fix(auth): fail closed when deleting user tokens fails (#3733)

tests/test_auth_config_lock_concurrency.py

@@ -8,6 +8,9 @@ with missing users or assertion errors.
 import json
 import threading
 import time
+import contextlib
+import sys
+import types
 from concurrent.futures import ThreadPoolExecutor, as_completed
 
 import pytest
@@ -15,6 +18,41 @@ import pytest
 from tests.helpers.import_state import clear_module
 
 
+class _OwnerColumn:
+    def __eq__(self, other):
+        return ("owner ==", other)
+
+
+class _FakeApiToken:
+    owner = _OwnerColumn()
+
+
+class _FakeQuery:
+    def filter(self, *_conds):
+        return self
+
+    def delete(self, *args, **kwargs):
+        return 0
+
+
+class _FakeSession:
+    def query(self, model):
+        assert model is _FakeApiToken
+        return _FakeQuery()
+
+
+@pytest.fixture(autouse=True)
+def _stub_api_token_purge(monkeypatch):
+    @contextlib.contextmanager
+    def _fake_db_session():
+        yield _FakeSession()
+
+    db_stub = types.ModuleType("core.database")
+    db_stub.get_db_session = _fake_db_session
+    db_stub.ApiToken = _FakeApiToken
+    monkeypatch.setitem(sys.modules, "core.database", db_stub)
+
+
 def _fresh_auth_manager(tmp_path):
     clear_module("core.auth")
     from core.auth import AuthManager

tests/test_delete_user_invalidates_token_cache.py

@@ -36,6 +36,17 @@ def _auth_manager(delete_result):
     )
 
 
+def _auth_manager_raising():
+    def _delete_user(_username, _requesting_user):
+        raise RuntimeError("auth save failed after token purge")
+
+    return types.SimpleNamespace(
+        get_username_for_token=lambda token: "admin",
+        is_admin=lambda user: True,
+        delete_user=_delete_user,
+    )
+
+
 def test_successful_delete_invalidates_cache():
     invalidations = []
     router = setup_auth_routes(_auth_manager(delete_result=True))
@@ -56,3 +67,16 @@ def test_refused_delete_does_not_invalidate_cache():
         raised = True
     assert raised, "a refused delete should raise (HTTP 400)"
     assert invalidations == [], "a refused delete must not touch the token cache"
+
+
+def test_delete_exception_invalidates_cache_for_partial_token_purge():
+    invalidations = []
+    router = setup_auth_routes(_auth_manager_raising())
+    handler = _handler(router)
+    try:
+        asyncio.run(handler(DeleteUserRequest(username="bob"), _fake_request(invalidations)))
+        raised = False
+    except RuntimeError:
+        raised = True
+    assert raised, "delete_user exception should still propagate"
+    assert invalidations == [True], "partial token purge must dirty the bearer cache"

tests/test_delete_user_revokes_api_tokens.py

@@ -114,3 +114,21 @@ def test_refused_delete_leaves_tokens_alone(manager, db_calls):
 def test_unknown_user_leaves_tokens_alone(manager, db_calls):
     assert manager.delete_user("ghost", "admin") is False
     assert db_calls == []
+
+
+def test_delete_user_fails_closed_when_api_token_purge_fails(manager, monkeypatch):
+    token = manager.create_session("bob", "secret-bob-pw")
+
+    @contextlib.contextmanager
+    def _failing_db_session():
+        raise RuntimeError("database unavailable")
+        yield
+
+    db_stub = types.ModuleType("core.database")
+    db_stub.get_db_session = _failing_db_session
+    db_stub.ApiToken = _FakeApiToken
+    monkeypatch.setitem(sys.modules, "core.database", db_stub)
+
+    assert manager.delete_user("bob", "admin") is False
+    assert "bob" in manager.users
+    assert manager.validate_token(token) is True