Marian c9ee259807 feat(oidc): refuse API writes to the env-managed provider ...

Startup rewrites this row from BAMBUDDY_OIDC_* on every boot, so an edit
through the UI would be accepted and then silently reverted at the next
restart -- the operator would watch their change vanish with nothing
explaining why. A 409 says so instead.

Covers all four mutating routes, including the two icon ones: the icon comes
from BAMBUDDY_OIDC_ICON_URL and would be restored the same way. Extracted as
one helper rather than four copies of the same check, so a fifth route cannot
be added with the guard silently missing.

Locking it is safe because BAMBUDDY_LOCAL_LOGIN (#1589) remains the documented
recovery path if the provider itself becomes unusable. A test pins that
UI-created providers stay editable -- the lock must not leak onto them.

Refs #2593

2026-07-28 21:05:29 +00:00

..

_fixtures

feat(auth): proxy OIDC provider icons server-side (#1333) (#1342)

2026-05-15 08:50:37 +02:00

integration

feat(oidc): refuse API writes to the env-managed provider

2026-07-28 21:05:29 +00:00

unit

feat(oidc): read BAMBUDDY_OIDC_* env config

2026-07-28 21:05:29 +00:00

__init__.py

…

conftest.py

feat(projects): per-file print progress and complete-sets tracking (#1897)

2026-07-28 12:46:31 +02:00

pytest.ini

test(pytest): silence upstream starlette httpx2 deprecation noise

2026-05-30 14:19:19 +02:00