open-swe/tests/test_auth_error_leak.py

"""AUTH-RESP-LEAK-01: upstream auth-error bodies must not reach user-facing text."""

from __future__ import annotations

import asyncio
from typing import Any

import httpx
import pytest

from agent.utils import auth

_SECRET_BODY = "SENSITIVE-UPSTREAM-BODY-9999"


class _Resp:
    def __init__(self, status_code: int, text: str) -> None:
        self.status_code = status_code
        self.text = text

    def raise_for_status(self) -> None:
        raise httpx.HTTPStatusError(
            "boom",
            request=httpx.Request("POST", "http://example.test"),
            response=self,  # type: ignore[arg-type]
        )

    def json(self) -> Any:
        return {}


class _Client:
    def __init__(self, resp: _Resp) -> None:
        self._resp = resp

    async def __aenter__(self) -> _Client:
        return self

    async def __aexit__(self, *_a: Any) -> None:
        return None

    async def post(self, *_a: Any, **_k: Any) -> _Resp:
        return self._resp


def test_http_error_returns_generic_message(monkeypatch: pytest.MonkeyPatch) -> None:
    monkeypatch.setattr(auth, "GITHUB_OAUTH_PROVIDER_ID", "provider-id")
    monkeypatch.setattr(auth, "X_SERVICE_AUTH_JWT_SECRET", "jwt-secret")
    monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **k: _Client(_Resp(500, _SECRET_BODY)))

    result = asyncio.run(auth.get_github_token_for_user("ls-user", "tenant"))

    assert "error" in result
    assert _SECRET_BODY not in result["error"]
    assert "500" in result["error"]