test(hygiene): default seed credential is hard-coded in CLI test teardown #43

New issue

Closed

opened 2026-09-21 18:18:33 +00:00 by gabogg · 1 comment

gabogg commented

2026-09-21 18:18:33 +00:00

Owner

Context

Follow-up from the verification of #39 (comment #issuecomment-884). Minor.

Problem

tests/test_cli_commands.py::test_user_command_does_not_resurrect_deleted_user deletes the default admin account and restores it in teardown by re-creating it with the literal seed password:

finally:
    if not user_repo.get_by_username("admin"):
        user_repo.create_user("admin", "ControlHG", role="admin")
    user_repo.delete_user("temp_admin")

The test itself is sound — it was verified to fail against the pre-fix commit 7f3e2f4 and pass after — but it copies the seed credential from app/db/database.py:390 into the test suite by hand.

Two consequences: the credential string now lives in a second place and can drift from the seeder, and a grep for the default password returns test files as well as the seeder.

Proposed fix

Import the seed constant rather than retyping it, or restore the fixture state through a helper that reuses whatever init_db seeds. Extracting the seed pairs in database.py:390 into a named module-level constant would serve both this and any future test that needs the same thing.

Acceptance criteria

No hard-coded default password literal in the test suite.
test_user_command_does_not_resurrect_deleted_user still fails against 7f3e2f4 and passes on master.

## Context Follow-up from the verification of #39 (comment [#issuecomment-884](https://git.gaboggamer.online/gabogg/hikcentral/pulls/39#issuecomment-884)). Minor. ## Problem `tests/test_cli_commands.py::test_user_command_does_not_resurrect_deleted_user` deletes the default `admin` account and restores it in teardown by re-creating it with the literal seed password: ```python finally: if not user_repo.get_by_username("admin"): user_repo.create_user("admin", "ControlHG", role="admin") user_repo.delete_user("temp_admin") ``` The test itself is sound — it was verified to fail against the pre-fix commit `7f3e2f4` and pass after — but it copies the seed credential from `app/db/database.py:390` into the test suite by hand. Two consequences: the credential string now lives in a second place and can drift from the seeder, and a grep for the default password returns test files as well as the seeder. ## Proposed fix Import the seed constant rather than retyping it, or restore the fixture state through a helper that reuses whatever `init_db` seeds. Extracting the seed pairs in `database.py:390` into a named module-level constant would serve both this and any future test that needs the same thing. ## Acceptance criteria - [ ] No hard-coded default password literal in the test suite. - [ ] `test_user_command_does_not_resurrect_deleted_user` still fails against `7f3e2f4` and passes on `master`.

gabogg added the

needs-triage

label

2026-09-21 18:18:33 +00:00

~~gabogg referenced this issue 2026-09-21 18:35:05 +00:00~~

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45

gabogg referenced this issue

2026-09-21 18:54:41 +00:00

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45

gabogg referenced this issue

2026-09-21 19:41:30 +00:00

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45