From 259a2b710c9107534145068d527a0c7a0baf51e9 Mon Sep 17 00:00:00 2001
From: "eric.quintero@trailofbits.com" <eric.quintero@trailofbits.com>
Date: Mon, 15 Jun 2026 19:28:48 +0000
Subject: [PATCH] Fix add_to_pydotorg session cleanup calls

---
 add_to_pydotorg.py            |  2 +-
 tests/test_add_to_pydotorg.py | 22 ++++++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/add_to_pydotorg.py b/add_to_pydotorg.py
index 33d54e04..2151f1f8 100755
--- a/add_to_pydotorg.py
+++ b/add_to_pydotorg.py
@@ -328,7 +328,7 @@ def post_object(base_url: str, objtype: str, datadict: dict[str, Any]) -> int:
 
 def delete_object(base_url: str, objtype: str, pk: int) -> None:
     """Delete an existing API object."""
-    resp = requests.delete(base_url + f"downloads/{objtype}/{pk}/", headers=headers)
+    resp = session.delete(f"{base_url}downloads/{objtype}/{pk}/")
     if resp.status_code != 204:
         raise RuntimeError(f"Deleting {objtype} {pk} failed: {resp.status_code}")
 
diff --git a/tests/test_add_to_pydotorg.py b/tests/test_add_to_pydotorg.py
index 7970d990..ad622fc0 100644
--- a/tests/test_add_to_pydotorg.py
+++ b/tests/test_add_to_pydotorg.py
@@ -3,7 +3,6 @@
 from typing import Any
 
 import pytest
-import requests
 from pyfakefs.fake_filesystem import FakeFilesystem
 
 os.environ["AUTH_INFO"] = "test_username:test_api_key"
@@ -87,7 +86,7 @@ class Response:
     def fake_post(*args: Any, **kwargs: Any) -> Response:
         return Response()
 
-    monkeypatch.setattr(requests, "post", fake_post)
+    monkeypatch.setattr(add_to_pydotorg.session, "post", fake_post)
 
     with pytest.raises(RuntimeError, match="validation failed"):
         add_to_pydotorg.post_object(
@@ -95,6 +94,25 @@ def fake_post(*args: Any, **kwargs: Any) -> Response:
         )
 
 
+def test_delete_object_uses_session(monkeypatch: pytest.MonkeyPatch) -> None:
+    class Response:
+        status_code = 204
+
+    calls: list[str] = []
+
+    def fake_delete(url: str) -> Response:
+        calls.append(url)
+        return Response()
+
+    monkeypatch.setattr(add_to_pydotorg.session, "delete", fake_delete)
+
+    add_to_pydotorg.delete_object(
+        "https://example.invalid/api/v1/", "release_file", 123
+    )
+
+    assert calls == ["https://example.invalid/api/v1/downloads/release_file/123/"]
+
+
 def test_create_release_files_cleans_up_created_rows(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: