lundberg/porchlight
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
porchlight/tests
History
Johan Lundberg b284cf596b
fix(oidc): return 400 instead of 500 on bad token requests 
The token endpoint wrapped parse_request in try/except but
  called process_request and do_response unguarded, so a parseable-but-invalid request (e.g. a refresh_token grant missing client_id, or an
  unknown token) made idpyoidc raise and surfaced as a 500. Wrap both so failures return a clean 400 invalid_request and log the traceback
  server-side. Adds a regression test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 14:37:01 +02:00
..
e2e fix(security): require CSRF-protected POST to consume a registration link 2026-06-05 13:40:30 +02:00
test_admin fix(security): prevent removing the last active admin 2026-06-05 13:31:39 +02:00
test_auth_routes fix(security): POST WebAuthn login-begin; render JS errors as text 2026-06-05 14:04:24 +02:00
test_authn fix(security): reject WebAuthn signature-counter rollback 2026-06-05 13:53:10 +02:00
test_invite fix(security): consume magic-link tokens atomically 2026-06-04 10:46:38 +02:00
test_manage chore: create package structure with src layout 2026-02-12 14:39:07 +01:00
test_oidc fix(oidc): return 400 instead of 500 on bad token requests 2026-06-10 14:37:01 +02:00
test_store fix(security): enforce globally-unique WebAuthn credential_id 2026-06-05 13:51:09 +02:00
__init__.py chore: create package structure with src layout 2026-02-12 14:39:07 +01:00
conftest.py fix(security): lock down signing-key file permissions 2026-06-08 15:21:27 +02:00
test_admin_groups_validation.py fix(security): reset session on login to prevent fixation 2026-06-04 14:23:08 +02:00
test_admin_invite_validation.py fix(security): reset session on login to prevent fixation 2026-06-04 14:23:08 +02:00
test_app.py feat(security): add baseline security-header middleware 2026-06-10 08:53:49 +02:00
test_authn_active.py fix(security): require CSRF-protected POST to consume a registration link 2026-06-05 13:40:30 +02:00
test_cli.py feat: add initial-admin CLI command 2026-02-18 11:29:13 +01:00
test_client_registration.py fix(security): lock down signing-key file permissions 2026-06-08 15:21:27 +02:00
test_config.py refactor: fix lint warnings and remove stale type: ignore comments 2026-02-18 13:08:03 +01:00
test_csrf.py fix(csrf): replay request body consumed during token validation 2026-06-10 13:07:02 +02:00
test_manage_profile.py feat: wire ProfileUpdate validation into manage profile route 2026-03-10 15:36:47 +01:00
test_models.py update all imports in test files: fastapi_oidc_op → porchlight 2026-02-16 15:34:53 +01:00
test_password_change.py fix(security): require CSRF-protected POST to consume a registration link 2026-06-05 13:40:30 +02:00
test_rate_limit.py fix(security): make rate-limit client IP proxy-aware 2026-06-05 13:35:29 +02:00
test_userid.py update all imports in test files: fastapi_oidc_op → porchlight 2026-02-16 15:34:53 +01:00
test_validation.py fix(security): escape user input in validation error HTML 2026-06-04 10:23:32 +02:00