Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/tests/test_setup_onboarding.py

@@ -93,12 +93,59 @@ def test_portainer_config_save_never_returns_secret(api_client):
         "verifyTls": False,
     }
     assert secret not in str(payload)
-
     all_settings = api_client.get("/api/settings/connectors").json()
     assert secret not in str(all_settings)
     assert next(item for item in all_settings if item["connectorId"] == "portainer")["hasSecret"] is True
 
 
+def test_generic_authentik_setup_cannot_set_or_overwrite_forge_oidc_binding(api_client):
+    import json
+
+    from sqlmodel import Session
+
+    from backend.app.db import session as db_session
+    from backend.app.schemas.forge_oidc import FORGE_OIDC_BINDING_SECRET_REF
+    from backend.app.services.secret_store import get_secret, set_secret
+    from backend.app.services.setup_service import _apply_forge_oidc_binding_to_runtime
+    from backend.app.core.config import settings
+
+    binding = json.dumps(
+        {
+            "version": 1,
+            "providerId": "31",
+            "scopeMappingIds": {
+                "openid": "75a34fd6-cc81-40b8-a8c3-2745af9567ab",
+                "email": "312810bb-11da-47d8-97d4-f2155348eaa2",
+                "profile": "7aa8c5f8-5e8e-4a1b-9c11-3a4f0a731cff",
+            },
+        }
+    )
+    with Session(db_session.engine) as session:
+        set_secret(session, FORGE_OIDC_BINDING_SECRET_REF, binding)
+
+    rejected = api_client.patch(
+        "/api/settings/connectors/authentik",
+        json={"forgeOidcBinding": binding, "providerId": "999"},
+    )
+    assert rejected.status_code == 422
+
+    saved = api_client.patch(
+        "/api/settings/connectors/authentik",
+        json={"url": "https://auth.example-host.com", "secret": "GENERIC_AUTHENTIK_TOKEN"},
+    )
+    assert saved.status_code == 200
+    assert binding not in saved.text
+    assert "GENERIC_AUTHENTIK_TOKEN" not in saved.text
+    with Session(db_session.engine) as session:
+        assert get_secret(session, FORGE_OIDC_BINDING_SECRET_REF, touch=False) == binding
+        assert _apply_forge_oidc_binding_to_runtime(session) is True
+    assert settings.apis["AUTHENTIK_FORGE_OIDC_PROVIDER_ID"] == "31"
+
+    all_settings = api_client.get("/api/settings/connectors").json()
+    assert binding not in str(all_settings)
+    assert "GENERIC_AUTHENTIK_TOKEN" not in str(all_settings)
+
+
 def test_portainer_config_save_trims_safe_fields(api_client):
     payload = api_client.patch(
         "/api/settings/connectors/portainer",