From 20f49e7bdaec342647120e04baedb451fdcbb48a Mon Sep 17 00:00:00 2001 From: Isla-Liu Date: Wed, 27 May 2026 09:29:48 +0800 Subject: [PATCH] docs(config): address PR #2964 review nits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Comment alongside _AUTH_FINGERPRINT_VOLATILE_KEYS notes client_secret is treated as rotation-only on purpose, not a model-cache differentiator (maintainer §Concerns 3). * _write_auth docstring at tests/test_issue_t16551f61_auth_token_churn_ fingerprint.py:108 now describes actual behavior (writes + monkeypatch, no sleep+restat) — Copilot r3302471228. Refs #2242. PR #2964 review. --- api/config.py | 2 +- .../test_issue_t16551f61_auth_token_churn_fingerprint.py | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/api/config.py b/api/config.py index 91544913..103c9f21 100644 --- a/api/config.py +++ b/api/config.py @@ -2603,7 +2603,7 @@ _AUTH_FINGERPRINT_VOLATILE_KEYS = frozenset({ "id_token", "api_key", "secret", - "client_secret", + "client_secret", # rotation-only on purpose; not a model-cache differentiator # Expiry / liveness — bumped every refresh, derived from the token above. "expires_at", "expires_at_ms", diff --git a/tests/test_issue_t16551f61_auth_token_churn_fingerprint.py b/tests/test_issue_t16551f61_auth_token_churn_fingerprint.py index 9e3f19ff..bf06b443 100644 --- a/tests/test_issue_t16551f61_auth_token_churn_fingerprint.py +++ b/tests/test_issue_t16551f61_auth_token_churn_fingerprint.py @@ -102,10 +102,11 @@ def _auth_store(*, active_provider="anthropic", extra_pool_provider=None, def _write_auth(tmp_path, monkeypatch, store: dict): """Point _get_auth_store_path() at a tmp auth.json and write `store`. - Sleeps 10ms and re-stats to guarantee mtime_ns/size would differ between - successive writes — proving the OLD stat-based fingerprint WOULD have - churned, so a stable result is attributable to the content fix, not to - the OS coincidentally reusing mtime/size. + Writes `store` as JSON to a tmp auth.json and monkeypatches + config._get_auth_store_path() to return that path. The mtime/size + sleep+restat dance lives at the call sites (the tests that actually + need to prove the OLD stat-based fingerprint WOULD have churned); + this helper itself only does the write + monkeypatch. """ auth_path = tmp_path / "auth.json" auth_path.write_text(json.dumps(store, indent=2), encoding="utf-8")