From 9f7261b9c07bcfc339d8b084def4166865f0f67c Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Tue, 2 Jun 2026 17:55:25 -0400
Subject: [PATCH] fix(audit-g5c): set CURATOR_BOOTSTRAP_NEW_KEY=1 in conftest

CredentialCrypto's safety check fires on create_app() instantiation
because the test environment has no pre-seeded Fernet key file. Set
the bootstrap env var before any test imports so the auto-create path
is allowed during tests.
---
 tests/conftest.py | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/tests/conftest.py b/tests/conftest.py
index 0afacb0..da8bb9d 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -8,18 +8,25 @@ migration code paths.
 
 import os
 
-import pytest
-import pytest_asyncio
-from sqlalchemy import create_engine
-from sqlalchemy.ext.asyncio import (
+# Audit 2026-06-02: CredentialCrypto now refuses to auto-generate a
+# Fernet key without explicit opt-in (production safety against silent
+# key regeneration on partial restore). The test environment never has
+# a pre-seeded key file, so set the bootstrap flag here before any
+# create_app() / CredentialCrypto() import path fires.
+os.environ.setdefault("CURATOR_BOOTSTRAP_NEW_KEY", "1")
+
+import pytest  # noqa: E402
+import pytest_asyncio  # noqa: E402
+from sqlalchemy import create_engine  # noqa: E402
+from sqlalchemy.ext.asyncio import (  # noqa: E402
     AsyncSession,
     async_sessionmaker,
     create_async_engine,
 )
-from sqlalchemy.orm import sessionmaker
+from sqlalchemy.orm import sessionmaker  # noqa: E402
 
-from backend.app import create_app
-from backend.app.models import Base
+from backend.app import create_app  # noqa: E402
+from backend.app.models import Base  # noqa: E402
 
 
 def _async_database_url() -> str: