: SessionDep,
-    milestone_id: int,
-    milestone: MilestoneUpdate,
-):
-    db_milestone = session.get(Milestone, milestone_id)
-    if not db_milestone:
-        raise HTTPException(status_code=404, detail="milestone not found")
-    milestone_data = milestone.model_dump(exclude_unset=True)
-    for key, value in milestone_data.items():
-        setattr(db_milestone, key, value)
-    session.add(db_milestone)
-    session.commit()
-    session.refresh(db_milestone)
-    return db_milestone
-
-
-@router.delete("/milestones/{milestone_id}")
-def delete_milestone(session: SessionDep, milestone_id: int):
-    milestone = session.get(Milestone, milestone_id)
-    if not milestone:
-        raise HTTPException(status_code=404, detail="milestone not found")
-    session.delete(milestone)
-    session.commit()
-    return {"ok": True}
+        session.commit()
+        session.refresh(db_milestone)
+        return db_milestone
+
+    @router.put("/milestones", response_model=MilestoneAdmin)
+    def update_milestone(
+        session: SessionDep,
+        milestone: MilestoneAdmin,
+    ):
+        db_milestone = get(session, Milestone, milestone.id)
+        for key, value in milestone.model_dump(exclude={"text", "images"}).items():
+            setattr(db_milestone, key, value)
+        update_milestone_text(session, milestone)
+        add(session, db_milestone)
+        return db_milestone
+
+    @router.delete("/milestones/{milestone_id}")
+    def delete_milestone(session: SessionDep, milestone_id: int):
+        milestone = get(session, Milestone, milestone_id)
+        session.delete(milestone)
+        session.commit()
+        return {"ok": True}
+
+    @router.post("/milestone-images/{milestone_id}", response_model=MilestoneImage)
+    async def upload_milestone_image(
+        session: SessionDep, milestone_id: int, file: UploadFile
+    ):
+        milestone = get(session, Milestone, milestone_id)
+        milestone_image = MilestoneImage(milestone_id=milestone.id, approved=True)
+        add(session, milestone_image)
+        filename = f"{app_settings.STATIC_FILES_PATH}/m{milestone_image.id}.jpg"
+        write_file(file, filename)
+        milestone_image.filename = filename
+        session.commit()
+        session.refresh(milestone_image)
+        return milestone_image
+
+    return router
diff --git a/mondey_backend/src/mondey_backend/routers/auth.py b/mondey_backend/src/mondey_backend/routers/auth.py
index eeca59e0..e77802a1 100644
--- a/mondey_backend/src/mondey_backend/routers/auth.py
+++ b/mondey_backend/src/mondey_backend/routers/auth.py
@@ -7,8 +7,11 @@
 from ..users import auth_backend
 from ..users import fastapi_users
 
-router = APIRouter(prefix="/auth", tags=["auth"])
-router.include_router(fastapi_users.get_auth_router(auth_backend))
-router.include_router(fastapi_users.get_register_router(UserRead, UserCreate))
-router.include_router(fastapi_users.get_reset_password_router())
-router.include_router(fastapi_users.get_verify_router(UserRead))
+
+def create_router() -> APIRouter:
+    router = APIRouter(prefix="/auth", tags=["auth"])
+    router.include_router(fastapi_users.get_auth_router(auth_backend))
+    router.include_router(fastapi_users.get_register_router(UserRead, UserCreate))
+    router.include_router(fastapi_users.get_reset_password_router())
+    router.include_router(fastapi_users.get_verify_router(UserRead))
+    return router
diff --git a/mondey_backend/src/mondey_backend/routers/milestones.py b/mondey_backend/src/mondey_backend/routers/milestones.py
index c5b888cd..b69fdb99 100644
--- a/mondey_backend/src/mondey_backend/routers/milestones.py
+++ b/mondey_backend/src/mondey_backend/routers/milestones.py
@@ -12,49 +12,51 @@
 from ..models.milestones import MilestoneGroupPublic
 from ..models.milestones import MilestonePublic
 
