coverage tests spawn local server with authentication for read-write requests

test/upload-detection-tools.test.js

@@ -55,9 +55,9 @@ test('Python API tools are syntax-valid and contain reusable 401 authentication
 });
 
 
-test('Python client retries the same request with API_USER and API_PASSWORD after HTTP 401', async t => {
-  const apiUser = process.env.API_USER || 'tester';
-  const apiPassword = process.env.API_PASSWORD || 'secret';
+test('Python client retries an intentionally simulated reverse-proxy 401 with trimmed environment credentials', async t => {
+  const apiUser = 'local-test-user';
+  const apiPassword = 'local-test-password';
   const expectedAuthorization = `Basic ${Buffer.from(`${apiUser}:${apiPassword}`).toString('base64')}`;
   const receivedAuthorization = [];
 
@@ -83,8 +83,8 @@ assert result == {'ok': True}
   const child = spawn('python3', ['-c', script], {
     env: {
       ...process.env,
-      API_USER: apiUser,
-      API_PASSWORD: apiPassword,
+      API_USER: `  ${apiUser}  `,
+      API_PASSWORD: `  ${apiPassword}  `,
       PYTHONPATH: path.join(root, 'tools/python')
     },
     stdio: ['ignore', 'pipe', 'pipe']