From 627912fae50c4d6256ded315f407535cb378c3ec Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Tue, 17 Feb 2026 01:35:11 +0000
Subject: [PATCH] Fix tests for earlier changes.

---
 paskia/db/operations.py |  5 ++++-
 paskia/fastapi/admin.py |  6 +++++-
 paskia/util/oidjwt.py   |  4 +++-
 tests/test_api.py       | 20 ++++++++++++++------
 4 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/paskia/db/operations.py b/paskia/db/operations.py
index 8ae8cf9..d1fdabd 100644
--- a/paskia/db/operations.py
+++ b/paskia/db/operations.py
@@ -642,7 +642,10 @@ def update_oid_client(
         changes["redirect_uris"] = redirect_uris
     if secret_hash is not None and secret_hash != client.client_secret_hash:
         changes["client_secret_hash"] = secret_hash
-    if backchannel_logout_uri is not _UNSET and backchannel_logout_uri != client.backchannel_logout_uri:
+    if (
+        backchannel_logout_uri is not _UNSET
+        and backchannel_logout_uri != client.backchannel_logout_uri
+    ):
         changes["backchannel_logout_uri"] = backchannel_logout_uri
 
     if not changes:
diff --git a/paskia/fastapi/admin.py b/paskia/fastapi/admin.py
index f24db23..4e75c19 100644
--- a/paskia/fastapi/admin.py
+++ b/paskia/fastapi/admin.py
@@ -1090,7 +1090,11 @@ async def admin_update_oidc_client(
             if not isinstance(uri, str) or not uri.startswith("http"):
                 raise ValueError(f"Invalid redirect URI: {uri}")
 
-    if backchannel_logout_uri is not _UNSET and backchannel_logout_uri and not backchannel_logout_uri.startswith("http"):
+    if (
+        backchannel_logout_uri is not _UNSET
+        and backchannel_logout_uri
+        and not backchannel_logout_uri.startswith("http")
+    ):
         raise ValueError("backchannel_logout_uri must be an HTTP(S) URL")
 
     secret_hash = None
diff --git a/paskia/util/oidjwt.py b/paskia/util/oidjwt.py
index 7d0bbc1..a696392 100644
--- a/paskia/util/oidjwt.py
+++ b/paskia/util/oidjwt.py
@@ -231,7 +231,9 @@ def create_logout_token(
         "iat": int(now.timestamp()),
         "exp": int((now + timedelta(seconds=120)).timestamp()),
         "events": {"http://schemas.openid.net/event/backchannel-logout": {}},
-        "jti": hashlib.sha256(f"{now.timestamp()}{audience}{sid}{sub}".encode()).hexdigest()[:16],
+        "jti": hashlib.sha256(
+            f"{now.timestamp()}{audience}{sid}{sub}".encode()
+        ).hexdigest()[:16],
     }
     if sid:
         payload["sid"] = sid
diff --git a/tests/test_api.py b/tests/test_api.py
index 68574d3..ae13926 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -11,7 +11,7 @@ These tests cover:
 """
 
 import secrets
-from datetime import timedelta
+from datetime import UTC, datetime, timedelta
 
 import httpx
 import pytest
@@ -299,22 +299,30 @@ class TestSetSessionEndpoint:
     """Tests for POST /auth/api/set-session"""
 
     @pytest.mark.asyncio
-    async def test_set_session_without_bearer_returns_401(
+    async def test_set_session_without_bearer_returns_400(
         self, client: httpx.AsyncClient
     ):
-        """Set session without bearer token should return 401."""
+        """Set session without bearer token should return 400."""
         response = await client.post("/auth/api/set-session")
-        assert response.status_code == 401
+        assert response.status_code == 400
 
     @pytest.mark.asyncio
     async def test_set_session_with_valid_bearer_token(
         self, client: httpx.AsyncClient, session_token: str
     ):
-        """Set session with valid bearer token should set cookie."""
+        """Set session with valid auth code as bearer should set cookie."""
+        from paskia import authcode
+
+        code = authcode.store_cookie(
+            authcode.CookieCode(
+                session_key=session_token,
+                created=datetime.now(UTC),
+            )
+        )
         response = await client.post(
             "/auth/api/set-session",
             headers={
-                "Authorization": f"Bearer {session_token}",
+                "Authorization": f"Bearer {code}",
                 "Host": "localhost:4401",
             },
         )