Move imports to top of file.

tests/conftest.py

@@ -19,8 +19,9 @@ import httpx
 import pytest
 import pytest_asyncio
 
+import paskia.db.operations as ops_db
 from paskia import globals as paskia_globals
-from paskia.authsession import expires
+from paskia.authsession import expires, reset_expires
 from paskia.db import (
     Credential,
     Org,
@@ -36,9 +37,12 @@ from paskia.db import (
     create_session,
     create_user,
 )
+from paskia.db.jsonl import JsonlStore
 from paskia.db.operations import DB, _create_token
+from paskia.fastapi.mainapp import app
 from paskia.fastapi.session import AUTH_COOKIE_NAME
 from paskia.sansio import Passkey
+from paskia.util.passphrase import generate
 
 
 @pytest.fixture(scope="session")
@@ -52,8 +56,6 @@ def event_loop():
 @pytest_asyncio.fixture(scope="function")
 async def test_db() -> AsyncGenerator[DB, None]:
     """Create an in-memory JSON database for testing."""
-    import paskia.db.operations as ops_db
-    from paskia.db.jsonl import JsonlStore
 
     with tempfile.NamedTemporaryFile(suffix=".jsonl", delete=True) as f:
         db = DB()
@@ -225,8 +227,6 @@ async def regular_session_token(
 @pytest_asyncio.fixture(scope="function")
 async def reset_token(test_db: DB, test_user: User, test_credential: Credential) -> str:
     """Create a reset token for the test user."""
-    from paskia.authsession import reset_expires
-    from paskia.util.passphrase import generate
 
     token = generate()
     create_reset_token(
@@ -248,7 +248,6 @@ async def client(
     initialized first.
     """
     # Import app after globals are set
-    from paskia.fastapi.mainapp import app
 
     transport = httpx.ASGITransport(app=app)
     async with httpx.AsyncClient(

tests/test_admin.py

@@ -11,6 +11,7 @@ These tests cover:
 - Credential management
 """
 
+import os
 from datetime import datetime, timezone
 from uuid import UUID
 
@@ -19,6 +20,7 @@ import pytest
 import pytest_asyncio
 import uuid7
 
+from paskia import db
 from paskia.authsession import expires
 from paskia.db import (
     Credential,
@@ -78,7 +80,6 @@ async def second_org_user(test_db: DB, second_org_role: Role) -> User:
 @pytest_asyncio.fixture(scope="function")
 async def second_org_credential(test_db: DB, second_org_user: User) -> Credential:
     """Create a credential for the second org user."""
-    import os
 
     credential = Credential.create(
         credential_id=os.urandom(32),
@@ -139,7 +140,6 @@ async def org_admin_user(test_db: DB, org_admin_role: Role) -> User:
 @pytest_asyncio.fixture(scope="function")
 async def org_admin_credential(test_db: DB, org_admin_user: User) -> Credential:
     """Create a credential for the org admin user."""
-    import os
 
     credential = Credential.create(
         credential_id=os.urandom(32),
@@ -1423,7 +1423,6 @@ class TestAdminPermissions:
     ):
         """Cannot rename the auth:admin permission."""
         # Get the auth:admin permission
-        from paskia import db
 
         perms = list(db.data().permissions.values())
         admin_perm = next(p for p in perms if p.scope == "auth:admin")
@@ -1478,7 +1477,6 @@ class TestAdminPermissions:
     ):
         """Cannot delete the only auth:admin permission (would lock out admin)."""
         # Get the auth:admin permission
-        from paskia import db
 
         perms = list(db.data().permissions.values())
         admin_perm = next(p for p in perms if p.scope == "auth:admin")
@@ -1496,14 +1494,12 @@ class TestAdminPermissions:
         self, client: httpx.AsyncClient, session_token: str, test_db: DB
     ):
         """Can delete an auth:admin permission if another accessible one exists."""
-        from paskia.db import Permission
 
         # Create a second auth:admin permission (no domain restriction)
         perm2 = Permission.create(scope="auth:admin", display_name="Secondary Admin")
         create_permission(perm2)
 
         # Get the original auth:admin permission (the one created in setup)
-        from paskia import db
 
         perms = list(db.data().permissions.values())
         admin_perms = [p for p in perms if p.scope == "auth:admin"]
@@ -1524,7 +1520,6 @@ class TestAdminPermissions:
         self, client: httpx.AsyncClient, session_token: str, test_db: DB
     ):
         """Cannot delete auth:admin if remaining one has mismatched domain."""
-        from paskia.db import Permission
 
         # Create a second auth:admin permission with a different domain
         perm2 = Permission.create(
@@ -1536,7 +1531,6 @@ class TestAdminPermissions:
 
         # Cannot delete the original one because the remaining one is not accessible
         # Get the original auth:admin permission
-        from paskia import db
 
         perms = list(db.data().permissions.values())
         admin_perms = [p for p in perms if p.scope == "auth:admin" and p.domain is None]

tests/test_api.py

@@ -10,12 +10,15 @@ These tests cover:
 - /auth/api/set-session - Set session from bearer token
 """
 
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
 import httpx
 import pytest
 
+from paskia.authsession import EXPIRES
 from paskia.db import create_session, delete_session
+from paskia.db.operations import _create_token
+from paskia.util.passphrase import generate
 from tests.conftest import auth_headers
 
 
@@ -410,7 +413,6 @@ class TestTokenInfoEndpoint:
     @pytest.mark.asyncio
     async def test_token_info_with_nonexistent_token(self, client: httpx.AsyncClient):
         """Token info with well-formed but non-existent token should return 401."""
-        from paskia.util.passphrase import generate
 
         fake_token = generate()
         response = await client.get(
@@ -499,7 +501,6 @@ class TestValidateSessionRefresh:
         self, client: httpx.AsyncClient, test_db
     ):
         """Validate should handle session expiry during refresh attempt."""
-        from paskia.db.operations import _create_token
 
         # Create a token but don't create a session for it
         token = _create_token()
@@ -519,10 +520,6 @@ class TestValidateSessionRefresh:
         test_credential,
     ):
         """Validate should return 401 if session disappears during refresh."""
-        from datetime import timedelta
-
-        from paskia.authsession import EXPIRES
-        from paskia.db.operations import _create_token
 
         # Create a session with an old expiry time to trigger refresh
         token = _create_token()