From 8fc71e4a6140663109a3b5c9c87625d5b9581e6b Mon Sep 17 00:00:00 2001 From: Mike Date: Sun, 4 Oct 2026 16:01:38 +0000 Subject: [PATCH] test(vault): fix the default JWT exp once so equal tokens compare equal jwt() took exp from time.time() on every call, so a test comparing a stored credential with an expected one built a moment later failed whenever a clock second ticked between the two calls. It flaked CI on PR #523 (TestProjectPicker::test_select_fills_the_existing_credential). Forcing a one-second tick between two calls: old helper -> tokens differ, new -> identical. Co-Authored-By: Claude Opus 5.5 --- tests/test_vault_connectors.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/test_vault_connectors.py b/tests/test_vault_connectors.py index b098c461..a08bdec5 100644 --- a/tests/test_vault_connectors.py +++ b/tests/test_vault_connectors.py @@ -38,9 +38,15 @@ def _b64(d: dict) -> str: return base64.urlsafe_b64encode(json.dumps(d).encode()).decode().rstrip('=') +# Fixed ONCE at import. Two jwt() calls for the same ref/role must give the SAME token: tests compare +# a stored credential against an expected one built later, and an exp taken from time.time() per call +# made them differ whenever a clock second ticked between the two calls (flaked CI on PR #523). +_DEFAULT_EXP = int(time.time()) + 10 * 365 * 86400 + + def jwt(ref: str, role: str, exp: int = None) -> str: claims = {'iss': 'supabase', 'ref': ref, 'role': role, 'iat': 1700000000, - 'exp': exp if exp is not None else int(time.time()) + 10 * 365 * 86400} + 'exp': exp if exp is not None else _DEFAULT_EXP} return f"{_b64({'alg': 'HS256', 'typ': 'JWT'})}.{_b64(claims)}.c2lnbmF0dXJl"