Merge branch 'fix/sec-33-34'

2026-08-07 06:51:31 -04:00
parent d2bb32d97b 193daa9ee8
commit 2aac29618e
17 changed files with 576 additions and 120 deletions
@@ -80,7 +80,8 @@ public sealed class GatewayApplicationTests
    public async Task Build_MapsMetricsEndpoint()
    {
        // Bind an ephemeral port (:0) — xUnit runs test collections in parallel, so any
-        // started-host test must avoid a fixed port to prevent a bind collision.
+        // started-host test must avoid a fixed port to prevent a bind collision. The auth SQLite
+        // store path is isolated to a per-process temp file by TestHostEnvironmentInitializer (SEC-33).
        await using WebApplication app = GatewayApplication.Build(["--urls=http://127.0.0.1:0"]);
        await app.StartAsync();
        try
@@ -258,7 +259,9 @@ public sealed class GatewayApplicationTests
        string expectedFailure)
    {
        // Bind an ephemeral port (:0) — xUnit runs test collections in parallel, so any
-        // WebApplication-building test must avoid a fixed port to prevent a bind collision.
+        // WebApplication-building test must avoid a fixed port to prevent a bind collision. The auth
+        // store path is isolated by TestHostEnvironmentInitializer (SEC-33), so startup opens a
+        // writable store and the injected misconfiguration is what fails validation.
        await using WebApplication app = GatewayApplication.Build(
            [$"--{key}={value}", "--urls=http://127.0.0.1:0"]);