mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-07 16:19:09 +00:00
Adam Moussa
ba9865e1cf
get_github_token_for_user folded the raw upstream response text into the error string that becomes a Slack/Linear comment (AUTH-RESP-LEAK-01). Log the full body server-side only and return a generic "GitHub auth failed (status <code>)". Also document the accepted shared-installation-token blast radius on the bot-token-only path (AUTHZ-003).
55 lines
1.5 KiB
Python
55 lines
1.5 KiB
Python
"""AUTH-RESP-LEAK-01: upstream auth-error bodies must not reach user-facing text."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from typing import Any
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from agent.utils import auth
|
|
|
|
_SECRET_BODY = "SENSITIVE-UPSTREAM-BODY-9999"
|
|
|
|
|
|
class _Resp:
|
|
def __init__(self, status_code: int, text: str) -> None:
|
|
self.status_code = status_code
|
|
self.text = text
|
|
|
|
def raise_for_status(self) -> None:
|
|
raise httpx.HTTPStatusError(
|
|
"boom",
|
|
request=httpx.Request("POST", "http://example.test"),
|
|
response=self, # type: ignore[arg-type]
|
|
)
|
|
|
|
def json(self) -> Any:
|
|
return {}
|
|
|
|
|
|
class _Client:
|
|
def __init__(self, resp: _Resp) -> None:
|
|
self._resp = resp
|
|
|
|
async def __aenter__(self) -> _Client:
|
|
return self
|
|
|
|
async def __aexit__(self, *_a: Any) -> None:
|
|
return None
|
|
|
|
async def post(self, *_a: Any, **_k: Any) -> _Resp:
|
|
return self._resp
|
|
|
|
|
|
def test_http_error_returns_generic_message(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.setattr(auth, "GITHUB_OAUTH_PROVIDER_ID", "provider-id")
|
|
monkeypatch.setattr(auth, "X_SERVICE_AUTH_JWT_SECRET", "jwt-secret")
|
|
monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **k: _Client(_Resp(500, _SECRET_BODY)))
|
|
|
|
result = asyncio.run(auth.get_github_token_for_user("ls-user", "tenant"))
|
|
|
|
assert "error" in result
|
|
assert _SECRET_BODY not in result["error"]
|
|
assert "500" in result["error"]
|