From df80a2e3ec3ac076487f972f0a5cd7dfb8431aa0 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Mon, 20 Jul 2026 15:55:27 -0400 Subject: [PATCH] =?UTF-8?q?test:=20address=20Open=20SWE=20review=20?= =?UTF-8?q?=E2=80=94=20xfail=20the=20web=5Fui=20non-ASCII=20auth=20pin,=20?= =?UTF-8?q?document=20subset=20coverage-floor=20override?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - tests/test_web_ui_auth.py: replace the TypeError characterization pin with an xfail(strict, raises=TypeError) asserting the DESIRED fail-closed (False) behavior. Documents the intended fix and auto-fails (xpass) once web_ui_auth is corrected, instead of requiring a passing test to be knowingly deleted. The module stays frozen this phase; the underlying hmac.compare_digest ASCII-only defect is tracked as a follow-up. - pytest.ini: document that the aggregate 80% floor (enforced in CI via the reusable workflow's bare pytest) red-exits local subset runs by design, with the --cov-fail-under=0 override for iteration. Floor stays in addopts because the centralized ci-python-sam workflow exposes no per-run test command. --- pytest.ini | 7 +++++++ tests/test_web_ui_auth.py | 17 +++++++++++------ 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/pytest.ini b/pytest.ini index b84ad2f..9511b4a 100644 --- a/pytest.ini +++ b/pytest.ini @@ -15,3 +15,10 @@ addopts = --cov=lambdas/shared --cov-report=term-missing --cov-fail-under=80 +; The 80% floor is an aggregate whole-suite gate, enforced in CI by the +; reusable ci-python-sam workflow's bare `pytest` run (which inherits these +; addopts). Because the floor is inherited by every invocation, running a +; single root or file for local iteration (e.g. `pytest tests/test_web_ui_auth.py`) +; under-measures the fixed --cov set and red-exits even when the selected tests +; pass. That is expected: append `--cov-fail-under=0` (or `-p no:cov`) to a +; subset run to skip the floor while iterating. The full-suite run still gates. diff --git a/tests/test_web_ui_auth.py b/tests/test_web_ui_auth.py index 382cbf2..8602e96 100644 --- a/tests/test_web_ui_auth.py +++ b/tests/test_web_ui_auth.py @@ -105,11 +105,16 @@ def test_header_matrix(load_auth, monkeypatch, headers, expected): assert mod.is_authenticated(_evt(**headers)) is expected -def test_non_ascii_token_raises_typeerror_documenting_pin(load_auth, monkeypatch): - """PIN (current behavior, fix deferred -- module frozen this phase): a - non-ASCII presented token makes hmac.compare_digest raise TypeError (surfaces - as a 500 today). Locked so a future fix is a deliberate, reviewed change.""" +@pytest.mark.xfail( + strict=True, + reason="web_ui_auth is frozen this phase: is_authenticated raises TypeError on " + "a non-ASCII presented token (hmac.compare_digest is ASCII-only) and surfaces " + "as a 500 instead of failing closed to False. Asserting the DESIRED behavior " + "under xfail(strict) documents the intended fix and auto-fails (xpass) the moment " + "the module is corrected, forcing the marker's removal. Tracked as a follow-up.", + raises=TypeError, +) +def test_non_ascii_token_should_fail_closed(load_auth, monkeypatch): mod = load_auth() monkeypatch.setattr(mod, "_get_auth_token", lambda: "SECRET") - with pytest.raises(TypeError): - mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"})) + assert mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"})) is False