Aug 4 - Update code to follow up - MT13b

tests/conftest.py

@@ -36,7 +36,10 @@ import sys
 
 # ── Import-time env (must be set BEFORE `import app`) ────────────────────────
 # Assigned, NOT setdefault — see the module docstring.
-os.environ['SECRET_KEY']           = 'test-secret-key'
+# SECRET_KEY doubles as the JWT signing key (app/api/jwt_utils.py), and PyJWT
+# warns below 32 bytes for HMAC-SHA256 (RFC 7518 §3.2). Throwaway, but sized so
+# the API tests do not emit InsecureKeyLengthWarning on every token.
+os.environ['SECRET_KEY']           = 'test-secret-key-not-for-production-use-0123456789'
 os.environ['DATABASE_URL']         = 'sqlite:///:memory:'
 os.environ['MULTI_TENANT_ENABLED'] = 'false'
 os.environ['BILLING_ENABLED']      = 'false'
@@ -65,6 +68,23 @@ import pytest  # noqa: E402
 @pytest.fixture(scope='session')
 def app():
     """A minimal single-tenant app on in-memory SQLite (multi-tenancy inert)."""
+    # Flask-Limiter uses in-memory storage keyed on the remote address, and this
+    # fixture is session-scoped — so every login across the WHOLE suite shares
+    # one counter against /auth/login's '20 per minute'. Past that the login
+    # returns 429, the test client stays anonymous, and whatever the test does
+    # next is redirected to the login page. The failure surfaces as an unrelated
+    # assertion ("the edit did not apply"), only in full runs, and only once
+    # enough tests have logged in — so it moves around as tests are added or
+    # reordered.
+    #
+    # This MUST happen before create_app(). Limiter.init_app() does
+    # `self.enabled = config.setdefault('RATELIMIT_ENABLED', self.enabled)` and
+    # returns early when false, registering no request hooks — and `enabled` is
+    # never consulted again at request time (flask-limiter 4.x). Setting it
+    # afterwards is silently a no-op. Production limits are untouched.
+    from app import limiter
+    limiter.enabled = False
+
     from app import create_app
     application = create_app('default')
     application.config.update(TESTING=True, WTF_CSRF_ENABLED=False, SQLALCHEMY_ECHO=False)