From 38742ad4b6daaa7b7e3928cdd67b8ec653577afd Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Mon, 17 Aug 2026 21:24:54 +0800 Subject: [PATCH] tests: sign class-scoped client tokens with the default JWT secret Since aef337e86 the config loader generates a random JWT secret even without a main config file, so the class-scoped client/authorized_client fixtures signed their tokens with a key that the autouse run_around_tests fixture would immediately replace with the default one for every test function. Every controller API test using those fixtures was failing with 401 (BadSignature). Sign both fixtures explicitly with DEFAULT_JWT_SECRET_KEY to match the secret enforced at request time. --- tests/conftest.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 7271179a0..f67b04839 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -155,7 +155,10 @@ def unauthorized_client(base_client: AsyncClient, test_user: User) -> AsyncClien @pytest_asyncio.fixture(loop_scope="class", scope="class") def authorized_client(base_client: AsyncClient, test_user: User) -> AsyncClient: - access_token = auth_service.create_access_token(test_user.username) + # Sign with the default secret key: the class-scoped token must stay valid + # across every test, but "run_around_tests" resets the config and forces + # jwt_secret_key back to the default for each test function. + access_token = auth_service.create_access_token(test_user.username, secret_key=DEFAULT_JWT_SECRET_KEY) base_client.headers = { **base_client.headers, "Authorization": f"Bearer {access_token}", @@ -168,7 +171,9 @@ async def client(base_client: AsyncClient) -> AsyncClient: # The super admin is automatically created when the users table is created # this account that can access all endpoints without restrictions. - access_token = auth_service.create_access_token("admin") + # Sign with the default secret key so the token matches the one enforced + # by "run_around_tests" when the config is reset for each test function. + access_token = auth_service.create_access_token("admin", secret_key=DEFAULT_JWT_SECRET_KEY) base_client.headers = { **base_client.headers, "Authorization": f"Bearer {access_token}",