Repository navigation
SLM backend: add direct test coverage for GET /api/auth/me #16385
Description
Activity
- added a commit that references this issue
on Sep 11, 2026 - added a commit that references this issue
on Sep 13, 2026 Closed — both criteria delivered in
autobot-slm-backend/tests/api/test_auth_me_16385.py, verified at2a6c281760AC1 — 2xx for a valid session token, via the real
get_current_user.
TestAuthMeValidToken::test_valid_token_returns_2xxmints a token, calls
GET /api/auth/methrough aTestClient, and asserts both halves:assert 200 <= resp.status_code < 300, resp.text assert resp.json() == {"username": "testuser", "is_admin": False, "user_type": "slm_admin"}
The status range and the body, not one standing in for the other.
AC2 — 401 for a missing or invalid token. Six assertions at
:260,:271,:277,
:288,:293,:299, covering missing, malformed and well-formed-but-wrong-signature,
plus the password-epoch cases where a token issued before a password change is rejected
and one issued after is accepted.And the test is wired to the real dependency rather than a stand-in, which is what
the criterion's "via the realget_current_user" was guarding against. The file says
so at:13and:19: other tests patchget_current_user_infowith aMagicMockand
can never produce a real HTTP outcome, so this one leavesget_current_useras the
genuine dependency.:26-28adds thatget_current_user_infois extracted from
api/auth.pyby AST, not by import, so a future change to that route's body or
decorator is caught rather than silently bypassed.That last point is why this closes rather than merely passing: the test asserts the
route's real behaviour and would notice if the route stopped being the thing under test.
What
Found while implementing #16374. #16374's nginx
auth_requestgate on/autobot-api/targetsGET /api/auth/me(autobot-slm-backend/api/auth.py,get_current_user_info) as its session-verify endpoint: 2xx for a valid SLM session, 401/403 otherwise (services/auth.py'ssecurity = HTTPBearer()andget_current_user).get_current_useritself is exercised indirectly by other tests (autobot-slm-backend/tests/api/test_slm_endpoints_12515.py,test_drift_resolve.py,test_local_admin_socket_15728.py,test_step_up_auth.py), but nothing tests the/api/auth/meroute directly — valid-session-gives-2xx / missing-or-invalid-gives-401 for that specific route has no test today. Not added in #16374 itself: this repo's SLM API tests bootstrap a heavy stub environment per file (seetest_auth_logout.py's module-level sys.modules dance) rather than a realTestClient, and building that correctly for a new route is separate scope from the nginx template change.Why it matters now
This route is no longer just a UI convenience call — it is the fail-closed gate protecting every
/autobot-api/*request from carrying backend-admin credentials. A regression inget_current_user_infoor itsget_current_userdependency (e.g. always returning 200, or crashing in a way nginx'sauth_requesttreats as pass-through) would silently reopen #16374.Acceptance criteria
GET /api/auth/mereturns 2xx for a valid session token (via the realget_current_userdependency, not a mock of the route itself).HTTPBearer's default) for a missing or invalid token.