From 751b16d804b0659514ac682b6b5d6c66a4e83e94 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 14 Mar 2026 09:55:33 +0000
Subject: [PATCH] test: clarify caller cleanup responsibility in
 _make_unauthenticated_client docstring

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 tests/test_api_tokens.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/test_api_tokens.py b/tests/test_api_tokens.py
index fa439462..710a961c 100644
--- a/tests/test_api_tokens.py
+++ b/tests/test_api_tokens.py
@@ -75,6 +75,9 @@ def _make_unauthenticated_client(tok_engine) -> TestClient:
     authentication path.  Any request made with this client that does not
     carry a valid session or Bearer token will receive a 401 from the
     actual auth code, not from a mocked dependency.
+
+    The caller is responsible for clearing overrides via ``_cleanup(app)``
+    after the test completes (typically in a ``finally`` block).
     """
     from app.main import app