fix(ci): annotate test CSRF disables for SonarCloud S4502

[cursor]

Summary

SonarCloud failed on main after commit b15de15 because new pytest coverage set WTF_CSRF_ENABLED = False without # NOSONAR annotations. SonarCloud rule python:S4502 treats those as new security vulnerabilities and fails the new_security_rating quality gate.

Changes

• Add # NOSONAR - test client posts without CSRF tokens to CSRF disables introduced in b15de15 (tests/test_app.py, tests/test_login_routes.py).
• Matches the pattern already used in PR fix(ci): make multiprocessing rate-limit test picklable on Python 3.14 #46 for the multiprocessing rate-limit test.

Verification

• python3 -m pytest -m "not integration" — 81 passed locally.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
16.7% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Annotate test-only CSRF disables to satisfy SonarCloud S4502

🐞 Bug fix 🧪 Tests 🕐 Less than 5 minutes

AI Description

• Add NOSONAR annotations to test-only CSRF disables flagged by SonarCloud S4502.
• Prevent SonarCloud quality gate failures on new_security_rating for recent pytest additions.

Diagram

graph TD
  Dev["Test config disables CSRF"] --> Pytest["pytest run"] --> Sonar{{"SonarCloud"}} --> Gate{"Quality gate (S4502)"} --> Merge["Main green"]
  Gate --> Block["CI fails"]
  subgraph Legend
    direction LR
    _p["Process"] ~~~ _e{{"External"}} ~~~ _d{"Decision"}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep CSRF enabled and post with valid CSRF tokens in tests

• ➕ Avoids suppressing a security rule
• ➕ Exercises realistic request/CSRF behavior
• ➖ More test setup complexity (token extraction, session handling)
• ➖ May add boilerplate across many tests

2. Centralize the CSRF disable + suppression in a shared fixture

• ➕ Removes repeated per-test config lines/comments
• ➕ Makes intent explicit and consistent across the suite
• ➖ Requires refactoring test setup patterns
• ➖ Fixture scope mistakes could unintentionally affect tests that should keep CSRF on

Recommendation: The current approach (inline NOSONAR with an explicit test-only rationale) is a pragmatic CI unblocking fix with minimal behavioral risk. If CSRF disables continue to spread, consider a shared fixture to reduce repetition and keep the suppression localized.

Files changed (2) +6 / -6

Tests (2) +6 / -6

test_app.pyAdd NOSONAR rationale to test-only CSRF disables +5/-5

Add NOSONAR rationale to test-only CSRF disables

• Annotates multiple instances of 'application.config["WTF_CSRF_ENABLED"] = False' with a NOSONAR comment explaining test client form posts without tokens. This prevents SonarCloud python:S4502 from being counted as new security issues.

tests/test_app.py

test_login_routes.pySuppress SonarCloud S4502 for CSRF disable in login route test +1/-1

Suppress SonarCloud S4502 for CSRF disable in login route test

• Adds a NOSONAR comment to the test configuration disabling CSRF. This keeps SonarCloud from failing the quality gate on a test-only security rule violation.

tests/test_login_routes.py

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review