Repository navigation
fix(tests): test_auth.py rate-limit test ineffective — Settings LRU cache not cleared after monkeypatch.setenv #271
Description
Summary
tests/test_auth.py patches RATE_LIMIT_DEFAULT_PER_MINUTE with monkeypatch.setenv() but never calls get_settings.cache_clear(). The get_settings() LRU cache returns the old Settings object with the original (high) rate limit. All 5 test requests return 200, making the 429 in statuses assertion unreliable — it passes only via accidental prior-test pollution.
Root Cause
tests/test_auth.py around line 154:
def test_authenticated_requests_are_rate_limited(client, monkeypatch):
monkeypatch.setenv('RATE_LIMIT_DEFAULT_PER_MINUTE', '3')
# get_settings.cache_clear() is MISSING here
for _ in range(5):
r = client.get('/v1/health', headers=auth_headers)
statuses.append(r.status_code)
assert 429 in statuses[3:] # ← unreliable, usually failsFailure Scenario
monkeypatch.setenvsets the env var, but the Settings LRU cache still returns the cachedSettings(rate_limit=60).- The rate limiter uses
limit=60. All 5 requests return 200. 429 in [200, 200, 200, 200, 200]→False. Test fails.- OR: A prior test accidentally left
rate_limit=3in a cached Settings object → test passes non-deterministically.
Proposed Fix
def test_authenticated_requests_are_rate_limited(monkeypatch):
monkeypatch.setenv('RATE_LIMIT_DEFAULT_PER_MINUTE', '3')
get_settings.cache_clear() # ← add this
# Build the client AFTER clearing the cache:
app = create_app(get_settings())
with TestClient(app) as client:
statuses = []
for _ in range(5):
r = client.get('/v1/health', headers=make_auth_headers())
statuses.append(r.status_code)
assert statuses[:3] == [200, 200, 200], "First 3 requests should succeed"
assert 429 in statuses[3:], "Requests 4-5 should be rate-limited"
Activity
piyushmakhija28 commentedon Jun 21, 2026
Fixed in PR #280 (Sprint R3/R4: fix(sprint-r3): root-cause fixes for all 39 bugs from code review round 3 + Sprint R4 round 4)