Light1YT
0247f13fb6
The whole backend api/v1 test suite hits `app` via TestClient mimo Caddy, so rbac_guard (app/main.py) 401'd every authed request (no X-Authenticated-User) — 112 tests red, the suite effectively dead (which is how #994's district 500 shipped uncaught). Add `settings.testing` (default False — prod RBAC untouched) + a strictly-gated bypass at the top of rbac_guard; tests/conftest.py enables it (env TESTING=1 + settings.testing=True before app import). Security: bypass fires ONLY when settings.testing is True, which is set NOWHERE in prod (default False; only tests/conftest.py flips it). RBAC's 401/403 logic stays covered by tests/test_rbac.py (its own middleware copy, ignores the flag). Effect: 112 → 42 failed, 1590 → 1660 passed. Remaining 42 (+5 mv_layout env errors) are stale-mock/assertion drift + env-required tests — fixed in CI-rehab 2/3. Foundation for a real Forgejo pytest gate (3/3). Refs #944. |
||
|---|---|---|
| .. | ||
| api | ||
| core | ||
| models | ||
| observability | ||
| schemas | ||
| scrapers | ||
| services | ||
| templates | ||
| workers | ||
| __init__.py | ||
| main.py | ||