fix: typer exit codes, JWT 7d expiry, shared test fixtures, AdminTab query, mantine 9.6.3

backend/tests/test_auth.py

@@ -8,7 +8,7 @@ import pytest
 from sqlmodel import select
 
 from app.auth import service
-from app.auth.deps import SESSION_COOKIE, resolve_tenant
+from app.auth.deps import SESSION_COOKIE
 from app.models import MagicLinkToken, User
 from app.settings import settings
 
@@ -200,6 +200,28 @@ async def test_no_token_or_session_in_logs(client, session, caplog):
     assert service.hash_token(token) not in caplog.text
 
 
+def test_session_jwt_short_expiry_and_claims(session):
+    """Stateless sessions expire in days (no revocation — bound the window)."""
+    user = _get_or_make_user(session, MEMBER)
+    claims = service.decode_session_token(service.mint_session_token(user))
+    assert claims["sub"] == str(user.id)
+    assert claims["tenant_id"] == user.tenant_id
+    assert claims["exp"] - claims["iat"] == 7 * 24 * 3600
+
+
+async def test_deleted_user_token_fails_closed(client, session):
+    """Tokens of deleted users stop working (row reloaded per request)."""
+    user = _get_or_make_user(session, MEMBER)
+    token = service.issue_magic_token(session, user)
+    response = await client.post("/api/auth/magic/consume", json={"token": token})
+    assert response.status_code == 200, response.text
+    jwt_cookie = response.cookies[SESSION_COOKIE]
+    session.delete(user)
+    session.commit()
+    client.cookies.set(SESSION_COOKIE, jwt_cookie)
+    assert (await client.get("/api/auth/me")).status_code == 401
+
+
 async def test_access_request_rate_limit(client):
     email = f"impatient-{uuid4()}@example.com"
     for _ in range(service.REQUESTS_PER_EMAIL_PER_HOUR):
@@ -214,14 +236,6 @@ async def test_access_request_rate_limit(client):
     assert limited.status_code == 429
 
 
-def test_resolve_tenant():
-    assert resolve_tenant(None, None) == "default"
-    assert resolve_tenant(None, "acme") == "acme"
-    user = User(email="a@b.c", tenant_id="parish-7")
-    assert resolve_tenant(user, None) == "parish-7"
-    assert resolve_tenant(user, "other") == "parish-7"
-
-
 def _broken_smtp(monkeypatch):
     from app.auth import mail