dashboards/tests/auth_contract.py

"""The admin credential the HTTP suite boots with, and the cost it hashes it at.

Phase 11 made every app start need a password: with no `auth.verifier` row and no
`DASH_ADMIN_PASSWORD` the lifespan raises instead of serving the fleet (see
`auth.load_auth_state`). So every test that runs a lifespan passes one, the same way the
operator's `.env.dev` does, and `testpass` is the phase's local-testing password — never a
production fallback.

The cost is the other half. The real 600 000 rounds cost ~0.3 s per hash, and the HTTP suite
starts a server a hundred-odd times; hashing at 1 000 rounds is the documented purpose of
`DASH_PBKDF2_ITERATIONS` and keeps that overhead at microseconds. The real figure is pinned
where it belongs — `tests/test_auth.py::test_the_default_cost_is_the_owasp_figure` and
`tests/test_config.py::test_the_auth_defaults_are_a_locked_door_and_a_long_session` — so
lowering it here cannot lower it there.

Deliberately not a fixture: `Settings(...)` is built inside helper functions and module-level
setup as well as inside tests, and a constant imports everywhere without dragging a request
scope along.
"""

from __future__ import annotations

#: The password every test app is seeded with (and, from task 03 on, signs in with).
ADMIN_PASSWORD = "testpass"

#: PBKDF2 rounds for the suite. See the module docstring; do not use this in a deployment.
FAST_PBKDF2 = 1_000


def auth_settings() -> dict[str, object]:
    """The `Settings` kwargs a test app needs in order to boot at all.

    A server with neither a stored verifier nor an `admin_password` **refuses to start**
    (task 02, invariant 11), and every `create_app()` in the suite runs a lifespan. Spreading
    this into the `Settings(...)` calls keeps that a one-line change in this file instead of an
    edit in every fixture that builds its own settings object.
    """
    return {"admin_password": ADMIN_PASSWORD, "pbkdf2_iterations": FAST_PBKDF2}