mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 08:03:15 +00:00
Adam Moussa
d980209157
Cross-family review (GPT-4.1) FIX item on the #1736 port: prove the warn-and-drop path for unprincipaled user tokens leaves the cached bot token reachable.
365 lines
13 KiB
Python
365 lines
13 KiB
Python
"""Tests for TTL + revocation handling on cached GitHub OAuth tokens.
|
|
|
|
Covers:
|
|
- (a) expired-cache reads return None / fall through to re-auth
|
|
- (b) 401 on a downstream GitHub call invalidates the cached token and
|
|
triggers a fresh resolve in the webhook layer
|
|
- (c) ``publish_review`` invalidates the cached token and returns a clean
|
|
failure when GitHub responds 401
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from datetime import UTC, datetime, timedelta
|
|
from typing import Any
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from agent.utils import github_comments, github_token
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _clear_token_cache() -> None:
|
|
github_token._GITHUB_TOKEN_CACHE.clear()
|
|
|
|
|
|
# (a) expired-cache reads -----------------------------------------------------
|
|
|
|
|
|
def test_is_expired_handles_iso_zulu_strings() -> None:
|
|
past = (datetime.now(UTC) - timedelta(hours=1)).isoformat().replace("+00:00", "Z")
|
|
future = (datetime.now(UTC) + timedelta(hours=1)).isoformat().replace("+00:00", "Z")
|
|
assert github_token._is_expired(past) is True
|
|
assert github_token._is_expired(future) is False
|
|
|
|
|
|
def test_is_expired_handles_unix_timestamps() -> None:
|
|
past = (datetime.now(UTC) - timedelta(hours=1)).timestamp()
|
|
future = (datetime.now(UTC) + timedelta(hours=1)).timestamp()
|
|
assert github_token._is_expired(past) is True
|
|
assert github_token._is_expired(future) is False
|
|
|
|
|
|
def test_is_expired_treats_unparseable_as_not_expired() -> None:
|
|
assert github_token._is_expired(None) is False
|
|
assert github_token._is_expired("") is False
|
|
assert github_token._is_expired("not-a-date") is False
|
|
|
|
|
|
def test_get_github_token_returns_none_for_expired_cache() -> None:
|
|
past = (datetime.now(UTC) - timedelta(hours=1)).isoformat()
|
|
github_token.cache_github_token_for_thread(
|
|
"tid", "ghp_secret", expires_at=past, is_bot_token=True
|
|
)
|
|
assert github_token.get_github_token({"configurable": {"thread_id": "tid"}}) is None
|
|
|
|
|
|
def test_get_github_token_returns_fresh_cached_token() -> None:
|
|
future = (datetime.now(UTC) + timedelta(hours=1)).isoformat()
|
|
github_token.cache_github_token_for_thread(
|
|
"tid", "ghp_secret", expires_at=future, is_bot_token=True
|
|
)
|
|
assert github_token.get_github_token({"configurable": {"thread_id": "tid"}}) == "ghp_secret"
|
|
|
|
|
|
def test_get_github_token_returns_cached_token_when_no_expires_at() -> None:
|
|
github_token.cache_github_token_for_thread("tid", "ghp_secret", is_bot_token=True)
|
|
assert github_token.get_github_token({"configurable": {"thread_id": "tid"}}) == "ghp_secret"
|
|
|
|
|
|
def test_user_token_cache_is_bound_to_github_login() -> None:
|
|
principal = github_token.github_token_principal(login=" Alice ")
|
|
github_token.cache_github_token_for_thread("shared-thread", "alice-token", principal=principal)
|
|
|
|
