Fix tests for earlier changes.

tests/test_api.py

@@ -11,7 +11,7 @@ These tests cover:
 """
 
 import secrets
-from datetime import timedelta
+from datetime import UTC, datetime, timedelta
 
 import httpx
 import pytest
@@ -299,22 +299,30 @@ class TestSetSessionEndpoint:
     """Tests for POST /auth/api/set-session"""
 
     @pytest.mark.asyncio
-    async def test_set_session_without_bearer_returns_401(
+    async def test_set_session_without_bearer_returns_400(
         self, client: httpx.AsyncClient
     ):
-        """Set session without bearer token should return 401."""
+        """Set session without bearer token should return 400."""
         response = await client.post("/auth/api/set-session")
-        assert response.status_code == 401
+        assert response.status_code == 400
 
     @pytest.mark.asyncio
     async def test_set_session_with_valid_bearer_token(
         self, client: httpx.AsyncClient, session_token: str
     ):
-        """Set session with valid bearer token should set cookie."""
+        """Set session with valid auth code as bearer should set cookie."""
+        from paskia import authcode
+
+        code = authcode.store_cookie(
+            authcode.CookieCode(
+                session_key=session_token,
+                created=datetime.now(UTC),
+            )
+        )
         response = await client.post(
             "/auth/api/set-session",
             headers={
-                "Authorization": f"Bearer {session_token}",
+                "Authorization": f"Bearer {code}",
                 "Host": "localhost:4401",
             },
         )