-router = APIRouter(tags=["milestones"])
-
-
-@router.get("/languages/", response_model=dict[int, str])
-def get_languages(
-    session: SessionDep,
-):
-    return {
-        language.id: language.lang for language in session.exec(select(Language)).all()
-    }
-
-
-@router.get("/milestones/", response_model=list[MilestonePublic])
-def get_milestones(
-    session: SessionDep,
-):
-    milestones = session.exec(select(Milestone).order_by(col(Milestone.order))).all()
-    return milestones
-
-
-@router.get("/milestones/{milestone_id}", response_model=MilestonePublic)
-def get_milestone(session: SessionDep, milestone_id: int):
-    milestone = session.get(Milestone, milestone_id)
-    if not milestone:
-        raise HTTPException(
-            status_code=404, detail=f"Milestone with id {milestone_id} not found"
-        )
-    return milestone
-
-
-@router.get("/milestone-groups/", response_model=list[MilestoneGroupPublic])
-def get_milestone_groups(session: SessionDep):
-    milestone_groups = session.exec(
-        select(MilestoneGroup).order_by(col(MilestoneGroup.order))
-    ).all()
-    return milestone_groups
-
-
-@router.get(
-    "/milestone-groups/{milestone_group_id}", response_model=MilestoneGroupPublic
-)
-def get_milestone_group(session: SessionDep, milestone_group_id: int):
-    milestone_group = session.get(MilestoneGroup, milestone_group_id)
-    if not milestone_group:
-        raise HTTPException(status_code=404, detail="milestone_group not found")
-    return milestone_group
+
+def create_router() -> APIRouter:
+    router = APIRouter(tags=["milestones"])
+
+    @router.get("/languages/", response_model=dict[int, str])
+    def get_languages(
+        session: SessionDep,
+    ):
+        return {
+            language.id: language.lang
+            for language in session.exec(select(Language)).all()
+        }
+
+    @router.get("/milestones/", response_model=list[MilestonePublic])
+    def get_milestones(
+        session: SessionDep,
+    ):
+        milestones = session.exec(
+            select(Milestone).order_by(col(Milestone.order))
+        ).all()
+        return milestones
+
+    @router.get("/milestones/{milestone_id}", response_model=MilestonePublic)
+    def get_milestone(session: SessionDep, milestone_id: int):
+        milestone = session.get(Milestone, milestone_id)
+        if not milestone:
+            raise HTTPException(
+                status_code=404, detail=f"Milestone with id {milestone_id} not found"
+            )
+        return milestone
+
+    @router.get("/milestone-groups/", response_model=list[MilestoneGroupPublic])
+    def get_milestone_groups(session: SessionDep):
+        milestone_groups = session.exec(
+            select(MilestoneGroup).order_by(col(MilestoneGroup.order))
+        ).all()
+        return milestone_groups
+
+    @router.get(
+        "/milestone-groups/{milestone_group_id}", response_model=MilestoneGroupPublic
+    )
+    def get_milestone_group(session: SessionDep, milestone_group_id: int):
+        milestone_group = session.get(MilestoneGroup, milestone_group_id)
+        if not milestone_group:
+            raise HTTPException(status_code=404, detail="milestone_group not found")
+        return milestone_group
+
+    return router
diff --git a/mondey_backend/src/mondey_backend/routers/users.py b/mondey_backend/src/mondey_backend/routers/users.py
index 76af6420..e0df7fd6 100644
--- a/mondey_backend/src/mondey_backend/routers/users.py
+++ b/mondey_backend/src/mondey_backend/routers/users.py
@@ -6,5 +6,8 @@
 from ..models.users import UserUpdate
 from ..users import fastapi_users
 
-router = APIRouter(prefix="/users", tags=["users"])
-router.include_router(fastapi_users.get_users_router(UserRead, UserUpdate))
+
+def create_router() -> APIRouter:
+    router = APIRouter(prefix="/users", tags=["users"])
+    router.include_router(fastapi_users.get_users_router(UserRead, UserUpdate))
+    return router
diff --git a/mondey_backend/src/mondey_backend/routers/utils.py b/mondey_backend/src/mondey_backend/routers/utils.py
new file mode 100644
index 00000000..81359328
--- /dev/null
+++ b/mondey_backend/src/mondey_backend/routers/utils.py
@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import logging
+from collections.abc import Iterable
+
+from fastapi import HTTPException
+from fastapi import UploadFile
+from sqlmodel import SQLModel
+
+from ..dependencies import SessionDep
+from ..models.milestones import MilestoneAdmin
+from ..models.milestones import MilestoneGroupAdmin
+from ..models.milestones import MilestoneGroupText
+from ..models.milestones import MilestoneText
+from ..models.milestones import Text
+
+
+def write_file(file: UploadFile, filename: str):
+    logging.warning(f"Saving file {file.filename} to {filename}")
+    try:
+        contents = file.file.read()
+        with open(filename, "wb") as f:
+            f.write(contents)
+    except Exception as e:
+        logging.exception(e)
+        raise HTTPException(status_code=404, detail="Error saving uploaded file") from e
+    finally:
+        file.file.close()
+
+
+def get(session: SessionDep, entity: type, ident: int):
+    instance = session.get(entity, ident)
+    if not instance:
+        raise HTTPException(
+            status_code=404, detail=f"{entity} with id {ident} not found"
+        )
+    return instance
+
+
+def add(session: SessionDep, instance: SQLModel):
+    session.add(instance)
+    session.commit()
+    session.refresh(instance)
+
+
+def _update_text(
+    session: SessionDep, entity: type[Text], texts: Iterable[Text], ident: int
+):
+    for text in texts:
+        db_text = session.get(entity, (ident, text.lang_id))
+        if not db_text:
+            db_text = text
+        else:
+            for key, value in text.model_dump().items():
+                setattr(db_text, key, value)
+        session.add(db_text)
+
+
+def update_milestone_text(session: SessionDep, milestone: MilestoneAdmin):
+    _update_text(session, MilestoneText, milestone.text.values(), milestone.id)
+
+
+def update_milestone_group_text(
+    session: SessionDep, milestone_group: MilestoneGroupAdmin
+):
+    _update_text(
+        session, MilestoneGroupText, milestone_group.text.values(), milestone_group.id
+    )
diff --git a/mondey_backend/src/mondey_backend/settings.py b/mondey_backend/src/mondey_backend/settings.py
index f8ffe7df..aa9f1537 100644
--- a/mondey_backend/src/mondey_backend/settings.py
+++ b/mondey_backend/src/mondey_backend/settings.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import os
+
 from pydantic_settings import BaseSettings
 from pydantic_settings import SettingsConfigDict
 