alice_config = {"configurable": {"thread_id": "shared-thread", "github_login": "ALICE"}}
|
|
bob_config = {"configurable": {"thread_id": "shared-thread", "github_login": "bob"}}
|
|
|
|
assert github_token.get_github_token(alice_config) == "alice-token"
|
|
assert github_token.get_github_token(bob_config) is None
|
|
|
|
|
|
def test_unbound_user_token_is_not_cached() -> None:
|
|
github_token.cache_github_token_for_thread("tid", "unbound-token")
|
|
assert github_token._GITHUB_TOKEN_CACHE == {}
|
|
|
|
|
|
def test_cached_bot_token_is_available_to_any_principal() -> None:
|
|
github_token.cache_github_token_for_thread("tid", "bot-token", is_bot_token=True)
|
|
config = {"configurable": {"thread_id": "tid", "github_login": "alice"}}
|
|
assert github_token.get_github_token(config) == "bot-token"
|
|
|
|
|
|
def test_refused_unbound_user_token_falls_back_to_cached_bot_token() -> None:
|
|
github_token.cache_github_token_for_thread("tid", "bot-token", is_bot_token=True)
|
|
github_token.cache_github_token_for_thread("tid", "unbound-user-token")
|
|
|
|
config = {"configurable": {"thread_id": "tid", "github_login": "alice"}}
|
|
assert github_token.get_github_token(config) == "bot-token"
|
|
assert list(github_token._GITHUB_TOKEN_CACHE) == [("tid", github_token._BOT_PRINCIPAL)]
|
|
|
|
|
|
def test_cached_token_expires_after_max_ttl() -> None:
|
|
"""A token with no/far expiry is still dropped once it's older than the 24h cap."""
|
|
far_future = (datetime.now(UTC) + timedelta(days=30)).isoformat()
|
|
old_cached_at = datetime.now(UTC) - timedelta(hours=25)
|
|
github_token._GITHUB_TOKEN_CACHE[("tid", github_token._BOT_PRINCIPAL)] = (
|
|
"ghp_secret",
|
|
far_future,
|
|
old_cached_at,
|
|
None,
|
|
)
|
|
assert github_token.get_github_token({"configurable": {"thread_id": "tid"}}) is None
|
|
|
|
|
|
def test_cache_write_sweeps_other_expired_entries() -> None:
|
|
"""Writing one entry evicts unrelated entries that have passed their expiry."""
|
|
past = (datetime.now(UTC) - timedelta(hours=1)).isoformat()
|
|
github_token.cache_github_token_for_thread(
|
|
"stale", "ghp_stale", expires_at=past, is_bot_token=True
|
|
)
|
|
github_token.cache_github_token_for_thread("fresh", "ghp_fresh", is_bot_token=True)
|
|
assert ("stale", github_token._BOT_PRINCIPAL) not in github_token._GITHUB_TOKEN_CACHE
|
|
assert ("fresh", github_token._BOT_PRINCIPAL) in github_token._GITHUB_TOKEN_CACHE
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_get_github_token_from_thread_skips_expired() -> None:
|
|
past = (datetime.now(UTC) - timedelta(hours=1)).isoformat()
|
|
github_token.cache_github_token_for_thread(
|
|
"tid", "ghp_revoked", expires_at=past, is_bot_token=True
|
|
)
|
|
token, expires_at = await github_token.get_github_token_from_thread("tid")
|
|
assert token is None
|
|
assert expires_at is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_get_github_token_from_thread_returns_fresh() -> None:
|
|
future = (datetime.now(UTC) + timedelta(hours=1)).isoformat()
|
|
github_token.cache_github_token_for_thread(
|
|
"tid", "ghp_live", expires_at=future, is_bot_token=True
|
|
)
|
|
token, expires_at = await github_token.get_github_token_from_thread("tid")
|
|
assert token == "ghp_live"
|
|
assert expires_at == future
