HIGH: All 800+ tests blocked by conftest.py crash — slowapi rate_limit_auth() decorator breaks on token() function #56

New issue

Closed

opened 2026-05-14 16:21:02 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 16:21:02 +00:00

Owner

Bug

The entire test suite fails to load. Conftest.py at backend/tests/conftest.py:31 imports from app.main import app, which triggers the full FastAPI router chain. The auth.py router uses @rate_limit_auth() decorator on the token() function, but the decorator from slowapi requires the function to have a request parameter — which token() lacks, having only form and session.

Error

Exception: No "request" or "websocket" argument on function "<function token at 0x...>"

Impact

All 800+ tests are blocked — none can load or run. This is a silent CI pipeline failure.

Root Cause

backend/app/routers/auth.py line 15:

@rate_limit_auth()  # slowapi limiter.limit(5/minute) — requires request param
@router.post("/token")
def token(form: OAuth2PasswordRequestForm = Depends(), session: Session = Depends(get_session)):
    ...

The rate_limit_auth() returns limiter.limit("5/minute") which wraps the function and inspects its signature for request or websocket. Since the token function doesn't have one, it raises.

Issue #908 already notes rate limiting is "completely disabled" — this is the root cause.

Fix Options

Add request: Request parameter to token() and other rate-limited functions
Fix rate_limit_auth() to use key_func that doesn't need a request param
Replace decorator-based rate limiting with middleware-only approach
Make conftest.py mock the app or use TestClient without triggering startup assertions

## Bug The entire test suite fails to load. Conftest.py at `backend/tests/conftest.py:31` imports `from app.main import app`, which triggers the full FastAPI router chain. The `auth.py` router uses `@rate_limit_auth()` decorator on the `token()` function, but the decorator from slowapi requires the function to have a `request` parameter — which `token()` lacks, having only `form` and `session`. ## Error ``` Exception: No "request" or "websocket" argument on function "<function token at 0x...>" ``` ## Impact **All 800+ tests are blocked** — none can load or run. This is a silent CI pipeline failure. ## Root Cause `backend/app/routers/auth.py` line 15: ```python @rate_limit_auth() # slowapi limiter.limit(5/minute) — requires request param @router.post("/token") def token(form: OAuth2PasswordRequestForm = Depends(), session: Session = Depends(get_session)): ... ``` The `rate_limit_auth()` returns `limiter.limit("5/minute")` which wraps the function and inspects its signature for `request` or `websocket`. Since the `token` function doesn't have one, it raises. ## Related Issue #908 already notes rate limiting is "completely disabled" — this is the root cause. ## Fix Options 1. Add `request: Request` parameter to `token()` and other rate-limited functions 2. Fix `rate_limit_auth()` to use `key_func` that doesn't need a request param 3. Replace decorator-based rate limiting with middleware-only approach 4. Make conftest.py mock the app or use TestClient without triggering startup assertions