@@ -20,3 +22,5 @@ class AppSettings(BaseSettings):
 
 
 app_settings = AppSettings()
+if os.environ.get("PYTEST_VERSION"):
+    app_settings.STATIC_FILES_PATH = "static2"
diff --git a/mondey_backend/tests/conftest.py b/mondey_backend/tests/conftest.py
index 8d0975c8..7fff77f3 100644
--- a/mondey_backend/tests/conftest.py
+++ b/mondey_backend/tests/conftest.py
@@ -1,14 +1,21 @@
 from __future__ import annotations
 
+import pathlib
+
 import pytest
+from fastapi import FastAPI
 from fastapi.testclient import TestClient
+from mondey_backend import settings
 from mondey_backend.dependencies import current_active_superuser
 from mondey_backend.dependencies import current_active_user
 from mondey_backend.dependencies import get_session
-from mondey_backend.main import app
+from mondey_backend.main import create_app
 from mondey_backend.models.milestones import Language
+from mondey_backend.models.milestones import Milestone
 from mondey_backend.models.milestones import MilestoneGroup
 from mondey_backend.models.milestones import MilestoneGroupText
+from mondey_backend.models.milestones import MilestoneImage
+from mondey_backend.models.milestones import MilestoneText
 from mondey_backend.models.users import UserRead
 from sqlmodel import Session
 from sqlmodel import SQLModel
@@ -16,8 +23,19 @@
 from sqlmodel.pool import StaticPool
 
 
+@pytest.fixture(scope="session")
+def static_dir(tmp_path_factory: pytest.TempPathFactory):
+    # use the same single temporary directory in all tests for static files
+    static_dir = tmp_path_factory.mktemp("static")
+    # add some milestone image files
+    for filename in ["m1.jpg", "m2.jpg", "m3.jpg"]:
+        with (static_dir / filename).open("w") as f:
+            f.write(filename)
+    return static_dir
+
+
 @pytest.fixture
-def session():
+def session(static_dir: pathlib.Path):
     # use a new in-memory SQLite database for each test
     engine = create_engine(
         "sqlite://",
@@ -26,18 +44,74 @@ def session():
         echo=False,
     )
     SQLModel.metadata.create_all(engine)
+    # add some test data
     with Session(engine) as session:
-        # add some test data to the database
-        session.add(Language(lang="de"))
-        session.add(Language(lang="en"))
-        session.add(Language(lang="fr"))
+        # add 3 languages
+        for lang in ["de", "en", "fr"]:
+            session.add(Language(lang=lang))
+        lang_ids = [1, 2, 3]
+        # add a milestone group with 3 milestones
         session.add(MilestoneGroup(order=2))
-        session.add(MilestoneGroupText(group_id=1, lang_id=1, title="t1", desc="d1"))
-        session.add(MilestoneGroupText(group_id=1, lang_id=2, title="t2", desc="d2"))
+        for lang_id in lang_ids:
+            lbl = f"g1_l{lang_id}"
+            session.add(
+                MilestoneGroupText(
+                    group_id=1, lang_id=lang_id, title=f"{lbl}_t", desc=f"{lbl}_d"
+                )
+            )
+        for milestone_id in [1, 2, 3]:
+            session.add(Milestone(order=0, group_id=1))
+            for lang_id in lang_ids:
+                lbl = f"m{milestone_id}_l{lang_id}"
+                session.add(
+                    MilestoneText(
+                        milestone_id=milestone_id,
+                        lang_id=lang_id,
+                        title=f"{lbl}_t",
+                        desc=f"{lbl}_d",
+                        obs=f"{lbl}_o",
+                        help=f"{lbl}_h",
+                    )
+                )
+        # add a second milestone group with 2 milestones
         session.add(MilestoneGroup(order=1))
-        session.add(MilestoneGroupText(group_id=2, lang_id=1, title="t3", desc="d3"))
-        session.add(MilestoneGroupText(group_id=2, lang_id=2, title="t4", desc="d4"))
-        session.add(MilestoneGroupText(group_id=2, lang_id=3, title="t5", desc="d5"))
+        for lang_id in lang_ids:
+            lbl = f"g1_l{lang_id}"
+            session.add(
+                MilestoneGroupText(
+                    group_id=2, lang_id=lang_id, title=f"{lbl}_t", desc=f"{lbl}_d"
+                )
+            )
+        for milestone_id in [4, 5]:
+            session.add(Milestone(order=0, group_id=2))
+            for lang_id in lang_ids:
+                lbl = f"m{milestone_id}_l{lang_id}"
+                session.add(
+                    MilestoneText(
+                        milestone_id=milestone_id,
+                        lang_id=lang_id,
+                        title=f"{lbl}_t",
+                        desc=f"{lbl}_d",
+                        obs=f"{lbl}_o",
+                        help=f"{lbl}_h",
+                    )
+                )
+        # add the milestone images that were created in the static directory
+        session.add(
+            MilestoneImage(
+                milestone_id=1, filename=str(static_dir / "m1.jpg"), approved=True
+            )
+        )
+        session.add(
+            MilestoneImage(
+                milestone_id=1, filename=str(static_dir / "m2.jpg"), approved=True
+            )
+        )
+        session.add(
+            MilestoneImage(
+                milestone_id=2, filename=str(static_dir / "m3.jpg"), approved=True
+            )
+        )
         session.commit()
         yield session
 
