test(auth): fix DataTables Forbidden alert by preventing API_TOKEN cache desync

- Prevented test_ui_login fixture from accidentally stripping API_TOKEN from app.conf, which was triggering random token regeneration mid-test.
- Added explicit invalidation of SETTINGS_SECONDARYCACHE in server/initialise.py to ensure the Python GraphQL backend immediately respects regenerated API_TOKENs.
- Fixed getSettingValue fallback logic in PHP auth layers to reliably use the token generated by the backend rather than mismatching.

Author: adamoutler

front/php/server/query_graphql.php

@@ -12,6 +12,9 @@
 // Helper function to get GraphQL URL (you can replace this with environment variables)
 function getGraphQLUrl() {
     $port = getSettingValue("GRAPHQL_PORT");  // Port for the GraphQL server
+    if (empty($port) || !is_numeric($port)) {
+        $port = 20211;
+    }
     return "0.0.0.0:$port/graphql";  // Full URL to the GraphQL endpoint
 }
 

front/php/templates/auth.php

@@ -29,7 +29,7 @@
 }
 
 $config_file_lines = file($config_file);
-$config_file_lines_pw = array_values(preg_grep('/^SETPWD_password.*=/', $config_file_lines ?: []));
+$config_file_lines_pw = array_values(preg_grep('/^SETPWD_password\s*=/', $config_file_lines ?: []));
 if (empty($config_file_lines_pw) || substr_count($config_file_lines_pw[0], "'") < 2) {
     http_response_code(401);
     echo 'Unauthorized 401';
@@ -38,9 +38,12 @@
 $password_line = explode("'", $config_file_lines_pw[0], 3);
 $nax_Password = $password_line[1];
 
-$config_file_lines_token = array_values(preg_grep('/^API_TOKEN.*=/', $config_file_lines ?: []));
+$config_file_lines_token = array_values(preg_grep('/^API_TOKEN\s*=/', $config_file_lines ?: []));
 $token_line = !empty($config_file_lines_token) ? explode("'", $config_file_lines_token[0], 3) : [];
 $api_token = $token_line[1] ?? '';
+if (empty($api_token)) {
+    $api_token = getenv('API_TOKEN') ?: '';
+}
 if ($api_token === '') {
     http_response_code(401);
     echo 'Unauthorized 401';

front/php/templates/security.php

@@ -93,6 +93,9 @@ function redirect($url) {
 }
 $nax_Password = getConfigValue('/^SETPWD_password\s*=/', $configLines);
 $api_token = getConfigValue('/^API_TOKEN\s*=/', $configLines, "'");
+if (empty($api_token)) {
+    $api_token = getenv('API_TOKEN') ?: '';
+}
 
 $expectedToken = 'Bearer ' . $api_token;
 

server/initialise.py

@@ -227,6 +227,13 @@ def importConfigs(pm, db, all_plugins):
     mylog("debug", ["[Import Config] importing config file"])
     conf.mySettings = []  # reset settings
     conf.mySettingsSQLsafe = []  # same as above but safe to be passed into a SQL query
+    
+    # Invalidate secondary cache from helper since conf.mySettings changed
+    try:
+        import helper
+        helper.SETTINGS_SECONDARYCACHE = {}
+    except Exception:
+        pass
 
     # User values loaded from now
     c_d = read_config_file(config_file)

test/ui/test_ui_login.py

@@ -43,7 +43,7 @@ def ensure_web_protection():
                         f.write(line)
                 f.write("\nSETPWD_enable_password='true'\n")
                 f.write("SETPWD_password='8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92'\n")
-        time.sleep(1)  # Let disk sync catch up
+        time.sleep(2)  # Let disk sync catch up
 
     yield