public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-10-17 11:25:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Post work PR #1024

Browse Source
This commit is contained in:
maziggy
2026-04-19 08:13:17 +02:00
parent e958b10f75
commit bb999c6805
1 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/integration/test_mfa_api.py
+34 -1
View File
@@ -3196,7 +3196,7 @@ class TestOIDCIssuerUrlTrailingSlash:
class TestOIDCCallbackCodeLength:
"""OIDC callback code query param must accept up to 2048 characters (OAuth spec)."""
"""OIDC callback code/state query params must accept up to 2048 characters (OAuth spec)."""
@pytest.mark.asyncio
@pytest.mark.integration
@@ -3230,3 +3230,36 @@ class TestOIDCCallbackCodeLength:
follow_redirects=False,
)
assert resp.status_code == 422, "2049-char code must be rejected by Pydantic"
@pytest.mark.asyncio
@pytest.mark.integration
async def test_state_512_chars_accepted(self, async_client: AsyncClient):
"""A 512-character state (old limit) must not be rejected with 422."""
state = "a" * 512
resp = await async_client.get(
f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}",
follow_redirects=False,
)
assert resp.status_code != 422, "512-char state must not be rejected by Pydantic"
@pytest.mark.asyncio
@pytest.mark.integration
async def test_state_2048_chars_accepted(self, async_client: AsyncClient):
"""A 2048-character state must not be rejected with 422."""
state = "a" * 2048
resp = await async_client.get(
f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}",
follow_redirects=False,
)
assert resp.status_code != 422, "2048-char state must not be rejected by Pydantic"
@pytest.mark.asyncio
@pytest.mark.integration
async def test_state_2049_chars_rejected(self, async_client: AsyncClient):
"""A 2049-character state must be rejected with 422."""
state = "a" * 2049
resp = await async_client.get(
f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}",
follow_redirects=False,
)
assert resp.status_code == 422, "2049-char state must be rejected by Pydantic"