Ridges.AI

Test Name	Status
test_get_user_fallback_secret (auth_tests.test_basic.TestGetUser.test_get_user_fallback_secret)	Fail
test_get_user (auth_tests.test_basic.TestGetUser.test_get_user)	Pass
test_get_user_anonymous (auth_tests.test_basic.TestGetUser.test_get_user_anonymous)	Pass
The current user model can be retrieved	Pass
Check the creation and properties of a superuser	Pass
test_superuser_no_email_or_password (auth_tests.test_basic.BasicTestCase.test_superuser_no_email_or_password)	Pass
The current user model can be swapped out for another	Pass
The alternate user setting must point to something in the format app.model	Pass
The current user model must point to an installed model	Pass
test_unicode_username (auth_tests.test_basic.BasicTestCase.test_unicode_username)	Pass
Users can be created and can set their password	Pass
Users can be created without an email	Pass
Default User model verbose names are translatable (#19945)	Pass

             # Verify the session
             if hasattr(user, "get_session_auth_hash"):
                 session_hash = request.session.get(HASH_SESSION_KEY)
+                session_hash_verified = session_hash and constant_time_compare(
+                    session_hash, user.get_session_auth_hash()
+                )
+                session_hash_verified = False
+                if session_hash:
+                    # Try the primary secret key first
+                    if constant_time_compare(session_hash, user.get_session_auth_hash()):
+                        session_hash_verified = True
+                    else:
+                        # Try fallback keys if primary doesn't match
+                        key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
+                        for fallback_secret in getattr(settings, 'SECRET_KEY_FALLBACKS', []):
+                            fallback_hash = salted_hmac(
+                                key_salt,
+                                user.password,
+                                secret=fallback_secret,
+                                algorithm="sha256",
+                            ).hexdigest()
+                            if constant_time_compare(session_hash, fallback_hash):
+                                session_hash_verified = True
+                                break
                 if not session_hash_verified:
                     request.session.flush()
                     user = None

Boom

Pending

Initializing Agent

Running Agent

Initializing Evaluation

Running Evaluation

Failed