@@ -64,8 +138,17 @@ def user():
     )
 
 
+@pytest.fixture(scope="session")
+def app(static_dir: pathlib.Path):
+    settings.app_settings.STATIC_FILES_PATH = str(static_dir)
+    app = create_app()
+    return app
+
+
 @pytest.fixture
-def user_client(session: Session, user: UserRead):
+def user_client(
+    app: FastAPI, static_dir: pathlib.Path, session: Session, user: UserRead
+):
     app.dependency_overrides[get_session] = lambda: session
     app.dependency_overrides[current_active_user] = lambda: user
     client = TestClient(app)
@@ -74,9 +157,323 @@ def user_client(session: Session, user: UserRead):
 
 
 @pytest.fixture
-def admin_client(session: Session, admin: UserRead):
+def admin_client(
+    app: FastAPI, static_dir: pathlib.Path, session: Session, admin: UserRead
+):
     app.dependency_overrides[get_session] = lambda: session
     app.dependency_overrides[current_active_superuser] = lambda: admin
     client = TestClient(app)
     yield client
     app.dependency_overrides.clear()
+
+
+@pytest.fixture
+def jpg_file(tmp_path: pathlib.Path):
+    jpg_path = tmp_path / "test.jpg"
+    with jpg_path.open("w") as f:
+        f.write("test")
+    return jpg_path
+
+
+@pytest.fixture
+def milestone_group1(static_dir: pathlib.Path):
+    return {
+        "id": 1,
+        "text": {
+            "1": {"title": "g1_l1_t", "desc": "g1_l1_d"},
+            "2": {"title": "g1_l2_t", "desc": "g1_l2_d"},
+            "3": {"title": "g1_l3_t", "desc": "g1_l3_d"},
+        },
+        "milestones": [
+            {
+                "id": 1,
+                "text": {
+                    "1": {"title": "m1_l1_t", "desc": "m1_l1_d"},
+                    "2": {"title": "m1_l2_t", "desc": "m1_l2_d"},
+                    "3": {"title": "m1_l3_t", "desc": "m1_l3_d"},
+                },
+                "images": [
+                    {"filename": f"{static_dir}/m1.jpg", "approved": True},
+                    {"filename": f"{static_dir}/m2.jpg", "approved": True},
+                ],
+            },
+            {
+                "id": 2,
+                "text": {
+                    "1": {"title": "m2_l1_t", "desc": "m2_l1_d"},
+                    "2": {"title": "m2_l2_t", "desc": "m2_l2_d"},
+                    "3": {"title": "m2_l3_t", "desc": "m2_l3_d"},
+                },
+                "images": [{"filename": f"{static_dir}/m3.jpg", "approved": True}],
+            },
+            {
+                "id": 3,
+                "text": {
+                    "1": {"title": "m3_l1_t", "desc": "m3_l1_d"},
+                    "2": {"title": "m3_l2_t", "desc": "m3_l2_d"},
+                    "3": {"title": "m3_l3_t", "desc": "m3_l3_d"},
+                },
+                "images": [],
+            },
+        ],
+    }
+
+
+@pytest.fixture
+def milestone_group_admin1(static_dir: pathlib.Path):
+    return {
+        "id": 1,
+        "order": 2,
+        "text": {
+            "1": {"group_id": 1, "desc": "g1_l1_d", "title": "g1_l1_t", "lang_id": 1},
+            "2": {"group_id": 1, "desc": "g1_l2_d", "title": "g1_l2_t", "lang_id": 2},
+            "3": {"group_id": 1, "desc": "g1_l3_d", "title": "g1_l3_t", "lang_id": 3},
+        },
+        "milestones": [
+            {
+                "group_id": 1,
+                "order": 0,
+                "id": 1,
+                "images": [
+                    {
+                        "id": 1,
+                        "milestone_id": 1,
+                        "filename": f"{static_dir}/m1.jpg",
+                        "approved": True,
+                    },
+                    {
+                        "id": 2,
+                        "milestone_id": 1,
+                        "filename": f"{static_dir}/m2.jpg",
+                        "approved": True,
+                    },
+                ],
+                "text": {
+                    "1": {
+                        "obs": "m1_l1_o",
+                        "help": "m1_l1_h",
+                        "title": "m1_l1_t",
+                        "desc": "m1_l1_d",
+                        "milestone_id": 1,
+                        "lang_id": 1,
+                    },
+                    "2": {
+                        "obs": "m1_l2_o",
+                        "help": "m1_l2_h",
+                        "title": "m1_l2_t",
+                        "desc": "m1_l2_d",
+                        "milestone_id": 1,
+                        "lang_id": 2,
+                    },
+                    "3": {
+                        "obs": "m1_l3_o",
+                        "help": "m1_l3_h",
+                        "title": "m1_l3_t",
+                        "desc": "m1_l3_d",
+                        "milestone_id": 1,
+                        "lang_id": 3,
+                    },
+                },
+            },
+            {
+                "group_id": 1,
+                "order": 0,
+                "id": 2,
+                "images": [
+                    {
+                        "id": 3,
+                        "milestone_id": 2,
+                        "filename": f"{static_dir}/m3.jpg",
+                        "approved": True,
+                    }
+                ],
+                "text": {
+                    "1": {
+                        "obs": "m2_l1_o",
+                        "help": "m2_l1_h",
+                        "title": "m2_l1_t",
+                        "desc": "m2_l1_d",
+                        "milestone_id": 2,
+                        "lang_id": 1,
+                    },
+                    "2": {
+                        "obs": "m2_l2_o",
+                        "help": "m2_l2_h",
+                        "title": "m2_l2_t",
+                        "desc": "m2_l2_d",
+                        "milestone_id": 2,
+                        "lang_id": 2,
+                    },
+                    "3": {
