test: cover the per-user OAuth flow, threat cases, store and startup

tests/test_transports_startup.py

@@ -14,6 +14,7 @@ from mcp.client.stdio import StdioServerParameters, stdio_client
 from aegis_gitea_mcp import cli, transports
 from aegis_gitea_mcp.cli import main
 from aegis_gitea_mcp.config import Settings
+from aegis_gitea_mcp.oauth import OAuthSetupError
 from aegis_gitea_mcp.transports import (
     HttpAuthExtras,
     http_startup_errors,
@@ -216,16 +217,21 @@ def test_oauth_misconfiguration_lists_every_missing_setting(
     assert uvicorn_spy.calls == []
 
 
-def test_oauth_enabled_but_unavailable_does_not_start_without_a_bearer(
-    uvicorn_spy: UvicornSpy, capsys: pytest.CaptureFixture[str]
+def test_oauth_enabled_but_unavailable_does_not_start(
+    uvicorn_spy: UvicornSpy, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    assert run_http(oauth_settings()) == 2
+    def broken(settings: Settings) -> HttpAuthExtras:
+        raise OAuthSetupError("token store unreadable")
 
-    assert "not available in this build" in capsys.readouterr().err
+    monkeypatch.setattr(transports, "load_oauth_components", broken)
+
+    assert run_http(oauth_settings(mcp_bearer_token=BEARER_TOKEN)) == 2
+
+    assert "per-user OAuth cannot start: token store unreadable" in capsys.readouterr().err
     assert uvicorn_spy.calls == []
 
 
-def test_oauth_enabled_with_a_bearer_falls_back_to_the_bearer(uvicorn_spy: UvicornSpy) -> None:
+def test_oauth_enabled_with_a_bearer_serves_both(uvicorn_spy: UvicornSpy) -> None:
     assert run_http(oauth_settings(mcp_bearer_token=BEARER_TOKEN)) == 0
     assert len(uvicorn_spy.calls) == 1
 
@@ -245,8 +251,17 @@ def test_oauth_components_are_used_when_available(
     assert len(uvicorn_spy.calls) == 1
 
 
-def test_default_oauth_components_hook_returns_none() -> None:
-    assert load_oauth_components(oauth_settings()) is None
+def test_default_oauth_components_hook_builds_the_oauth_components() -> None:
+    extras = load_oauth_components(oauth_settings())
+
+    assert extras.auth_server_provider is not None
+    assert extras.token_verifier is not None and extras.resolver is not None
+
+
+def test_startup_errors_without_oauth_components() -> None:
+    errors = http_startup_errors(oauth_settings(mcp_bearer_token=BEARER_TOKEN), None)
+
+    assert errors == ["OAUTH_ENABLED=true but per-user OAuth could not be set up"]
 
 
 def test_bearer_without_gitea_token_is_refused(