autonomic-bot
972f5ec4ad
Some checks failed
continuous-integration/drone/push Build is failing
test_create_room_get_livekit_token_and_read_back authenticated with a raw OIDC user access token as 'Authorization: Bearer'; meet v1.22.0 hardened API auth to reject user access tokens (release notes: 'reject user access tokens on the API'), so the test went RED with 401 on the v1.24.0 upgrade (drone build #1137; same at v1.23.0 in build #1122). Updated to the successor auth path: recipe-local _oidc_session.py (same helper as tests/lasuite-docs) drives the real OIDC authorization-code flow (app -> keycloak login form -> callback -> Django session cookie, CSRF on unsafe methods). - NEW assertion: a raw OIDC Bearer token is REJECTED (401/403) - the v1.22.0 hardening asserted as the new correct behavior. - The full meeting flow (create 201 + LiveKit JWT grant, read-back, DELETE) is unchanged, now over the session-authenticated API. No assertion weakened. Stale-test fix for recipe PR recipe-maintainers/lasuite-meet#8 (carry-over from /upgrade-all 2026-07-24).