Repository navigation
test(sso): rate-limit throttle tests (#9611) + callback host-case test fix (#10255) - #10270
Merged
Merged
Conversation
Test assertion was inverted — production code already normalises the host to lowercase via urlsplit().hostname (RFC 3986 §3.2.2); the test incorrectly expected the original mixed-case form. Correct the assertion so the test accurately reflects the intended security behaviour. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ert 429 + Retry-After (#9611) Add three tests covering the rate-limit guard in each SSO endpoint (initiate_sso_login, oauth_callback, ldap_login). The core challenge: FastAPI's @router.get/post decorator replaces endpoint functions with MagicMock objects when `router` itself is mocked, making the coroutines unreachable. Fix: stub APIRouter so .get/.post act as identity decorators, preserving the real coroutine function in the module namespace. Each test: - loads a fresh module instance (isolation) - replaces the module-level limiter with patch.object(_sso_auth, _LIMITER) - drives acquire→False / get_retry_after_seconds→30 - asserts HTTP 429 + Retry-After: 30 header Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Jun 17, 2026
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
Applied Black, isort, and autoflake to match code-quality checks. Triggered by workflow auto-fix-formatting.yml. Co-Authored-By: Paperclip <noreply@paperclip.ing>
Owner
Author
Review — APPROVED ✅ (admin-merge: sole failure is known infra)Test-only change (SLM Required CI: code-quality ✅, startup-import-smoke ✅, Test Summary ✅, Analyze Python ✅, SAST ✅, hardened-smoke-test ✅. The lone |
This was referenced Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
Umbrella #9930 fixes. #9611: PR #9610's SSO rate-limit tests were absent from
test_sso_auth.py(module-level limiter instances are hard to patch). #10255:test_build_callback_url_case_insensitivefailed — but_build_callback_urlalready lowercases the host (RFC 3986); the test asserted the wrong (uppercase) expectation. Both are test-only; production rate-limit + callback logic was already correct.What Changed
_sso_*_limiterinstances with a throttled AsyncMock, invoke the real endpoint functions, assert 429 + Retry-After and thatacquire/get_retry_after_secondswere awaited.localhost) the production code already returns.Verification
pytest tests/api/test_sso_auth.py→ 8 passed (3 new rate-limit + corrected case test + existing). ruff + black clean. Rebased onto latest Dev_new_gui.Model Used
Claude Opus 4.8 (implementer subagent + self-review)
Closes #9611
Closes #10255