Identify sessions by session key - a hash that can be safely shared.

tests/conftest.py

@@ -19,6 +19,7 @@ from collections.abc import AsyncGenerator
 from datetime import UTC, datetime, timedelta
 from uuid import UUID
 
+import base64url
 import httpx
 import pytest
 import pytest_asyncio
@@ -251,10 +252,10 @@ def create_test_session(
     ip: str = "127.0.0.1",
     user_agent: str = "pytest",
     duration: timedelta | None = None,
-) -> tuple[bytes, str]:
+) -> tuple[str, str]:
     """Create a test session. Returns (key, token) tuple.
 
-    - key: bytes used for session lookup (base64url encode for URLs)
+    - key: str used for session lookup (base64url encoded)
     - token: stored in cookie/sent to client
     """
     if duration is None:
@@ -267,7 +268,7 @@ def create_test_session(
 
     # Generate token and derive key
     token = secrets.token_urlsafe(12)
-    key = hash_secret("cookie", token)
+    key = base64url.enc(hash_secret("cookie", token))
 
     session = Session.create(
         user=user_uuid,

tests/test_admin.py

@@ -1300,7 +1300,7 @@ class TestAdminSessions:
         )
 
         response = await client.delete(
-            f"/auth/api/admin/users/{test_user.uuid}/sessions/{base64url.enc(extra_db_key)}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{extra_db_key}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1364,9 +1364,9 @@ class TestAdminSessions:
             f"/auth/api/admin/users/{test_user.uuid}/sessions/invalid!!id",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 400
+        assert response.status_code == 404
         data = response.json()
-        assert "Invalid session ID format" in data["detail"]
+        assert "Session not found" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_delete_session_not_found(