Skip to content

fix(tests): stop unconditionally mocking require_api_key in saved-views tests #2193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Subramaniyajothi6 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix(tests): stop unconditionally mocking require_api_key in saved-views tests #2193

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4ffa32e
fix(tests): stop unconditionally mocking require_api_key in saved-vie…
Subramaniyajothi6 Jul 24, 2026
d4d3aa8
test(saved-views): un-skip the auth negative-path tests
Subramaniyajothi6 Jul 31, 2026
0b482da
Merge branch 'main' into fix/saved-views-auth-bypass-2192
Subramaniyajothi6 Aug 5, 2026
d57cb6a
Merge remote-tracking branch 'upstream/main' into fix/saved-views-aut…
Subramaniyajothi6 Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 4 additions & 12 deletions testing/backend/unit/test_saved_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,38 +10,32 @@
from fastapi import FastAPI
from backend.secuscan.saved_views import saved_views_router
from backend.secuscan.database import Database, get_db
from backend.secuscan.auth import require_api_key
import backend.secuscan.database as _db_module
import backend.secuscan.auth as _auth_module
from pathlib import Path


# ─── Fixtures ─────────────────────────────────────────────────────────────────

async def _mock_require_api_key() -> str:
"""Mock auth dependency that always succeeds."""
return "test-owner-id"


@pytest_asyncio.fixture
async def app_client():
"""
Spin up an isolated FastAPI app with an in-memory SQLite database
and the saved_views_router registered. The client authenticates as
the "default" owner (no X-User-Id header) using a real API key,
matching how routes.py's own tests exercise auth (issue #1743).

require_api_key is exercised for real (not mocked) so the auth
negative-path tests below actually verify enforcement instead of
always observing whatever the mock returns.
"""
# In-memory DB — isolated per test function
test_db = Database(":memory:")
await test_db.connect()
_db_module.db = test_db

# Minimal app with auth override
_app = FastAPI()
_app.include_router(saved_views_router)

# Override auth dependency to bypass authentication in tests
_app.dependency_overrides[require_api_key] = _mock_require_api_key

with tempfile.TemporaryDirectory() as tmp_data_dir:
api_key = _auth_module.init_api_key(tmp_data_dir)
Expand Down Expand Up @@ -354,7 +348,6 @@ async def test_filter_json_with_null_values_rejected(app_client: AsyncClient):

# ─── Auth & owner isolation (issue #1743) ────────────────────────────────────

@pytest.mark.skip(reason="pre-existing upstream issue: app_client overrides auth so 401 cannot be tested here")
@pytest.mark.asyncio
async def test_unauthenticated_request_rejected(app_client: AsyncClient):
"""Requests without a valid API key/session are rejected, not served."""
Expand All @@ -364,7 +357,6 @@ async def test_unauthenticated_request_rejected(app_client: AsyncClient):
assert res.status_code == 401


@pytest.mark.skip(reason="pre-existing upstream issue: app_client overrides auth so 401 cannot be tested here")
@pytest.mark.asyncio
async def test_wrong_api_key_rejected(app_client: AsyncClient):
"""A malformed/incorrect API key is rejected."""
Expand Down
Loading