44 lines
1.9 KiB
Python
44 lines
1.9 KiB
Python
"""Tools the generic sweep must not call because they would break the run itself."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
from mcp import Client
|
|
|
|
from aegis_gitea_mcp.audit import AuditLogger
|
|
from aegis_gitea_mcp.server import build_server
|
|
from tests.integration.conftest import McpSession, integration_settings
|
|
from tests.integration.harness import GiteaInstance
|
|
from tests.integration.sweep_plan import EXCLUDED
|
|
|
|
|
|
async def test_delete_current_token_deletes_only_a_throwaway_token(
|
|
gitea: GiteaInstance, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
assert set(EXCLUDED) == {"gitea_misc_delete_current_token"}
|
|
monkeypatch.setenv("GITEA_URL", gitea.base_url)
|
|
throwaway = gitea.mint_token(gitea.admin_login, gitea.admin_password, ["all"])
|
|
settings = integration_settings(gitea, tmp_path / "state", gitea_token=throwaway)
|
|
audit = AuditLogger(settings.resolved_audit_log_path)
|
|
try:
|
|
async with Client(build_server(settings, audit=audit)) as client:
|
|
session = McpSession(client, settings.resolved_audit_log_path)
|
|
current = await session.ok("gitea_misc_get_current_token")
|
|
assert "all" in current.data["scopes"]
|
|
assert gitea.api("GET", "/user", token=throwaway).status_code == 200
|
|
|
|
deleted = await session.ok("gitea_misc_delete_current_token")
|
|
assert deleted.data is None
|
|
assert throwaway not in session.audit_text()
|
|
|
|
# The token is gone: Gitea now refuses it, while the harness admin token lives on.
|
|
assert gitea.api("GET", "/user", token=throwaway).status_code == 401
|
|
assert gitea.api("GET", "/user").status_code == 200
|
|
again = await session.call("gitea_misc_get_current_token")
|
|
assert again.is_error and again.status == 401
|
|
assert throwaway not in again.text
|
|
finally:
|
|
audit.close()
|