Merge branch 'vineeth/dev-656' of github.com:plastic-labs/honcho into vineeth/dev-656

src/crud.py

@@ -931,8 +931,7 @@ async def get_metamessage(
         stmt = stmt.where(models.Metamessage.message_id == message_id)
 
     result = await db.execute(stmt)
-    metamessage = result.scalar_one_or_none()
-    return metamessage
+    return result.scalar_one_or_none()
 
 
 async def update_metamessage(

src/routers/apps.py

@@ -17,8 +17,6 @@ router = APIRouter(
     tags=["apps"],
 )
 
-# jwt_params = Depends(require_auth(app_id="app_id"))
-
 
 @router.get("", response_model=schemas.App)
 async def get_app(

tests/routes/test_scoped_api.py

@@ -347,8 +347,8 @@ def test_get_session_by_id_with_auth(auth_client, sample_data):
     )
     assert response.status_code == 200
 
-    # Test with session-scoped JWT
     if auth_client.auth_type == "empty":
+        # Test with session-scoped JWT
         auth_client.headers["Authorization"] = (
             f"Bearer {create_jwt(JWTParams(se=session_id))}"
         )
@@ -358,13 +358,66 @@ def test_get_session_by_id_with_auth(auth_client, sample_data):
         )
         assert response.status_code == 200
 
-        response2 = auth_client.get(
+        response = auth_client.get(
             f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions"
         )
 
-        assert response2.status_code == 200
+        assert response.status_code == 200
 
-        assert response2.json()["id"] == session_id
+        assert response.json()["id"] == session_id
+
+        # Test with wrong session_id (should be 401 since we have a session-scoped JWT)
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions?session_id={generate_nanoid()}"
+            ).status_code
+            == 401
+        )
+
+        # Test with user-scoped JWT
+        auth_client.headers["Authorization"] = (
+            f"Bearer {create_jwt(JWTParams(us=test_user.public_id))}"
+        )
+
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions?session_id={session_id}"
+            ).status_code
+            == 200
+        )
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions"
+            ).status_code
+            == 401
+        )
+
+        # Test with app-scoped JWT
+        auth_client.headers["Authorization"] = (
+            f"Bearer {create_jwt(JWTParams(ap=test_app.public_id))}"
+        )
+
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions?session_id={session_id}"
+            ).status_code
+            == 200
+        )
+
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions"
+            ).status_code
+            == 401
+        )
+
+        # Test with wrong session_id (should be 404 since we have an app-scoped JWT)
+        assert (
+            auth_client.get(
+                f"/v1/apps/{test_app.public_id}/users/{test_user.public_id}/sessions?session_id={generate_nanoid()}"
+            ).status_code
+            == 404
+        )
 
 
 def test_create_collection(auth_client, sample_data) -> None: