test: add failing tests for publishable_client_key and token store defaults

- Test publishable_client_key header included/omitted in _build_headers
- Test ExplicitTokenStore defaults to None without arguments
- Test resolve_token_store dict branch defaults missing keys to None
- Test StackServerApp/AsyncStackServerApp accept publishable_client_key

sdks/implementations/python/tests/test_app.py

@@ -64,6 +64,14 @@ class TestStackServerAppConstruction:
         )
         assert app is not None
 
+    def test_constructs_with_publishable_client_key(self) -> None:
+        app = StackServerApp(project_id="proj", secret_server_key="sk", publishable_client_key="pk_test")
+        assert app is not None
+
+    def test_async_constructs_with_publishable_client_key(self) -> None:
+        app = AsyncStackServerApp(project_id="proj", secret_server_key="sk", publishable_client_key="pk_test")
+        assert app is not None
+
     def test_context_manager(self) -> None:
         with StackServerApp(project_id="proj", secret_server_key="sk") as app:
             assert app is not None

sdks/implementations/python/tests/test_client.py

@@ -71,6 +71,16 @@ class TestBuildHeaders:
         )
         assert uuid_pattern.match(nonce), f"Nonce {nonce!r} is not a valid UUID v4"
 
+    def test_publishable_client_key_header_included(self) -> None:
+        client = SyncAPIClient(project_id="proj_123", secret_server_key="sk_secret", publishable_client_key="pk_test")
+        headers = client._build_headers()
+        assert headers["x-stack-publishable-client-key"] == "pk_test"
+
+    def test_publishable_client_key_header_omitted_when_none(self) -> None:
+        client = SyncAPIClient(project_id="proj_123", secret_server_key="sk_secret")
+        headers = client._build_headers()
+        assert "x-stack-publishable-client-key" not in headers
+
 
 # ---------------------------------------------------------------------------
 # URL building tests

sdks/implementations/python/tests/test_token_store.py

@@ -138,6 +138,17 @@ class TestExplicitTokenStore:
         assert store.get_stored_access_token() == "at_1"
         assert store.get_stored_refresh_token() == "rt_1"
 
+    def test_defaults_to_none_without_arguments(self) -> None:
+        store = ExplicitTokenStore()
+        assert store.get_stored_access_token() is None
+        assert store.get_stored_refresh_token() is None
+
+    def test_partial_dict_defaults_missing_to_none(self) -> None:
+        store = resolve_token_store({"access_token": "at"}, "proj")
+        assert isinstance(store, ExplicitTokenStore)
+        assert store.get_stored_access_token() == "at"
+        assert store.get_stored_refresh_token() is None
+
 
 # ---------------------------------------------------------------------------
 # RequestTokenStore