From dee534ee2a8c113437ee6fccee088617dae10ecf Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Fri, 12 Jun 2026 08:45:27 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9D=20CodeRabbit=20Chat:=20Implement?=
 =?UTF-8?q?=20requested=20code=20changes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../backend/api/tests/test_authentication.py   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/api/src/backend/api/tests/test_authentication.py b/api/src/backend/api/tests/test_authentication.py
index 3af362d210..1f3e238ba7 100644
--- a/api/src/backend/api/tests/test_authentication.py
+++ b/api/src/backend/api/tests/test_authentication.py
@@ -425,3 +425,21 @@ class TestSSEAuthentication:
         jwt_instance.get_validated_token.assert_called_once_with("query-jwt")
         assert user == "query-user"
         assert token == "validated"
+
+    def test_query_token_invalid_raises_authentication_error(self):
+        """An invalid JWT in `?access_token` must propagate as an auth error,
+        not be swallowed or treated as unauthenticated."""
+        from rest_framework_simplejwt.exceptions import InvalidToken
+
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {"access_token": "bad-token"}
+
+        jwt_instance = MagicMock()
+        jwt_instance.get_validated_token.side_effect = InvalidToken("Token is invalid")
+
+        with patch("api.authentication.JWTAuthentication", return_value=jwt_instance):
+            with pytest.raises(InvalidToken):
+                SSEAuthentication().authenticate(request)
+
+        jwt_instance.get_validated_token.assert_called_once_with("bad-token")