Session keys hardened (namespaced hashes of tokens). Various cleanup.

tests/test_api.py

@@ -17,9 +17,9 @@ import httpx
 import pytest
 
 from paskia.authsession import EXPIRES
-from paskia.db import create_session, delete_session
+from paskia.db import delete_session
 from paskia.util.passphrase import generate
-from tests.conftest import auth_headers
+from tests.conftest import auth_headers, create_test_session
 
 
 class TestSettingsEndpoint:
@@ -522,7 +522,7 @@ class TestValidateSessionRefresh:
         """Validate should return 401 if session disappears during refresh."""
 
         # Create a session with a short remaining duration to trigger refresh
-        token = create_session(
+        db_key, secret = create_test_session(
             user_uuid=test_user.uuid,
             credential_uuid=test_credential.uuid,
             host="localhost",
@@ -532,11 +532,11 @@ class TestValidateSessionRefresh:
         )
 
         # Delete the session right before validate tries to refresh
-        delete_session(token)
+        delete_session(db_key)
 
         response = await client.post(
             "/auth/api/validate",
-            headers={**auth_headers(token), "Host": "localhost:4401"},
+            headers={**auth_headers(secret), "Host": "localhost:4401"},
         )
         # Session was found initially but disappeared during refresh
         assert response.status_code == 401