woggioni
a9eb97e6e1
CI / Build and push docker image (push) Successful in 1m11s
OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's default would also request email, which the platform never stores or exposes. The display-name fallback drops the email claim too (preferred_username, name, then the sub). Tests pin the configured scopes and cover an IdP that still returns an email claim: the claim is ignored and absent from /api/me.
43 lines
1.7 KiB
Python
43 lines
1.7 KiB
Python
"""Auth routes on the fully wired application.
|
|
|
|
The integration suite's app is built from the indexed test environment
|
|
(one provider named ``default``); these tests pin the public surface the
|
|
SPA and bookmarks rely on.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from httpx import ASGITransport, AsyncClient
|
|
|
|
from tavolo.app import app, oidc
|
|
from tests.helpers import async_test
|
|
|
|
|
|
class AuthRoutesTest(unittest.TestCase):
|
|
@async_test
|
|
async def test_providers_endpoint_reports_the_configured_provider(self) -> None:
|
|
transport = ASGITransport(app=app)
|
|
async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
|
|
response = await client.get("/api/auth/providers")
|
|
self.assertEqual(200, response.status_code)
|
|
self.assertEqual(
|
|
{"providers": [{"name": "default", "login_url": "/auth/default/login"}]},
|
|
response.json(),
|
|
)
|
|
|
|
@async_test
|
|
async def test_generic_login_redirects_to_the_provider(self) -> None:
|
|
transport = ASGITransport(app=app)
|
|
async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
|
|
response = await client.get("/auth/login", follow_redirects=False)
|
|
self.assertEqual(302, response.status_code)
|
|
self.assertEqual("/auth/default/login", response.headers["location"])
|
|
|
|
def test_authorization_scopes_exclude_email(self) -> None:
|
|
# Only the scopes the app uses are requested: openid (sub) and
|
|
# profile (preferred_username/name). kaya-oidc's default would also
|
|
# request email, which the app neither needs nor stores.
|
|
mixin = oidc.provider("default")
|
|
self.assertEqual(("openid", "profile"), tuple(mixin._config.scopes))
|