From bb999c680543bc53aac83f04a1bf0fbd0e093c95 Mon Sep 17 00:00:00 2001 From: maziggy Date: Sun, 19 Apr 2026 08:13:17 +0200 Subject: [PATCH] Post work PR #1024 --- backend/tests/integration/test_mfa_api.py | 35 ++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/backend/tests/integration/test_mfa_api.py b/backend/tests/integration/test_mfa_api.py index d7fe1a543..643a8e9e2 100644 --- a/backend/tests/integration/test_mfa_api.py +++ b/backend/tests/integration/test_mfa_api.py @@ -3196,7 +3196,7 @@ class TestOIDCIssuerUrlTrailingSlash: class TestOIDCCallbackCodeLength: - """OIDC callback code query param must accept up to 2048 characters (OAuth spec).""" + """OIDC callback code/state query params must accept up to 2048 characters (OAuth spec).""" @pytest.mark.asyncio @pytest.mark.integration @@ -3230,3 +3230,36 @@ class TestOIDCCallbackCodeLength: follow_redirects=False, ) assert resp.status_code == 422, "2049-char code must be rejected by Pydantic" + + @pytest.mark.asyncio + @pytest.mark.integration + async def test_state_512_chars_accepted(self, async_client: AsyncClient): + """A 512-character state (old limit) must not be rejected with 422.""" + state = "a" * 512 + resp = await async_client.get( + f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}", + follow_redirects=False, + ) + assert resp.status_code != 422, "512-char state must not be rejected by Pydantic" + + @pytest.mark.asyncio + @pytest.mark.integration + async def test_state_2048_chars_accepted(self, async_client: AsyncClient): + """A 2048-character state must not be rejected with 422.""" + state = "a" * 2048 + resp = await async_client.get( + f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}", + follow_redirects=False, + ) + assert resp.status_code != 422, "2048-char state must not be rejected by Pydantic" + + @pytest.mark.asyncio + @pytest.mark.integration + async def test_state_2049_chars_rejected(self, async_client: AsyncClient): + """A 2049-character state must be rejected with 422.""" + state = "a" * 2049 + resp = await async_client.get( + f"/api/v1/auth/oidc/callback?code=bogus-code&state={state}", + follow_redirects=False, + ) + assert resp.status_code == 422, "2049-char state must be rejected by Pydantic"