Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_gitea_access_diagnostics.py

@@ -0,0 +1,91 @@
+"""Safe access diagnostics preserve the stable client error contract."""
+
+import json
+from uuid import UUID
+
+import httpx
+import pytest
+
+from packages.connector_kit.gitea import (
+    GiteaClient,
+    GiteaError,
+    GiteaSettings,
+    RegisteredRepository,
+    StaticTokenProvider,
+)
+
+SECRET_REFERENCE = "docker-secret://" + "test"
+
+
+@pytest.mark.parametrize("status", [401, 403])
+@pytest.mark.parametrize(
+    ("method", "path", "scope"),
+    [
+        ("POST", "user/repos", "write:user"),
+        ("GET", "user/repos", "read:user"),
+        ("GET", "repos/private-owner/private-name", None),
+    ],
+)
+def test_access_diagnostics_are_specific_sanitized_and_not_retried(status, method, path, scope):
+    calls = []
+
+    def upstream(request):
+        calls.append(request)
+        return httpx.Response(status, json={"message": "upstream-secret-value"})
+
+    client = GiteaClient(
+        GiteaSettings(base_url="https://gitea.example", token_reference=SECRET_REFERENCE),
+        StaticTokenProvider("credential-secret-value"),
+        transport=httpx.MockTransport(upstream),
+    )
+    try:
+        with pytest.raises(GiteaError) as caught:
+            client._request(path, method=method)
+        error = caught.value
+        envelope = error.envelope(operation="test")
+        assert error.code == "GITEA_ACCESS_DENIED"
+        assert error.upstream_status == status
+        assert error.category == ("authentication" if status == 401 else "permission")
+        assert not error.retryable and not error.safe_to_retry
+        assert len(calls) == 1
+        rendered = json.dumps(envelope)
+        for forbidden in [
+            "upstream-secret-value",
+            "credential-secret-value",
+            "private-owner",
+            "private-name",
+        ]:
+            assert forbidden not in rendered
+        if status == 403 and scope:
+            assert scope in error.recovery_hint
+        else:
+            assert "write:user" not in error.recovery_hint
+            assert "read:user" not in error.recovery_hint
+    finally:
+        client.close()
+
+
+@pytest.mark.parametrize("status", [401, 403])
+def test_log_access_uses_the_same_safe_diagnostics(status):
+    client = GiteaClient(
+        GiteaSettings(base_url="https://gitea.example", token_reference=SECRET_REFERENCE),
+        StaticTokenProvider("fixture-token"),
+        transport=httpx.MockTransport(
+            lambda request: httpx.Response(status, text="upstream-secret")
+        ),
+    )
+    repo = RegisteredRepository(
+        repository_ref="test",
+        project_id=UUID(int=1),
+        owner="owner",
+        name="repo",
+        source_uri="itworx-git://test/test",
+    )
+    try:
+        with pytest.raises(GiteaError) as caught:
+            client.action_job_logs(repo, 1)
+        assert caught.value.upstream_status == status
+        assert caught.value.category == ("authentication" if status == 401 else "permission")
+        assert "upstream-secret" not in json.dumps(caught.value.envelope(operation="logs"))
+    finally:
+        client.close()