Spaces:
Sleeping
Sleeping
Commit History
-
test(F-10): regression tests for compacted storage + the use_count race
Covers: repeated auth against one key stays at 1 line, not N; 5 keys each verified twice stay at 5 lines; revoke doesn't duplicate lines; and the core regression -- 20 threads verifying the same key concurrently must produce use_count == 20. Verified this last test fails against the pre-fix code (observed 1, 2, or 3 across 3 runs, not 20) and passes reliably against the fix.36f93c8
-
test(F-6): regression tests for salting + backward compatibility
Covers: new keys get a real, non-empty, per-key salt; two keys never share a salt; a hand-constructed legacy record with no salt field (simulating a key issued before this fix) still verifies correctly; salt never appears in create/verify/list/revoke responses. All 16 tests in this file pass against the real api_key_manager.py.79844ab
-
chore(cleanup): remove api_key_manager.py's dead check_permission() and its tests
check_permission()/_ANALYST_PATHS/_ADMIN_PATHS were never called from any route — every route needing authorization instead reimplemented its own inline check (or, for analyze.py/cases.py, had none at all, fixed earlier in this branch via backend/core/auth.py). This function's existence, with _ANALYST_PATHS explicitly naming the two prefixes that turned out to be wide open, is what made that gap so clearly an oversight rather than a design choice. Now that backend/core/auth.py provides the real, actually-wired require_analyst/require_admin dependencies, this dead function (and its three tests, which validated logic that never ran in production) are removed rather than left as a second, unused authorization system.dd16fc4 -
fix(test): test_api_create_key_without_auth now uses a bare, unauthenticated client
This test verifies /api/v1/keys/ rejects requests with no auth at all, but it was reusing the shared conftest.py client fixture — which now auto-attaches an analyst-role Bearer token (added for analyze.py/ cases.py auth enforcement). The request therefore arrived authenticated (wrong role) rather than unauthenticated, getting 403 instead of the expected 401. Fix: construct a bare TestClient(app) locally in this test instead of depending on the shared, now-authenticated client fixture.82ba365
-
feat(rbac):API key management and role-based access control
02a7a61