Aug 26 - Enhance security 4

tests/conftest.py

@@ -56,8 +56,13 @@ def auth_headers(token):
 
 def make_user(client, email='user@example.com', auth_hash='AUTH-HASH-V1',
               enc_key_salt='SALT-V1'):
-    """Register + log in. Returns (access_token, refresh_token)."""
-    assert register(client, email, auth_hash, enc_key_salt).status_code == 201
+    """
+    Register + log in. Returns (access_token, refresh_token).
+
+    Registration answers 202 for both new and duplicate addresses so it cannot
+    be used to probe account existence — see test_registration_privacy.py.
+    """
+    assert register(client, email, auth_hash, enc_key_salt).status_code == 202
     res = login(client, email, auth_hash)
     assert res.status_code == 200, res.get_json()
     body = res.get_json()