Security advisory 2 addressed

backend/tests/test_api.py

@@ -39,7 +39,7 @@ def test_login_returns_token():
     assert 'access_token' in payload
     assert payload['token_type'] == 'bearer'
 
-    admin_session = client.get('/api/auth/me', params={'token': payload['access_token']})
+    admin_session = client.get('/api/auth/me', headers={'Authorization': f"Bearer {payload['access_token']}"})
     assert admin_session.status_code == 200
     assert admin_session.json()['is_admin'] is True
 
@@ -47,9 +47,10 @@ def test_login_returns_token():
            'email': 'bob@example.com',
         'password': 'secret123',
     }).json()['access_token']
-    user_session = client.get('/api/auth/me', params={'token': user_token})
+    user_session = client.get('/api/auth/me', headers={'Authorization': f"Bearer {user_token}"})
     assert user_session.status_code == 200
     assert user_session.json()['is_admin'] is False
+    assert client.get('/api/auth/me', params={'token': payload['access_token']}).status_code == 401
 
 
 def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():

backend/tests/test_database.py

@@ -10,7 +10,7 @@ def test_database_migrations_are_versioned_and_idempotent():
     connection = sqlite3.connect(':memory:')
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 13
+    assert get_schema_version(connection) == 14
     tables = {
         row[0]
         for row in connection.execute(
@@ -27,6 +27,6 @@ def test_database_migrations_are_versioned_and_idempotent():
     assert set(DEFAULT_TAGS) <= seeded_tags
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 13
+    assert get_schema_version(connection) == 14
 
     connection.close()