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_invalidate_cached_github_token_clears_cache() -> None:
|
|
github_token.cache_github_token_for_thread("tid-42", "ghp_live", is_bot_token=True)
|
|
await github_token.invalidate_cached_github_token("tid-42")
|
|
token, expires_at = await github_token.get_github_token_from_thread("tid-42")
|
|
assert token is None
|
|
assert expires_at is None
|
|
|
|
|
|
# (b) 401 on a downstream GitHub call -----------------------------------------
|
|
|
|
|
|
class _MockResponse:
|
|
def __init__(self, status_code: int, json_data: Any | None = None) -> None:
|
|
self.status_code = status_code
|
|
self._json = json_data or {}
|
|
|
|
def json(self) -> Any:
|
|
return self._json
|
|
|
|
|
|
class _MockHttpxClient:
|
|
def __init__(self, status_code: int, json_data: Any | None = None) -> None:
|
|
self.status_code = status_code
|
|
self.json_data = json_data
|
|
self.posts: list[dict[str, Any]] = []
|
|
self.gets: list[dict[str, Any]] = []
|
|
|
|
async def __aenter__(self) -> _MockHttpxClient:
|
|
return self
|
|
|
|
async def __aexit__(self, *args: Any) -> None:
|
|
return None
|
|
|
|
async def post(self, url: str, **kwargs: Any) -> _MockResponse:
|
|
self.posts.append({"url": url, **kwargs})
|
|
return _MockResponse(self.status_code, self.json_data)
|
|
|
|
async def get(self, url: str, **kwargs: Any) -> _MockResponse:
|
|
self.gets.append({"url": url, **kwargs})
|
|
return _MockResponse(self.status_code, self.json_data)
|
|
|
|
|
|
def test_react_to_github_comment_raises_on_401(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
mock_client = _MockHttpxClient(status_code=401)
|
|
monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **kw: mock_client)
|
|
|
|
async def _run() -> None:
|
|
await github_comments.react_to_github_comment(
|
|
{"owner": "o", "name": "r"},
|
|
comment_id=1,
|
|
event_type="issue_comment",
|
|
token="revoked",
|
|
)
|
|
|
|
with pytest.raises(github_token.GitHubAuthError):
|
|
asyncio.run(_run())
|
|
|
|
|
|
def test_fetch_pr_comments_since_last_tag_raises_on_401(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
mock_client = _MockHttpxClient(status_code=401)
|
|
monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **kw: mock_client)
|
|
|
|
async def _run() -> None:
|
|
await github_comments.fetch_pr_comments_since_last_tag(
|
|
{"owner": "o", "name": "r"},
|
|
pr_number=42,
|
|
token="revoked",
|
|
)
|
|
|
|
with pytest.raises(github_token.GitHubAuthError):
|
|
asyncio.run(_run())
|
|
|
|
|
|
def test_fetch_issue_comments_raises_on_401(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
mock_client = _MockHttpxClient(status_code=401)
|
|
monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **kw: mock_client)
|
|
|
|
async def _run() -> None:
|
|
await github_comments.fetch_issue_comments(
|
|
{"owner": "o", "name": "r"},
|
|
issue_number=42,
|
|
token="revoked",
|
|
)
|
|
|
|
with pytest.raises(github_token.GitHubAuthError):
|
|
asyncio.run(_run())
|
|
|
|
|
|
# (c) successful re-auth following stale-cache invalidation -------------------
|
|
|
|
|
|
def test_process_github_pr_comment_invalidates_and_reauths_on_401(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
"""End-to-end check: a 401 on react triggers invalidate + re-resolve."""