+                        "obs": "m2_l3_o",
+                        "help": "m2_l3_h",
+                        "title": "m2_l3_t",
+                        "desc": "m2_l3_d",
+                        "milestone_id": 2,
+                        "lang_id": 3,
+                    },
+                },
+            },
+            {
+                "group_id": 1,
+                "order": 0,
+                "id": 3,
+                "images": [],
+                "text": {
+                    "1": {
+                        "obs": "m3_l1_o",
+                        "help": "m3_l1_h",
+                        "title": "m3_l1_t",
+                        "desc": "m3_l1_d",
+                        "milestone_id": 3,
+                        "lang_id": 1,
+                    },
+                    "2": {
+                        "obs": "m3_l2_o",
+                        "help": "m3_l2_h",
+                        "title": "m3_l2_t",
+                        "desc": "m3_l2_d",
+                        "milestone_id": 3,
+                        "lang_id": 2,
+                    },
+                    "3": {
+                        "obs": "m3_l3_o",
+                        "help": "m3_l3_h",
+                        "title": "m3_l3_t",
+                        "desc": "m3_l3_d",
+                        "milestone_id": 3,
+                        "lang_id": 3,
+                    },
+                },
+            },
+        ],
+    }
+
+
+@pytest.fixture
+def milestone_group2():
+    return {
+        "id": 2,
+        "text": {
+            "1": {"title": "g1_l1_t", "desc": "g1_l1_d"},
+            "2": {"title": "g1_l2_t", "desc": "g1_l2_d"},
+            "3": {"title": "g1_l3_t", "desc": "g1_l3_d"},
+        },
+        "milestones": [
+            {
+                "id": 4,
+                "images": [],
+                "text": {
+                    "1": {
+                        "desc": "m4_l1_d",
+                        "title": "m4_l1_t",
+                    },
+                    "2": {
+                        "desc": "m4_l2_d",
+                        "title": "m4_l2_t",
+                    },
+                    "3": {
+                        "desc": "m4_l3_d",
+                        "title": "m4_l3_t",
+                    },
+                },
+            },
+            {
+                "id": 5,
+                "images": [],
+                "text": {
+                    "1": {
+                        "desc": "m5_l1_d",
+                        "title": "m5_l1_t",
+                    },
+                    "2": {
+                        "desc": "m5_l2_d",
+                        "title": "m5_l2_t",
+                    },
+                    "3": {
+                        "desc": "m5_l3_d",
+                        "title": "m5_l3_t",
+                    },
+                },
+            },
+        ],
+    }
+
+
+@pytest.fixture
+def milestone_group_admin2():
+    return {
+        "id": 2,
+        "order": 1,
+        "text": {
+            "1": {"group_id": 2, "desc": "g1_l1_d", "title": "g1_l1_t", "lang_id": 1},
+            "2": {"group_id": 2, "desc": "g1_l2_d", "title": "g1_l2_t", "lang_id": 2},
+            "3": {"group_id": 2, "desc": "g1_l3_d", "title": "g1_l3_t", "lang_id": 3},
+        },
+        "milestones": [
+            {
+                "group_id": 2,
+                "order": 0,
+                "id": 4,
+                "images": [],
+                "text": {
+                    "1": {
+                        "obs": "m4_l1_o",
+                        "help": "m4_l1_h",
+                        "title": "m4_l1_t",
+                        "desc": "m4_l1_d",
+                        "milestone_id": 4,
+                        "lang_id": 1,
+                    },
+                    "2": {
+                        "obs": "m4_l2_o",
+                        "help": "m4_l2_h",
+                        "title": "m4_l2_t",
+                        "desc": "m4_l2_d",
+                        "milestone_id": 4,
+                        "lang_id": 2,
+                    },
+                    "3": {
+                        "obs": "m4_l3_o",
+                        "help": "m4_l3_h",
+                        "title": "m4_l3_t",
+                        "desc": "m4_l3_d",
+                        "milestone_id": 4,
+                        "lang_id": 3,
+                    },
+                },
+            },
+            {
+                "group_id": 2,
+                "order": 0,
+                "id": 5,
+                "images": [],
+                "text": {
+                    "1": {
+                        "obs": "m5_l1_o",
+                        "help": "m5_l1_h",
+                        "title": "m5_l1_t",
+                        "desc": "m5_l1_d",
+                        "milestone_id": 5,
+                        "lang_id": 1,
+                    },
+                    "2": {
+                        "obs": "m5_l2_o",
+                        "help": "m5_l2_h",
+                        "title": "m5_l2_t",
+                        "desc": "m5_l2_d",
+                        "milestone_id": 5,
+                        "lang_id": 2,
+                    },
+                    "3": {
+                        "obs": "m5_l3_o",
+                        "help": "m5_l3_h",
+                        "title": "m5_l3_t",
+                        "desc": "m5_l3_d",
+                        "milestone_id": 5,
+                        "lang_id": 3,
+                    },
+                },
+            },
+        ],
+    }
diff --git a/mondey_backend/tests/routers/test_admin.py b/mondey_backend/tests/routers/test_admin.py
index d44cb03c..d9441b0b 100644
--- a/mondey_backend/tests/routers/test_admin.py
+++ b/mondey_backend/tests/routers/test_admin.py
@@ -1,71 +1,31 @@
+import pathlib
+
 from fastapi.testclient import TestClient
 
