Reported as a flake: four live tests passed and one failed Unauthorized,
while other tests doing the same call succeeded. It is not a flake and
not the server being slow.
Jellyfin keys the SESSION on DeviceId, and a second AuthenticateByName
under the same DeviceId REPLACES the first — the earlier token starts
answering 401. Measured directly against 10.11.11 rather than inferred:
same DeviceId: auth -> T1, auth -> T2; T1 = 401, T2 = 200
different DeviceId: auth -> A, auth -> B; A = 200, B = 200
Five tests authenticating in parallel under one DeviceId were therefore
invalidating each other, and whichever finished first was left holding a
dead token. Running with --test-threads=1 hid it, which is why the first
run looked green.
The tests now share one lazily-initialised session, which is also what
the app must do. Two production obligations follow and are now written
on `auth_header` where somebody will read them: the DeviceId must be
stable PER INSTALL (persisted like local_plex::client_id — a constant
would make two QBZ installs log each other out, a fresh id per launch
drops the previous run's token and litters the server's devices page),
and the app must authenticate once and hold the token rather than
concurrently.
Verified in the parallel configuration the report used: 10 unit + 5 live,
three consecutive runs, 5/5 each time.
cc
vicrodh
910f7aec4d