Faster and simplified hash_secret() that directly produces urlsafe entries.

tests/conftest.py

@@ -19,7 +19,6 @@ from collections.abc import AsyncGenerator
 from datetime import UTC, datetime, timedelta
 from uuid import UUID
 
-import base64url
 import httpx
 import pytest
 import pytest_asyncio
@@ -268,7 +267,7 @@ def create_test_session(
 
     # Generate token and derive key
     token = secrets.token_urlsafe(12)
-    key = base64url.enc(hash_secret("cookie", token))
+    key = hash_secret("cookie", token)
 
     session = Session.create(
         user=user_uuid,

tests/test_admin.py

@@ -16,7 +16,6 @@ import secrets
 from datetime import UTC, datetime
 from uuid import UUID
 
-import base64url
 import httpx
 import pytest
 import pytest_asyncio
@@ -1301,7 +1300,7 @@ class TestAdminSessions:
         test_user,
     ):
         """Admin can delete their own current session."""
-        session_db_key = base64url.enc(hash_secret("cookie", session_token))
+        session_db_key = hash_secret("cookie", session_token)
         response = await client.delete(
             f"/auth/api/admin/users/{test_user.uuid}/sessions/{session_db_key}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},