 
 def test_post_language(admin_client: TestClient):
-    response = admin_client.post("/admin/language/", json={"lang": "es"})
+    response = admin_client.post("/admin/languages/", json={"lang": "es"})
     assert response.status_code == 200
     assert response.json() == {"id": 4, "lang": "es"}
 
 
 def test_delete_language(admin_client: TestClient):
-    response = admin_client.delete("/admin/language/2")
+    response = admin_client.delete("/admin/languages/2")
     assert response.status_code == 200
     assert admin_client.get("/languages").json() == {"1": "de", "3": "fr"}
 
 
-def test_get_milestone_groups(admin_client: TestClient):
+def test_get_milestone_groups(
+    admin_client: TestClient, milestone_group_admin1: dict, milestone_group_admin2: dict
+):
     response = admin_client.get("/admin/milestone-groups/")
     assert response.status_code == 200
     assert len(response.json()) == 2
-    group1, group2 = response.json()
-    assert group1 == {
-        "id": 2,
-        "order": 1,
-        "text": {
-            "1": {
-                "group_id": 2,
-                "lang_id": 1,
-                "title": "t3",
-                "desc": "d3",
-            },
-            "2": {
-                "group_id": 2,
-                "lang_id": 2,
-                "title": "t4",
-                "desc": "d4",
-            },
-            "3": {
-                "group_id": 2,
-                "lang_id": 3,
-                "title": "t5",
-                "desc": "d5",
-            },
-        },
-        "milestones": [],
-    }
-    assert group2 == {
-        "id": 1,
-        "order": 2,
-        "text": {
-            "1": {
-                "group_id": 1,
-                "lang_id": 1,
-                "title": "t1",
-                "desc": "d1",
-            },
-            "2": {
-                "group_id": 1,
-                "lang_id": 2,
-                "title": "t2",
-                "desc": "d2",
-            },
-        },
-        "milestones": [],
-    }
+    assert response.json() == [milestone_group_admin2, milestone_group_admin1]
 
