[usermaneGermane]

Adds tests/test_server_http.py — 79 tests, ~4 s, standard library only, the same file in both server repos — and fixes the two server bugs it found. Bumps the version to 1.4.1 (patch).

Why

The server repos' tests covered setup, listen settings, logging and bind, but never sent the server a request. Request handling was only tested from the clients, through client code, so the refusals meant for a broken, outdated or hostile client were never run.

What the tests cover

• Token: /health is open; everything else is 401 without Bearer <token> (missing, wrong, Basic, no scheme, lowercase bearer); checked before routing.
• Paths: only /vault/<user> and /vault/<user>/meta; dangerous usernames (.., .hidden, con, NUL, 64 chars, …) refused and nothing created; 63 chars accepted; POST/DELETE/PATCH → 501.
• If-Match: first push without it OK; later push without it → 428; stale → 409 with the store unchanged; quoted revision accepted; * overwrites; two pushes racing for one revision → exactly one 200 and one 409.
• Bodies: not JSON / no blob / not a string / not ASCII / not base64 / too short → 400; empty or nonsense Content-Length → 400; over 8 MB → 413 without reading it.
• History: each push keeps the revision it replaces; trimmed to HISTORY_LIMIT (20); X-PassMan-Drop-History: 1 clears it.
• Key generation: stored, kept when the header is left out, nonsense → 400.
• Responses: Cache-Control: no-store and JSON on successes and errors.
• Access log: names the request, never the body, the token or the query string; garbled request lines are refused and the server carries on.

Mutation-checked: removing the lock, the revision check or the If-Match requirement each makes its test fail.

Fixed in server/passman_server.py

1. GET /vault/<user>/meta/<anything> returned the user's meta: _user_from_path ignored parts after the third. Now 404, as its docstring says.
2. The access log kept the query string, which log_message's docstring says it leaves out. A log_request override now cuts it from the logged request line.

Neither had a practical effect (both need the token; the clients send no query strings), but the file now does what it says.

The same server file goes to both clients' test copies in separate PRs (Client-Windows, Client-Linux); all four copies stay byte-identical.

Also

• Test fixture polls for shutdown every 10 ms instead of 0.5 s (otherwise the file took 40 s).
• README Development section: describes the new tests; both clients (not only Windows) keep a copy of passman_server.py.

Tested

Full suite locally on Python 3.13 (Windows): 171 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_011jnuqjxmKqjXT4CuBRJMzr