From c15fe81498ecb46abe1ede634612e7ab60b2210b Mon Sep 17 00:00:00 2001 From: patrick Date: Thu, 10 Sep 2026 02:16:34 +0200 Subject: [PATCH] fix(tests): RLS-Bypass + Refresh-Fehler in Bearer-Auth-Tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Direkte DB-Inserts über db_session brauchen SET LOCAL app.bypass_rls='on' pro Transaktion (verfällt nach commit, siehe [[project_rls_bypass_commit_pitfall]]). db_session.refresh() nach commit schlug aus demselben Grund fehl – entfernt, nicht nötig. Bestehender test_heartbeat_missing_headers erwartete 422, liefert jetzt korrekt 401 (Header sind seit Bearer-Auth-Modus optional). 229/229 Tests grün auf 137. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Dzdm3EWeNdYFUuXFRJryA1 --- backend/tests/test_kiosk_security.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/backend/tests/test_kiosk_security.py b/backend/tests/test_kiosk_security.py index e7ad101..e72a170 100644 --- a/backend/tests/test_kiosk_security.py +++ b/backend/tests/test_kiosk_security.py @@ -256,12 +256,15 @@ async def test_kiosk_device_lifecycle(client: AsyncClient, kiosk_admin_headers, async def test_heartbeat_missing_headers(client: AsyncClient): - """Heartbeat ohne Kiosk-Header → 422 (FastAPI Validierungsfehler).""" + """Heartbeat ohne Kiosk-Header und ohne Bearer-Token → 401. + (Header sind seit Einführung des Bearer-Auth-Modus optional, damit beide + Auth-Wege über dieselbe Dependency laufen können; verify_kiosk_request + prüft das Fehlen beider Modi selbst und wirft 401 statt 422.)""" resp = await client.post( HEARTBEAT_URL, json={"queued_offline_entries": 0}, ) - assert resp.status_code == 422, resp.text + assert resp.status_code == 401, resp.text async def test_kiosk_devices_list( @@ -406,9 +409,10 @@ async def approved_bearer_device(db_session, registered_user): key_algorithm="bearer_vpn", device_token_hash=hash_token(token), ) + from sqlalchemy import text + await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'")) db_session.add(device) await db_session.commit() - await db_session.refresh(device) return device, token @@ -448,6 +452,8 @@ async def test_bearer_heartbeat_ip_whitelist_violation(client: AsyncClient, db_s device_token_hash=hash_token(token), ip_whitelist="10.99.99.0/24", ) + from sqlalchemy import text + await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'")) db_session.add(device) await db_session.commit() @@ -472,6 +478,8 @@ async def test_bearer_heartbeat_revoked_device(client: AsyncClient, db_session, key_algorithm="bearer_vpn", device_token_hash=hash_token(token), ) + from sqlalchemy import text + await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'")) db_session.add(device) await db_session.commit()