Cody Schaefer
b97ccd7ad8
Caught the moment a real LDAP_REQUIRED_GROUP landed in .env: ldap_auth_check's "a just-provisioned account appears in the Admin console list" started failing, consistently, with no code change that could explain it. start() removed LDAP_REQUIRED_GROUP from the subprocess environment so the test could run without a group gate. But the server imports server/db.py, which calls load_dotenv(), and python-dotenv skips only keys ALREADY PRESENT in os.environ - so a popped variable is helpfully restored from the developer's .env inside the child process. The test was quietly running against the real required group, the fake "outsider" account was refused by it, and the account under test was never provisioned. Setting the variable to an empty string fixes it: empty still counts as present, so load_dotenv leaves it alone. Fixed in both harnesses - ldap_auth_check and browser_check, the latter shared by 39 files - and corrected the fix suggested in BL-028, which said to pop MICRON_DB_URL and would therefore not have worked either. Worth stating as a rule: in this repo a test cannot assume an environment variable is ABSENT. .env re-supplies it in any subprocess. Force the value you want; never remove it. ldap_auth_check 32/32, browser_check re-run green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>