Session keys hardened (namespaced hashes of tokens). Various cleanup.

tests/test_admin.py

@@ -16,6 +16,7 @@ import secrets
 from datetime import UTC, datetime
 from uuid import UUID
 
+import base64url
 import httpx
 import pytest
 import pytest_asyncio
@@ -33,11 +34,11 @@ from paskia.db import (
     create_org,
     create_permission,
     create_role,
-    create_session,
     create_user,
 )
 from paskia.db.operations import DB
-from tests.conftest import auth_headers
+from paskia.util.crypto import hash_secret
+from tests.conftest import auth_headers, create_test_session
 
 # -------------------- Additional Fixtures --------------------
 
@@ -97,13 +98,11 @@ async def second_org_session_token(
     test_db: DB, second_org_user: User, second_org_credential: Credential
 ) -> str:
     """Create a session for the second org admin user."""
-    return create_session(
+    _db_key, secret = create_test_session(
         user_uuid=second_org_user.uuid,
         credential_uuid=second_org_credential.uuid,
-        host="localhost",
-        ip="127.0.0.1",
-        user_agent="pytest",
     )
+    return secret
 
 
 @pytest_asyncio.fixture(scope="function")
@@ -153,13 +152,11 @@ async def org_admin_session_token(
     test_db: DB, org_admin_user: User, org_admin_credential: Credential
 ) -> str:
     """Create a session for the org admin user."""
-    return create_session(
+    _db_key, secret = create_test_session(
         user_uuid=org_admin_user.uuid,
         credential_uuid=org_admin_credential.uuid,
-        host="localhost",
-        ip="127.0.0.1",
-        user_agent="pytest",
     )
+    return secret
 
 
 @pytest_asyncio.fixture(scope="function")
@@ -1290,7 +1287,7 @@ class TestAdminSessions:
     ):
         """Admin should be able to delete a user's session."""
         # Create an additional session to delete
-        extra_token = create_session(
+        extra_db_key, _extra_secret = create_test_session(
             user_uuid=test_user.uuid,
             credential_uuid=test_credential.uuid,
             host="other.host:4401",
@@ -1299,7 +1296,7 @@ class TestAdminSessions:
         )
 
         response = await client.delete(
-            f"/auth/api/admin/users/{test_user.uuid}/sessions/{extra_token}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{base64url.enc(extra_db_key)}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1316,8 +1313,9 @@ class TestAdminSessions:
         test_user,
     ):
         """Admin can delete their own current session."""
+        session_db_key = base64url.enc(hash_secret("cookie", session_token))
         response = await client.delete(
-            f"/auth/api/admin/users/{test_user.uuid}/sessions/{session_token}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{session_db_key}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1362,9 +1360,9 @@ class TestAdminSessions:
             f"/auth/api/admin/users/{test_user.uuid}/sessions/invalid!!id",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 400
         data = response.json()
-        assert "Session not found" in data["detail"]
+        assert "Invalid session ID format" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_delete_session_not_found(