test: write failure paths, expired OAuth token, non-admin admin-tool refusals and webhook credential leak checks

tests/integration/test_scenario_release_hooks.py

@@ -238,10 +238,15 @@ async def test_webhook_lifecycle(
                 f"{prefix}_edit_hook",
                 f"{prefix}_delete_hook",
             )
+        # The signing secret and the Authorization header are credentials: neither may come
+        # back in any result or reach the audit log (Gitea itself omits the secret).
+        secret = f"hook-secret-{secrets.token_hex(12)}"
+        header = f"Bearer hook-auth-{secrets.token_hex(12)}"
+        config = {**HOOK_CONFIG, "secret": secret, "authorization_header": header}
         hook = await mcp.ok(
             create,
             status=201,
-            body={"type": "gitea", "config": HOOK_CONFIG, "events": ["push"], "active": True},
+            body={"type": "gitea", "config": config, "events": ["push"], "active": True},
             **scope,
         )
         hook_id = hook.data["id"]
@@ -252,7 +257,10 @@ async def test_webhook_lifecycle(
         assert hook_id in [item["id"] for item in hooks.data]
         assert (await mcp.ok(get, id=hook_id, **scope)).data["config"]["url"] == HOOK_CONFIG["url"]
         edited = await mcp.ok(
-            edit, id=hook_id, body={"active": False, "events": ["push", "issues"]}, **scope
+            edit,
+            id=hook_id,
+            body={"active": False, "events": ["push", "issues"], "config": config},
+            **scope,
         )
         assert edited.data["active"] is False
         assert "issues" in edited.data["events"]
@@ -260,6 +268,9 @@ async def test_webhook_lifecycle(
             await mcp.ok("gitea_hook_repo_test_hook", id=hook_id, **scope)
         await mcp.ok(delete, id=hook_id, **scope)
         await mcp.fail(get, 404, id=hook_id, **scope)
+        for credential in (secret, header, header.removeprefix("Bearer ")):
+            assert all(credential not in text for text in mcp.texts), "a webhook credential leaked"
+            assert credential not in mcp.audit_text(), "a webhook credential reached the audit log"
     finally:
         if level == "org":
             drop_org(gitea, org)