Закрыли часть проблем с безопасностью + мелкие починки

codebase/backend/api-backend/tests/contract/test_openapi.py

@@ -1,14 +1,22 @@
+import asyncio
 import base64
 import json
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
 import yaml
 from alembic.config import Config
 from alembic.script import ScriptDirectory
 from pydantic import SecretStr
 
-from app.main import EXPECTED_API_DB_REVISION, app, otp_settings, websocket_token
+from app.main import (
+    EXPECTED_API_DB_REVISION,
+    app,
+    otp_settings,
+    refresh_jwks_cache,
+    websocket_token,
+)
 from app.services import SettingsSnapshot
 
 EXPECTED_PATHS = {
@@ -65,6 +73,39 @@ def test_readiness_expected_revision_matches_alembic_head() -> None:
     assert EXPECTED_API_DB_REVISION == scripts.get_current_head()
 
 
+@pytest.mark.asyncio
+async def test_jwks_refresh_loop_recovers_after_startup_race(monkeypatch) -> None:
+    class FakeJWKS:
+        has_keys = False
+        refresh_calls = 0
+
+        async def refresh(self) -> None:
+            self.refresh_calls += 1
+            self.has_keys = True
+
+    jwks = FakeJWKS()
+    test_app = SimpleNamespace(
+        state=SimpleNamespace(
+            jwks=jwks,
+            settings=SimpleNamespace(jwks_cache_ttl_seconds=300),
+        )
+    )
+    delays: list[int] = []
+
+    async def fake_sleep(delay: int) -> None:
+        delays.append(delay)
+        if len(delays) > 1:
+            raise asyncio.CancelledError
+
+    monkeypatch.setattr("app.main.asyncio.sleep", fake_sleep)
+
+    with pytest.raises(asyncio.CancelledError):
+        await refresh_jwks_cache(test_app)
+
+    assert jwks.refresh_calls == 1
+    assert delays == [5, 300]
+
+
 def test_websocket_route_is_registered() -> None:
     assert any(getattr(route, "path", None) == "/api/v1/realtime" for route in app.routes)