 
 def test_post_milestone_group(admin_client: TestClient):
-    response = admin_client.post("/admin/milestone-group/")
+    response = admin_client.post("/admin/milestone-groups/")
     assert response.status_code == 200
     assert response.json() == {
         "id": 3,
@@ -94,30 +54,136 @@ def test_post_milestone_group(admin_client: TestClient):
     }
 
 
-def test_patch_milestone_groups(admin_client: TestClient):
-    data = admin_client.get("/admin/milestone-groups").json()[0]
-    data["order"] = 6
-    data["text"]["1"]["title"] = "asdsd"
-    data["text"]["1"]["desc"] = "12xzascdasdf"
-    data["text"]["2"]["title"] = "asqwdreqweqw"
-    data["text"]["2"]["desc"] = "th567"
-    response = admin_client.patch("/admin/milestone-group", json=data)
+def test_put_milestone_group(admin_client: TestClient, milestone_group_admin1: dict):
+    milestone_group = milestone_group_admin1
+    milestone_group["order"] = 6
+    milestone_group["text"]["1"]["title"] = "asdsd"
+    milestone_group["text"]["1"]["desc"] = "12xzascdasdf"
+    milestone_group["text"]["2"]["title"] = "asqwdreqweqw"
+    milestone_group["text"]["2"]["desc"] = "th567"
+    response = admin_client.put("/admin/milestone-groups", json=milestone_group)
     assert response.status_code == 200
-    assert response.json() == data
+    assert response.json() == milestone_group
 
 
-def test_admin_delete_milestone_group(admin_client: TestClient):
+def test_delete_milestone_group(admin_client: TestClient):
     assert admin_client.get("/milestone-groups/2").status_code == 200
     response = admin_client.delete("/admin/milestone-groups/2")
     assert response.status_code == 200
     assert admin_client.get("/milestone-groups/2").status_code == 404
+    response = admin_client.delete("/admin/milestone-groups/2")
+    assert response.status_code == 404
 
 
-def test_admin_delete_milestone_group_invalid_group_id(admin_client: TestClient):
+def test_delete_milestone_group_invalid_group_id(admin_client: TestClient):
     response = admin_client.delete("/admin/milestone-groups/692")
     assert response.status_code == 404
 
