From 16a21c93d7c7149439efcce3e042a4af70776ce5 Mon Sep 17 00:00:00 2001 From: tmdeveloper007 Date: Fri, 24 Jul 2026 20:53:02 +0000 Subject: [PATCH] fix(tests): add unauthed_client fixture for saved-views auth tests Add unauthed_client fixture without dependency override so auth-rejection tests exercise the real require_api_key function. Update test_unauthenticated_request_rejected and test_wrong_api_key_rejected to use unauthed_client instead of app_client (which bypasses auth). Fixes backend-unit failures where these tests were asserting 200 == 401 because the app_client fixture unconditionally overrode require_api_key. --- testing/backend/unit/test_saved_views.py | 41 ++++++++++++++++++++---- 1 file changed, 35 insertions(+), 6 deletions(-) diff --git a/testing/backend/unit/test_saved_views.py b/testing/backend/unit/test_saved_views.py index 62c615051..0ec66c93a 100644 --- a/testing/backend/unit/test_saved_views.py +++ b/testing/backend/unit/test_saved_views.py @@ -61,6 +61,37 @@ async def app_client(): _auth_module._api_key = None +@pytest_asyncio.fixture +async def unauthed_client(): + """ + FastAPI app with saved_views_router and NO auth dependency override. + Used for tests that verify the real require_api_key enforcement, + specifically auth-rejection tests that must exercise the actual + authentication logic (not a mock that always succeeds). + """ + test_db = Database(":memory:") + await test_db.connect() + _db_module.db = test_db + + _app = FastAPI() + _app.include_router(saved_views_router) + # No dependency override — real require_api_key runs + + with tempfile.TemporaryDirectory() as tmp_data_dir: + api_key = _auth_module.init_api_key(tmp_data_dir) + + transport = ASGITransport(app=_app) + async with AsyncClient( + transport=transport, + base_url="http://test", + ) as client: + yield client + + await test_db.disconnect() + _db_module.db = None + _auth_module._api_key = None + + @pytest_asyncio.fixture async def other_owner_client(app_client: AsyncClient): """A second authenticated client acting as a different owner (`bob`), @@ -355,18 +386,16 @@ async def test_filter_json_with_null_values_rejected(app_client: AsyncClient): # ─── Auth & owner isolation (issue #1743) ──────────────────────────────────── @pytest.mark.asyncio -async def test_unauthenticated_request_rejected(app_client: AsyncClient): +async def test_unauthenticated_request_rejected(unauthed_client: AsyncClient): """Requests without a valid API key/session are rejected, not served.""" - res = await app_client.get( - "/api/v1/saved-views", headers={"X-Api-Key": ""} - ) + res = await unauthed_client.get("/api/v1/saved-views") assert res.status_code == 401 @pytest.mark.asyncio -async def test_wrong_api_key_rejected(app_client: AsyncClient): +async def test_wrong_api_key_rejected(unauthed_client: AsyncClient): """A malformed/incorrect API key is rejected.""" - res = await app_client.get( + res = await unauthed_client.get( "/api/v1/saved-views", headers={"X-Api-Key": "not-the-real-key"} ) assert res.status_code == 401