5 idempotency tests broken after auth requirement on /v1/intent #250

New issue

Closed

opened 2026-07-22 18:13:51 +00:00 by Mark · 0 comments

Mark commented

2026-07-22 18:13:51 +00:00

Owner

Finding

The @validate_auth decorator on POST /v1/intent now correctly requires authentication, but 5 idempotency tests in tests/unit/test_http_entrypoint.py do not pass a JWT token.

Affected tests

Test	Expected	Got
`test_top_level_idempotency_key_accepted_for_non_provision_worker`	202	401
`test_payload_idempotency_key_echoed_in_response`	202	401
`test_top_level_key_precedence_in_response`	202	401
`test_no_idempotency_key_still_works`	202	401
`test_dedup_collapses_duplicate_idempotency_key`	202	401

Root cause

The @validate_auth decorator on /v1/intent correctly rejects unauthenticated requests with 401. The test fixtures (http_app) don't create or pass a JWT token. The auth system behavior is correct — the tests need updating to generate a token and include it in test requests.

How to reproduce

Check out master of Mark/mesh-seed
Run pytest tests/unit/test_http_entrypoint.py -k "idempotency" -v
Observe 5 tests failing with 401 instead of 202

Expected behavior

All 5 idempotency tests pass (return 202) by using a valid Authorization: Bearer <token> header obtained from the dev-mode login endpoint.

Suggested fix

Update the http_app fixture (or a dedicated fixture) to:

Call POST /v1/auth/login first (which accepts any API key in dev mode when MESH_API_KEY is unset)
Pass the returned access_token in the Authorization header of subsequent requests

Regression introduced by

Commit 9d69544 — "fix #137: AUTH-001 — Real Authentication System" (issue #137, closed)

Reported by post-deploy probe | kanban card t_dd7185dc

## Finding The `@validate_auth` decorator on `POST /v1/intent` now correctly requires authentication, but 5 idempotency tests in `tests/unit/test_http_entrypoint.py` do not pass a JWT token. ### Affected tests | Test | Expected | Got | |------|----------|-----| | `test_top_level_idempotency_key_accepted_for_non_provision_worker` | 202 | 401 | | `test_payload_idempotency_key_echoed_in_response` | 202 | 401 | | `test_top_level_key_precedence_in_response` | 202 | 401 | | `test_no_idempotency_key_still_works` | 202 | 401 | | `test_dedup_collapses_duplicate_idempotency_key` | 202 | 401 | ### Root cause The `@validate_auth` decorator on `/v1/intent` correctly rejects unauthenticated requests with 401. The test fixtures (`http_app`) don't create or pass a JWT token. The auth system behavior is correct — the tests need updating to generate a token and include it in test requests. ### How to reproduce 1. Check out `master` of Mark/mesh-seed 2. Run `pytest tests/unit/test_http_entrypoint.py -k "idempotency" -v` 3. Observe 5 tests failing with 401 instead of 202 ### Expected behavior All 5 idempotency tests pass (return 202) by using a valid `Authorization: Bearer <token>` header obtained from the dev-mode login endpoint. ### Suggested fix Update the `http_app` fixture (or a dedicated fixture) to: 1. Call `POST /v1/auth/login` first (which accepts any API key in dev mode when `MESH_API_KEY` is unset) 2. Pass the returned `access_token` in the `Authorization` header of subsequent requests ### Regression introduced by Commit `9d69544` — "fix #137: AUTH-001 — Real Authentication System" (issue #137, closed) --- _Reported by post-deploy probe | kanban card t_dd7185dc_