|
|
from agent.webhooks import common as webhook_common
|
|
from agent.webhooks import github as github_webhooks
|
|
|
|
invalidated: dict[str, int] = {"calls": 0}
|
|
resolves: list[str] = []
|
|
react_calls: list[str] = []
|
|
fetch_calls: list[str] = []
|
|
|
|
async def fake_invalidate(thread_id: str) -> None:
|
|
invalidated["calls"] += 1
|
|
|
|
tokens = iter(["stale-token", "fresh-token"])
|
|
|
|
async def fake_get_or_resolve(thread_id: str, email: str, *, repo: Any = None) -> str | None:
|
|
token = next(tokens)
|
|
resolves.append(token)
|
|
return token
|
|
|
|
async def fake_react(
|
|
repo_config: dict[str, str],
|
|
comment_id: int,
|
|
*,
|
|
event_type: str,
|
|
token: str,
|
|
pull_number: int | None = None,
|
|
node_id: str | None = None,
|
|
) -> bool:
|
|
react_calls.append(token)
|
|
if token == "stale-token":
|
|
raise github_comments.GitHubAuthError("revoked")
|
|
return True
|
|
|
|
async def fake_fetch_pr_comments(
|
|
repo_config: dict[str, str], pr_number: int, *, token: str
|
|
) -> list[dict[str, Any]]:
|
|
fetch_calls.append(token)
|
|
return [
|
|
{"body": "@openswe please look", "author": "octo", "created_at": "2026-01-01T00:00:00Z"}
|
|
]
|
|
|
|
async def fake_extract_pr_context(
|
|
payload: dict[str, Any], event_type: str
|
|
) -> tuple[dict[str, str], int, str, str, str, int, str | None]:
|
|
return (
|
|
{"owner": "o", "name": "r"},
|
|
7,
|
|
"open-swe/00000000-0000-0000-0000-000000000001",
|
|
"octo",
|
|
"https://github.com/o/r/pull/7",
|
|
42,
|
|
None,
|
|
)
|
|
|
|
async def fake_trigger_or_queue_run(*args: Any, **kwargs: Any) -> None:
|
|
return None
|
|
|
|
monkeypatch.setattr(webhook_common, "extract_pr_context", fake_extract_pr_context)
|
|
monkeypatch.setattr(webhook_common, "_get_or_resolve_thread_github_token", fake_get_or_resolve)
|
|
monkeypatch.setattr(webhook_common, "invalidate_cached_github_token", fake_invalidate)
|
|
monkeypatch.setattr(webhook_common, "react_to_github_comment", fake_react)
|
|
monkeypatch.setattr(webhook_common, "fetch_pr_comments_since_last_tag", fake_fetch_pr_comments)
|
|
monkeypatch.setattr(webhook_common, "_trigger_or_queue_run", fake_trigger_or_queue_run)
|
|
monkeypatch.setattr(
|
|
webhook_common,
|
|
"email_for_login",
|
|
lambda login: asyncio.sleep(0, result="octo@example.com" if login == "octo" else None),
|
|
)
|
|
|
|
asyncio.run(
|
|
github_webhooks.process_github_pr_comment(
|
|
{"sender": {"login": "octo", "id": 1}},
|
|
"issue_comment",
|
|
)
|
|
)
|
|
|
|
assert invalidated["calls"] == 1
|
|
assert resolves == ["stale-token", "fresh-token"]
|
|
assert react_calls == ["stale-token", "fresh-token"]
|
|
assert fetch_calls == ["fresh-token"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_publish_review_invalidates_cached_token_on_401(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
import importlib
|
|
|
|
publish_review_module = importlib.import_module("agent.tools.publish_review")
|
|
|
|
invalidated: dict[str, int] = {"calls": 0}
|
|
|
|
async def fake_invalidate(thread_id: str) -> None:
|
|
invalidated["calls"] += 1
|
|
invalidated["thread_id"] = thread_id # type: ignore[assignment]
|
|
|
|
async def fake_publish(*args: Any, **kwargs: Any) -> dict[str, Any]:
|
|
raise github_token.GitHubAuthError("401 from PR review")
|
|
|
|
monkeypatch.setattr(
|
|
publish_review_module,
|
|
"get_config",
|
|
lambda: {
|
|
"configurable": {
|
|
"repo": {"owner": "o", "name": "r"},
|
|
"pr_number": 7,
|
|
"head_sha": "deadbeef",
|
|
},
|
|
},
|
|
)
|
|
monkeypatch.setattr(publish_review_module, "get_github_token", lambda: "revoked-token")
|
|
monkeypatch.setattr(publish_review_module, "invalidate_cached_github_token", fake_invalidate)
|
|
monkeypatch.setattr(publish_review_module, "_publish_review_async", fake_publish)
|
|
monkeypatch.setattr(publish_review_module, "get_thread_id_from_runtime", lambda: "thread-xyz")
|
|
|
|
result = await publish_review_module.publish_review()
|
|
assert result["success"] is False
|
|
assert "401" in result["error"]
|
|
assert invalidated["calls"] == 1
|
|
assert invalidated.get("thread_id") == "thread-xyz"
|