From 5d4a50d2cdd7bacfaa9339e8209d302324de89cc Mon Sep 17 00:00:00 2001 From: Patrick Buckley Date: Mon, 4 May 2026 13:11:30 -0700 Subject: [PATCH] chore(oidc): consolidate test OIDCConfig helper + fix exceptions banner (cumulative q-4, q-5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit q-4: tests/test_oidc.py's _make_config and tests/test_oidc_handlers.py's _make_oidc_config built the same OIDCConfig with sensible defaults but had drifted — only the handlers helper set redirect_base. After b3 made redirect_base operationally required, every test_oidc.py test that exercised redirect_base had to override it explicitly. A future test could omit redirect_base and silently exercise the wrong production path. Moves make_oidc_test_config to tests/conftest.py with the more complete handler-version defaults (including redirect_base). Both test files import it under their existing local alias (_make_config / _make_oidc_config) so the 60+ call sites in test_oidc.py and the handler tests don't have to change. q-5: section banner '# Exception' (singular) at oidc.py:79 became inconsistent after b5 (callback robustness) added OIDCKeyNotFoundError. Renamed to '# Exceptions'. --- tests/conftest.py | 32 ++++++++++++++++++++++++++++++++ tests/test_oidc.py | 23 +---------------------- tests/test_oidc_handlers.py | 34 ++++------------------------------ turnstone/core/oidc.py | 2 +- 4 files changed, 38 insertions(+), 53 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 987fe246..db828a71 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -1,10 +1,42 @@ from __future__ import annotations import os +from typing import TYPE_CHECKING, Any from unittest.mock import MagicMock import pytest +if TYPE_CHECKING: + from turnstone.core.oidc import OIDCConfig + + +def make_oidc_test_config(**overrides: Any) -> OIDCConfig: + """Build a test ``OIDCConfig`` with sensible defaults. + + Shared between ``test_oidc.py`` and ``test_oidc_handlers.py`` so the + defaults (including the now-required ``redirect_base``) stay aligned. + """ + from turnstone.core.oidc import OIDCConfig + + defaults: dict[str, Any] = { + "enabled": True, + "issuer": "https://idp.example.com", + "client_id": "my-client", + "client_secret": "my-secret", + "scopes": "openid email profile", + "provider_name": "TestIDP", + "role_claim": "", + "role_map": {}, + "password_enabled": True, + "redirect_base": "https://app.example.com", + "authorization_endpoint": "https://idp.example.com/authorize", + "token_endpoint": "https://idp.example.com/token", + "userinfo_endpoint": "https://idp.example.com/userinfo", + "jwks_uri": "https://idp.example.com/.well-known/jwks.json", + } + defaults.update(overrides) + return OIDCConfig(**defaults) + def pytest_addoption(parser: pytest.Parser) -> None: parser.addoption( diff --git a/tests/test_oidc.py b/tests/test_oidc.py index 6ed05913..32872887 100644 --- a/tests/test_oidc.py +++ b/tests/test_oidc.py @@ -15,8 +15,8 @@ import httpx import jwt as pyjwt import pytest +from tests.conftest import make_oidc_test_config as _make_config from turnstone.core.oidc import ( - OIDCConfig, OIDCError, OIDCKeyNotFoundError, _ensure_default_role, @@ -39,27 +39,6 @@ from turnstone.core.oidc import ( # --------------------------------------------------------------------------- -def _make_config(**overrides) -> OIDCConfig: - """Build a test OIDCConfig with sensible defaults.""" - defaults = { - "enabled": True, - "issuer": "https://idp.example.com", - "client_id": "my-client", - "client_secret": "my-secret", - "scopes": "openid email profile", - "provider_name": "TestIDP", - "role_claim": "", - "role_map": {}, - "password_enabled": True, - "authorization_endpoint": "https://idp.example.com/authorize", - "token_endpoint": "https://idp.example.com/token", - "userinfo_endpoint": "https://idp.example.com/userinfo", - "jwks_uri": "https://idp.example.com/.well-known/jwks.json", - } - defaults.update(overrides) - return OIDCConfig(**defaults) - - def _mock_storage(**overrides): """Build a MagicMock with sensible storage defaults.""" s = MagicMock() diff --git a/tests/test_oidc_handlers.py b/tests/test_oidc_handlers.py index 7b7d9055..9f9a83f9 100644 --- a/tests/test_oidc_handlers.py +++ b/tests/test_oidc_handlers.py @@ -18,10 +18,7 @@ from starlette.middleware.base import BaseHTTPMiddleware from starlette.routing import Mount, Route from starlette.testclient import TestClient -if TYPE_CHECKING: - from starlette.requests import Request - from starlette.responses import Response - +from tests.conftest import make_oidc_test_config as _make_oidc_config from turnstone.console.server import ( admin_delete_oidc_identity, admin_list_oidc_identities, @@ -35,32 +32,9 @@ from turnstone.core.auth import ( from turnstone.core.oidc import OIDCConfig, OIDCError, OIDCKeyNotFoundError from turnstone.core.storage._sqlite import SQLiteBackend -# --------------------------------------------------------------------------- -# Helpers -# --------------------------------------------------------------------------- - - -def _make_oidc_config(**overrides: Any) -> OIDCConfig: - """Build a test OIDCConfig with sensible defaults.""" - defaults: dict[str, Any] = { - "enabled": True, - "issuer": "https://idp.example.com", - "client_id": "my-client", - "client_secret": "my-secret", - "scopes": "openid email profile", - "provider_name": "TestIDP", - "role_claim": "", - "role_map": {}, - "password_enabled": True, - "redirect_base": "https://app.example.com", - "authorization_endpoint": "https://idp.example.com/authorize", - "token_endpoint": "https://idp.example.com/token", - "userinfo_endpoint": "https://idp.example.com/userinfo", - "jwks_uri": "https://idp.example.com/.well-known/jwks.json", - } - defaults.update(overrides) - return OIDCConfig(**defaults) - +if TYPE_CHECKING: + from starlette.requests import Request + from starlette.responses import Response # --------------------------------------------------------------------------- # Thin handler wrappers — match the pattern used in server.py / console diff --git a/turnstone/core/oidc.py b/turnstone/core/oidc.py index b6d098e7..f69af2dc 100644 --- a/turnstone/core/oidc.py +++ b/turnstone/core/oidc.py @@ -76,7 +76,7 @@ _KNOWN_TRUSTED_ENDPOINT_HOSTS: dict[str, frozenset[str]] = { # --------------------------------------------------------------------------- -# Exception +# Exceptions # ---------------------------------------------------------------------------