fix: fail closed weak password opt-in

central/tests/test_control_plane.py

@@ -1,4 +1,5 @@
 from datetime import datetime, timedelta, timezone
+import importlib
 import pytest
 
 from fastapi.testclient import TestClient
@@ -57,6 +58,21 @@ def test_short_local_password_requires_explicit_setting(monkeypatch):
         assert verify_password("admin", admin.password_hash)
 
 
+def test_removed_weak_password_flag_is_fail_closed_after_import(monkeypatch):
+    monkeypatch.setenv("ALLOW_WEAK_DEV_PASSWORD", "1")
+    import central.app.config as config_module
+    import central.app.human_auth as human_auth_module
+
+    importlib.reload(config_module)
+    importlib.reload(human_auth_module)
+    session_factory = setup_db()
+    with session_factory() as session:
+        assert human_auth_module.create_admin(session, "admin", "admin").username == "admin"
+        monkeypatch.delenv("ALLOW_WEAK_DEV_PASSWORD", raising=False)
+        with pytest.raises(ValueError):
+            human_auth_module.create_admin(session, "admin2", "admin")
+
+
 def test_production_admin_keeps_strong_password_minimum(monkeypatch):
     session_factory = setup_db()
     with session_factory() as session: