Merge pull request 'Fix CAR-1132: SQLite UUID binding and User.id defaults in test fixtures' (#42) from betty/car-1132-comprehensive-fix into dev

src/cartsnitch_api/auth/dependencies.py

@@ -43,6 +43,11 @@ async def _validate_session_token(token: str, db: AsyncSession) -> str:
         )
 
     user_id, expires_at = row
+    # SQLite stores TIMESTAMP as TEXT and returns it as a string via raw
+    # SQL — normalise to a tz-aware datetime here so the comparison below
+    # works regardless of driver.
+    if isinstance(expires_at, str):
+        expires_at = datetime.fromisoformat(expires_at)
     if expires_at.tzinfo is None:
         # Treat naive datetimes as UTC
         expires_at = expires_at.replace(tzinfo=UTC)

src/cartsnitch_api/middleware/rate_limit.py

@@ -108,6 +108,9 @@ class RedisSlidingWindow:
 
 _redis_client: Redis | None = None
 _use_redis = False
+_public_limiter: RateLimitBackend
+_auth_limiter: RateLimitBackend
+_auth_strict_limiter: RateLimitBackend
 
 if settings.rate_limit_redis_enabled:
     try:

src/cartsnitch_api/schemas.py

@@ -16,7 +16,7 @@ class UpdateUserRequest(BaseModel):
 
 
 class UserResponse(BaseModel):
-    id: str
+    id: UUID
     email: str
     display_name: str
     created_at: datetime