 
-def test_admin_delete_milestone_group_invalid_admin_user(user_client: TestClient):
+def test_delete_milestone_group_invalid_admin_user(user_client: TestClient):
     response = user_client.delete("/admin/milestone-groups/2")
     assert response.status_code == 401
+
+
+def test_put_milestone_group_image(
+    admin_client: TestClient, static_dir: pathlib.Path, jpg_file: pathlib.Path
+):
+    static_dir_jpg = static_dir / "mg1.jpg"
+    assert not static_dir_jpg.is_file()
+    with open(jpg_file, "rb") as f:
+        response = admin_client.put(
+            "/admin/milestone-group-images/1",
+            files={"file": ("filename", f, "image/jpeg")},
+        )
+    assert response.status_code == 200
+    assert static_dir_jpg.is_file()
+
+
+def test_post_milestone(admin_client: TestClient):
+    response = admin_client.post("/admin/milestones/2")
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": 6,
+        "group_id": 2,
+        "order": 0,
+        "text": {
+            "1": {
+                "milestone_id": 6,
+                "lang_id": 1,
+                "title": "",
+                "desc": "",
+                "obs": "",
+                "help": "",
+            },
+            "2": {
+                "milestone_id": 6,
+                "lang_id": 2,
+                "title": "",
+                "desc": "",
+                "obs": "",
+                "help": "",
+            },
+            "3": {
+                "milestone_id": 6,
+                "lang_id": 3,
+                "title": "",
+                "desc": "",
+                "obs": "",
+                "help": "",
+            },
+        },
+        "images": [],
+    }
+
+
+def test_put_milestone(admin_client: TestClient, milestone_group_admin1: dict):
+    milestone = milestone_group_admin1["milestones"][0]
+    milestone["order"] = 6
+    milestone["text"]["1"]["title"] = "asdsd"
+    milestone["text"]["1"]["desc"] = "12xzascdasdf"
+    milestone["text"]["1"]["obs"] = "asdrgf"
+    milestone["text"]["1"]["help"] = "jgfhj"
+    milestone["text"]["2"]["title"] = "asqwdreqweqw"
+    milestone["text"]["2"]["desc"] = "th567"
+    response = admin_client.put("/admin/milestones", json=milestone)
+    assert response.status_code == 200
+    assert response.json() == milestone
+
+
+def test_delete_milestone(admin_client: TestClient):
+    assert admin_client.get("/milestones/2").status_code == 200
+    response = admin_client.delete("/admin/milestones/2")
+    assert response.status_code == 200
+    assert admin_client.get("/milestones/2").status_code == 404
+    response = admin_client.delete("/admin/milestones/2")
+    assert response.status_code == 404
+
+
+def test_post_milestone_image(
+    admin_client: TestClient, static_dir: pathlib.Path, jpg_file: pathlib.Path
+):
+    # 3 milestone images already exist, image ids are sequential
+    assert len(admin_client.get("/milestones/1").json()["images"]) == 2
+    assert len(admin_client.get("/milestones/2").json()["images"]) == 1
+    assert len(admin_client.get("/milestones/3").json()["images"]) == 0
+    assert len(admin_client.get("/milestones/4").json()["images"]) == 0
+    assert len(admin_client.get("/milestones/5").json()["images"]) == 0
+    image_id = 3
+    # add an image to each milestone
+    for milestone_id in [1, 2, 3, 4, 5]:
+        image_id += 1
+        static_dir_jpg = static_dir / f"m{image_id}.jpg"
+        assert not static_dir_jpg.is_file()
+        with open(jpg_file, "rb") as f:
+            response = admin_client.post(
+                f"/admin/milestone-images/{milestone_id}",
+                files={"file": ("filename", f, "image/jpeg")},
+            )
+        assert response.status_code == 200
+        assert response.json()["filename"] == str(static_dir_jpg)
+        assert static_dir_jpg.is_file()
+    assert len(admin_client.get("/milestones/1").json()["images"]) == 3
+    assert len(admin_client.get("/milestones/2").json()["images"]) == 2
+    assert len(admin_client.get("/milestones/3").json()["images"]) == 1
+    assert len(admin_client.get("/milestones/4").json()["images"]) == 1
+    assert len(admin_client.get("/milestones/5").json()["images"]) == 1
diff --git a/mondey_backend/tests/routers/test_milestones.py b/mondey_backend/tests/routers/test_milestones.py
index 890661f0..2636def2 100644
--- a/mondey_backend/tests/routers/test_milestones.py
+++ b/mondey_backend/tests/routers/test_milestones.py
@@ -10,50 +10,36 @@ def test_get_languages(self, client_type: str, request: pytest.FixtureRequest):
         assert response.json() == {"1": "de", "2": "en", "3": "fr"}
 
     def test_get_milestone_groups(
-        self, client_type: str, request: pytest.FixtureRequest
+        self,
+        client_type: str,
+        milestone_group1: dict,
+        milestone_group2: dict,
+        request: pytest.FixtureRequest,
     ):
         client = request.getfixturevalue(client_type)
         response = client.get("/milestone-groups/")
         assert response.status_code == 200
         assert len(response.json()) == 2
-        group1, group2 = response.json()
-        assert group1 == {
-            "id": 2,
-            "text": {
-                "1": {"title": "t3", "desc": "d3"},
-                "2": {"title": "t4", "desc": "d4"},
-                "3": {"title": "t5", "desc": "d5"},
-            },
-            "milestones": [],
-        }
-        assert group2 == {
-            "id": 1,
-            "text": {
-                "1": {"title": "t1", "desc": "d1"},
-                "2": {"title": "t2", "desc": "d2"},
-            },
-            "milestones": [],
-        }
+        assert response.json() == [milestone_group2, milestone_group1]
 
     def test_get_milestone_group(
-        self, client_type: str, request: pytest.FixtureRequest
+        self,
+        client_type: str,
+        milestone_group1: dict,
+        milestone_group2: dict,
+        request: pytest.FixtureRequest,
     ):
         client = request.getfixturevalue(client_type)
-        response = client.get("/milestone-groups/2")
-        assert response.status_code == 200
-        assert response.json() == {
-            "id": 2,
-            "text": {
-                "1": {"title": "t3", "desc": "d3"},
-                "2": {"title": "t4", "desc": "d4"},
-                "3": {"title": "t5", "desc": "d5"},
-            },
-            "milestones": [],
-        }
+        response1 = client.get("/milestone-groups/1")
+        assert response1.status_code == 200
+        assert response1.json() == milestone_group1
+        response2 = client.get("/milestone-groups/2")
+        assert response2.status_code == 200
+        assert response2.json() == milestone_group2
 
     def test_get_milestone_group_invalid_id(
         self, client_type: str, request: pytest.FixtureRequest
     ):
         client = request.getfixturevalue(client_type)
-        response = client.get("/milestone-group/2")
+        response = client.get("/milestone-groups/99")
         assert response.status_code == 404