configs/.env.example

@@ -11,4 +11,6 @@ DB_PORT="change_me"
 
 REDIS_PASSWORD="change_me"
 REDIS_PORT=change_me #int
-REDIS_HOST="change_me"
+REDIS_HOST="change_me"
+
+PROD_MODE=bool

src/models/configs_read/env.py

@@ -20,6 +20,8 @@ class Env(Base):
     REDIS_PORT:int
     REDIS_HOST:str
     
+    PROD_MODE:bool
+    
     model_config=SettingsConfigDict(env_file="configs/.env", extra=None)
 
 env_settings=Env()  # type: ignore[call-arg]

src/web/protected_routes/auth_routes.py

@@ -38,7 +38,7 @@ async def get_access_token(request: Request,
         key="refresh_token",
         value=refresh_token,
         httponly=True,
-        secure=True,
+        secure=env_settings.PROD_MODE,
         samesite="strict",
         max_age=env_settings.REFRESH_TOKEN_EXPIRE_DAYS * 24 * 60 * 60
     )
@@ -57,7 +57,7 @@ async def get_refresh_token(request:Request,
         key="refresh_token",
         value=refresh_token,
         httponly=True,
-        secure=True,
+        secure=env_settings.PROD_MODE,
         samesite="strict",
         max_age=env_settings.REFRESH_TOKEN_EXPIRE_DAYS * 24 * 60 * 60
     )

tests/e2e/test_auth.py

@@ -68,7 +68,7 @@ class TestRedis:
     
     
     @pytest.mark.parametrize("test_user_fixture", [([], [])], indirect=True)
-    async def test_get_logout_revoke_positive(self,test_user_fixture, target_url:str)->None:
+    async def test_logout_revokes_access_token(self,test_user_fixture, target_url:str)->None:
         
         session=test_user_fixture[0]
         
@@ -80,5 +80,5 @@ class TestRedis:
         with allure.step("verify token is revoked"), pytest.raises(HTTPStatusError) as exc_info:
             response = await session.get(f"{target_url}/protected")
             response.raise_for_status()
-        assert exc_info.value.response.status_code==429
+        assert exc_info.value.response.status_code==401